Avir el ngt liknande instalerade sig via Mozilla
#1
Skrivet 02 december 2009 - 15:47
Rensade tempfiler med CCleaner.
Körde MBAM igen, hittade inget.
Startade Mozilla igen, vilken omedelbart ville starta Fake Scannern igen.
Körde en TMHJ. se logg.
F-Secure scannar nu datorn!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:56, on 2009-12-02
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\vVX1000.exe
C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\F-Secure\Common\FSM32.EXE
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\F-Secure\FSGUI\fscuif.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.c...lt<mplcache=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Lokal tjänst')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Lokal tjänst')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Nätverkstjänst')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Nätverkstjänst')
O4 - Global Startup: OfficeSAS.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {FD60E04A-8F1B-4AC4-8F53-EC5124D610BA} - http://www.buypass.n...ate_5.2.0.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: F-Secure BlackLight Sensor - F-Secure Corporation - C:\Windows\TEMP\F-Secure\Anti-Virus\fsblsrv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 9773 bytes
- Inte din sorts mobil? Jämför priser på fler hos
#2
Skrivet 02 december 2009 - 16:22
Tydligen försvann det,för nu öppnade Mozilla utan att starta scanner processen!!
När scannerprogramet startade på webbsidan, (i Facebook)!, var vi snabba att öppna Aktivitetshanteraren o stoppa Mozilla.
FAKE ALARM kanske.
Hittar inget skit längre!!
Om ngn har ytterligare råd om att kolla mera.
Välkomna, men ingen kris!
Mvh
Mats H
Det här inlägget har redigerats av Mats H: 02 december 2009 - 16:22
#3
Skrivet 02 december 2009 - 16:41
Mange
Edit: Google är en bra kompis
* HP Pavilion DV6 1100 + Windows 8 Consumer Preview + Windows 7 x64 SP1 Dual Boot *
* HP 6530b (2st) + Windows 7 x86 SP1 *
#4
Skrivet 02 december 2009 - 16:56
Manneman, den 02 december 2009 - 16:41 , skrev:
Mange
Edit: Google är en bra kompis
Just det! En gammal budgetmodell!
#5
Skrivet 02 december 2009 - 17:27
Spara DDS på Skrivbordet.
http://download.blee...om/sUBs/dds.scr
Starta programmet (i Vista högerklicka och Kör som administratör).
Tryck Yes/Ja om frågan om Optional Scan dyker upp.
I ditt svar bifogar du de två loggarna DSS.txt och Attach.txt men i varsitt inlägg. Om du vet hur man använder spoiler-funktionen i svaret så använd det gärna på de två loggarna.
Om DDS inte fungerar för att du har 64-bitars Windows så tar vi ett annat program.
#6
Skrivet 02 december 2009 - 17:45
Cecilia, den 02 december 2009 - 17:27 , skrev:
Spara DDS på Skrivbordet.
http://download.blee...om/sUBs/dds.scr
Starta programmet (i Vista högerklicka och Kör som administratör).
Tryck Yes/Ja om frågan om Optional Scan dyker upp.
I ditt svar bifogar du de två loggarna DSS.txt och Attach.txt men i varsitt inlägg. Om du vet hur man använder spoiler-funktionen i svaret så använd det gärna på de två loggarna.
Om DDS inte fungerar för att du har 64-bitars Windows så tar vi ett annat program.
Här kommer DDS loggen:
DDS (Ver_09-12-01.01) - NTFSX64
Run by Busters at 17:39:17,87 on 2009-12-02
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_17
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.4085.2640 [GMT 1:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
C:\Program Files\Microsoft LifeCam\MSCamS64.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE
C:\Program Files (x86)\F-Secure\Common\FSHDLL64.EXE
C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\vVX1000.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\officeSASscheduler.exe
C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\F-Secure\Common\FSM32.EXE
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\OfficeSAS.exe
C:\Program Files (x86)\F-Secure\Spam Control\fsscoepl_x64.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
C:\Users\Busters\Desktop\dds.scr
C:\Windows\system32\conhost.exe
============== Pseudo HJT Report ===============
uSearch Page =
uStart Page = https://www.google.c...lt<mplcache=2
uSearch Bar =
mLocal Page = c:\windows\syswow64\blank.htm
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files (x86)\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~4\office14\GROOVEEX.DLL
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~4\office14\URLREDIR.DLL
BHO: Browsing Protection Class: {c6867eb7-8350-4856-877f-93cf8ae3dc9c} - c:\program files (x86)\f-secure\nrs\iescript\baselitmus.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - c:\program files (x86)\f-secure\nrs\iescript\baselitmus.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [MaxMenuMgr] "c:\program files (x86)\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [HP Software Update] c:\program files (x86)\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [F-Secure Manager] "c:\program files (x86)\f-secure\common\FSM32.EXE" /splash
mRun: [F-Secure TNB] "c:\program files (x86)\f-secure\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW
mRun: [LifeCam] "c:\program files (x86)\microsoft lifecam\LifeExp.exