Torjan polis ucash

19 november, 2012

Tja.

Lyckats så klart inplantera virus i min käre farbror dator, Det gär Ukash polisen 1000kr betala bla bla. Kan inte göra ett skit.

Har kört lite virusprogram osv i felsäkert läge men det verkar inte vilja ge med sig så körde DDS och fick lite loggar som är helt obegripligt enligt mig men man kan ju inte vara bäst på allt

Tack på förhand för hjälpen!

Till loggarna då:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 2010-06-11 16:24:23

System Uptime: 2012-11-19 20:46:15 (1 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5Q PRO TURBO

Processor: Intel® Core2 Quad CPU Q8300 @ 2.50GHz | LGA 775 | 2499/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 931 GiB total, 421,522 GiB free.

D: is CDROM ()

E: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: ehdrv

Device ID: ROOT\LEGACY_EHDRV\0000

Manufacturer:

Name: ehdrv

PNP Device ID: ROOT\LEGACY_EHDRV\0000

Service: ehdrv

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Security Processor Loader Driver

Device ID: ROOT\LEGACY_SPLDR\0000

Manufacturer:

Name: Security Processor Loader Driver

PNP Device ID: ROOT\LEGACY_SPLDR\0000

Service: spldr

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: sptd

Device ID: ROOT\LEGACY_SPTD\0000

Manufacturer:

Name: sptd

PNP Device ID: ROOT\LEGACY_SPTD\0000

Service: sptd

.

==== System Restore Points ===================

.

RP139: 2012-10-10 11:22:19 - Windows Update

RP140: 2012-10-12 19:56:20 - Installed Quake Live Internet Explorer Plugin

RP141: 2012-10-20 22:08:25 - Schemalagd kontrollpunkt

RP142: 2012-11-09 17:06:15 - Schemalagd kontrollpunkt

RP143: 2012-11-17 00:00:05 - Schemalagd kontrollpunkt

RP144: 2012-11-17 00:49:48 - Windows Update

RP145: 2012-11-18 15:16:45 - Windows Update

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Reader 9.3 - Svenska

Apple-programstöd

Apple Mobile Device Support

Apple Software Update

Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver

µTorrent

Bonjour

Call of Duty: Black Ops

Call of Duty: Black Ops - Multiplayer

Call of Duty: Modern Warfare 2

Call of Duty: Modern Warfare 2 - Multiplayer

Convert AVI to MP4 1.3

Counter-Strike

DAEMON Tools Toolbar

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Diablo III

ElfBot NG 4.5.9

EPU-6 Engine

ESET NOD32 Antivirus

ESN Sonar

Express Gate

GameXN GO

Google Chrome

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Heroes of Newerth

iTunes

Java Auto Updater

Java 6 Update 23

JMicron JMB36X Driver

Left 4 Dead 2

Malwarebytes Anti-Malware version 1.65.1.1000

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office 2010 Language Pack Service Pack 1 (SP1)

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access MUI (Swedish) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Excel MUI (Swedish) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office Groove MUI (Swedish) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office InfoPath MUI (Swedish) 2010

Microsoft Office Language Pack 2010 - Swedish/svenska

Microsoft Office O MUI (Swedish) 2010

Microsoft Office Office 32-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office OneNote MUI (Swedish) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office Outlook MUI (Swedish) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office PowerPoint MUI (Swedish) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (Finnish) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (German) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proof (Swedish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Proofing (Swedish) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Publisher MUI (Swedish) 2010

Microsoft Office Shared 32-bit MUI (English) 2010

Microsoft Office Shared 32-bit MUI (Swedish) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared MUI (Swedish) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office SharePoint Designer MUI (Swedish) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Office Word MUI (Swedish) 2010

Microsoft Office X MUI (Swedish) 2010

Microsoft SharePoint Designer 2010 Service Pack 1 (SP1)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

MobileMe Control Panel

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 8 Essentials

neroxml

NVIDIA-uppdatering 1.10.8

NVIDIA 3D Vision drivrutin 306.97

NVIDIA 3D Vision drivrutin för styrenhet 301.42

NVIDIA Display Control Panel

NVIDIA Grafikdrivrutin 306.97

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX systemprogramvara 9.12.0213

NVIDIA Stereoscopic 3D Driver

NVIDIA Update Components

NVIDIAs kontrollpanel 306.97

Octoshape add-in for Adobe Flash Player

Platform

Poker at bet365

PunkBuster Services

Quake Live Internet Explorer Plugin

QuickTime

Safari

Skype Toolbars

Skype™ 5.10

Spotify

StarCraft II

Steam

Svenska Spels Poker

System Requirements Lab

System Requirements Lab CYRI

Turbo Key

TurboV

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

VCRedistSetup

VentriloMIX

VIA Plattform för enhetshanterare

Windows Live Communications Platform

Windows Live Essentials

Windows Live inloggningsassistenten

Windows Live Messenger

Windows Live Upload Tool

WinRAR

VLC media player 2.0.1

.

==== End Of File ===========================

DDS (Ver_2012-11-07.01) - NTFS_AMD64 NETWORK

Internet Explorer: 9.0.8112.16455

Run by JIM at 21:04:12 on 2012-11-19

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.46.1053.18.4095.2556 [GMT 1:00]

.

AV: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {CB0F8167-5331-BA19-698E-64816B6801A5}

SP: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {706E6083-750B-B597-533E-5FF310EF4B18}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Windows\helppane.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\JIM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6GUTCUG\Ransom_unlock.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.se/

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

BHO: Windows Live inloggningshjälpen: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"

uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [spotify Web Helper] "C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe"

uRun: [rwepfrwvqmkedzf] C:\Windows\rwepfrwv.exe

mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

mRun: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe"

mRun: [Turbo Key] "C:\Program Files\ASUS\Turbo Key\TurboKey.exe"

mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe

mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{463DFB51-CDA3-4A23-937F-1F85AA42F57C} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{6D28D63B-9B4A-4C58-9BCD-E207B8666BFD} : DHCPNameServer = 130.244.127.161 130.244.127.169

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-TB: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

.

============= SERVICES / DRIVERS ===============

.

S2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2010-6-13 90112]

S2 DvmMDES;DeviceVM Meta Data Export Service;C:\ASUS.SYS\config\DVMExportService.exe [2009-2-18 294912]

S2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-9-29 735960]

S2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2009-9-29 123200]

S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-19 399432]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-19 676936]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-2 382824]

S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-11-19 25928]

S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2011-5-10 22528]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]

S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-20 1255736]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2010-6-13 1196032]

.

=============== Created Last 30 ================

.

2012-11-19 19:42:17 -------- d-----w- C:\Users\JIM\AppData\Roaming\Malwarebytes

2012-11-19 19:42:08 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-11-19 19:42:08 -------- d-----w- C:\ProgramData\Malwarebytes

2012-11-19 19:42:08 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-11-19 17:37:13 -------- d-----w- C:\ProgramData\ujgxrmmbqvdhubu

2012-11-19 17:37:10 105472 ----a-w- C:\Windows\rwepfrwv.exe

2012-11-19 17:37:10 105472 ----a-w- C:\ProgramData\rwepfrwv.exe

2012-11-17 20:47:57 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys

2012-11-17 20:47:25 -------- d-----w- C:\Program Files\iPod

2012-11-17 20:47:24 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-11-17 20:47:24 -------- d-----w- C:\Program Files\iTunes

2012-11-17 20:47:24 -------- d-----w- C:\Program Files (x86)\iTunes

2012-11-16 14:40:54 3147264 ----a-w- C:\Windows\System32\win32k.sys

2012-11-16 14:40:41 95744 ----a-w- C:\Windows\System32\synceng.dll

2012-11-16 14:40:41 78336 ----a-w- C:\Windows\SysWow64\synceng.dll

.

==================== Find3M ====================

.

2012-10-10 20:22:54 2428776 ----a-w- C:\Windows\SysWow64\nvapi.dll

2012-10-10 20:22:52 26331496 ----a-w- C:\Windows\System32\nvoglv64.dll

2012-10-10 20:22:52 1760104 ----a-w- C:\Windows\System32\nvdispco64.dll

2012-10-10 20:22:32 15309160 ----a-w- C:\Windows\SysWow64\nvd3dum.dll

2012-10-10 20:22:26 2747240 ----a-w- C:\Windows\System32\nvcuvid.dll

2012-10-10 20:22:24 19906920 ----a-w- C:\Windows\SysWow64\nvoglv32.dll

2012-10-10 20:22:18 13443944 ----a-w- C:\Windows\System32\drivers\nvlddmkm.sys

2012-10-10 20:22:14 17559912 ----a-w- C:\Windows\SysWow64\nvcompiler.dll

2012-10-08 18:42:16 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-08 18:42:16 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll

2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-10-02 19:51:11 3293544 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-10-02 19:51:04 6200680 ----a-w- C:\Windows\System32\nvcpl.dll

2012-10-02 19:50:57 891240 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-10-02 19:50:57 63336 ----a-w- C:\Windows\System32\nvshext.dll

2012-10-02 19:50:57 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll

2012-10-02 19:50:57 118120 ----a-w- C:\Windows\System32\nvmctray.dll

2012-10-02 12:15:52 430952 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2012-09-14 19:23:40 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-09-14 18:30:38 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-08-30 18:11:29 5505904 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-08-30 17:18:33 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-08-30 17:18:33 3902832 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-08-24 18:05:28 220160 ----a-w- C:\Windows\System32\wintrust.dll

2012-08-24 17:10:47 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

.

============= FINISH: 21:04:50,27 ===============

19 november, 2012

1.

Klicka på Start-knappen och skriv in följande i den lilla sökrutan: msconfig

Starta programmet msconfig som kommer upp i listan ovanför.

På fliken Autostart letar du upp raden som innehåller filnamnet: rwepfrwv.exe

Ta bort bocken för den raden.

Starta om datorn i normalt läge.

2.

Kör DDS igen och klistra in den nya DDS.txt i ditt svar.

3.

Spara RougueKiller på Skrivbordet.

http://www.sur-la-toile.com/RogueKiller/

Stäng av alla program.

Ta bort alla externa enheter, t ex USB-minnen och externa hårddiskar, utom tangentbord och mus. Låt dem vara bortkopplade medan rensningen pågår.

Kör RogueKiller (i Vista och Windows 7 högerklicka på programmet och välj "Kör som administratör). Om det inte går att köra så pröva flera gång, men om det fortfarande inte går så pröva med att döpa om programmet till winlogon.exe.

Vänta tills "Prescan" har avslutats.

Klicka på "Scan"-knappen uppe till höger.

Vänta tills skanningen är klar.

En rapport "RKreport.txt" ska då ha skapats på Skrivbordet. Klistra in innehållet i den i ditt svar.

19 november, 2012

Jag ser i DDS-loggen att det finns en väldigt gammal java-version med kända

säkerhetshål som gör det lätt att infektera datorn från en webbsida,

avinstallera Java 6 Update 23.

20 november, 2012

Här är de nya dds rapporterna:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 2010-06-11 16:24:23

System Uptime: 2012-11-20 20:08:43 (0 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5Q PRO TURBO

Processor: Intel® Core2 Quad CPU Q8300 @ 2.50GHz | LGA 775 | 1999/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 931 GiB total, 421,52 GiB free.

D: is CDROM ()

E: is Removable

F: is CDROM ()

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP139: 2012-10-10 11:22:19 - Windows Update

RP140: 2012-10-12 19:56:20 - Installed Quake Live Internet Explorer Plugin

RP141: 2012-10-20 22:08:25 - Schemalagd kontrollpunkt

RP142: 2012-11-09 17:06:15 - Schemalagd kontrollpunkt

RP143: 2012-11-17 00:00:05 - Schemalagd kontrollpunkt

RP144: 2012-11-17 00:49:48 - Windows Update

RP145: 2012-11-18 15:16:45 - Windows Update

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Reader 9.3 - Svenska

Apple-programstöd

Apple Mobile Device Support

Apple Software Update

Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver

µTorrent

Bonjour

Call of Duty: Black Ops

Call of Duty: Black Ops - Multiplayer

Call of Duty: Modern Warfare 2

Call of Duty: Modern Warfare 2 - Multiplayer

Convert AVI to MP4 1.3

Counter-Strike

DAEMON Tools Toolbar

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Diablo III

ElfBot NG 4.5.9

EPU-6 Engine

ESET NOD32 Antivirus

ESN Sonar

Express Gate

GameXN GO

Google Chrome

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Heroes of Newerth

iTunes

Java Auto Updater

Java 6 Update 23

JMicron JMB36X Driver

Left 4 Dead 2

Malwarebytes Anti-Malware version 1.65.1.1000

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office 2010 Language Pack Service Pack 1 (SP1)

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access MUI (Swedish) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Excel MUI (Swedish) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office Groove MUI (Swedish) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office InfoPath MUI (Swedish) 2010

Microsoft Office Language Pack 2010 - Swedish/svenska

Microsoft Office O MUI (Swedish) 2010

Microsoft Office Office 32-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office OneNote MUI (Swedish) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office Outlook MUI (Swedish) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office PowerPoint MUI (Swedish) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (Finnish) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (German) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proof (Swedish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Proofing (Swedish) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Publisher MUI (Swedish) 2010

Microsoft Office Shared 32-bit MUI (English) 2010

Microsoft Office Shared 32-bit MUI (Swedish) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared MUI (Swedish) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office SharePoint Designer MUI (Swedish) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Office Word MUI (Swedish) 2010

Microsoft Office X MUI (Swedish) 2010

Microsoft SharePoint Designer 2010 Service Pack 1 (SP1)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

MobileMe Control Panel

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 8 Essentials

neroxml

NVIDIA-uppdatering 1.10.8

NVIDIA 3D Vision drivrutin 306.97

NVIDIA 3D Vision drivrutin för styrenhet 301.42

NVIDIA Display Control Panel

NVIDIA Grafikdrivrutin 306.97

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX systemprogramvara 9.12.0213

NVIDIA Stereoscopic 3D Driver

NVIDIA Update Components

NVIDIAs kontrollpanel 306.97

Octoshape add-in for Adobe Flash Player

Platform

Poker at bet365

PunkBuster Services

Quake Live Internet Explorer Plugin

QuickTime

Safari

Skype Toolbars

Skype™ 5.10

Spotify

StarCraft II

Steam

Svenska Spels Poker

System Requirements Lab

System Requirements Lab CYRI

Turbo Key

TurboV

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

VCRedistSetup

VentriloMIX

VIA Plattform för enhetshanterare

Windows Live Communications Platform

Windows Live Essentials

Windows Live inloggningsassistenten

Windows Live Messenger

Windows Live Upload Tool

WinRAR

VLC media player 2.0.1

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16455

Run by JIM at 20:12:08 on 2012-11-20

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.46.1053.18.4095.2225 [GMT 1:00]

.

AV: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {CB0F8167-5331-BA19-698E-64816B6801A5}

SP: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {706E6083-750B-B597-533E-5FF310EF4B18}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\ASUS.SYS\config\DVMExportService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Windows\SysWOW64\IoctlSvc.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\Six Engine\SixEngine.exe

C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

C:\Program Files\ASUS\TurboV\TurboV.exe

C:\Program Files\ASUS\Turbo Key\TurboKey.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\msfeedssync.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wuauclt.exe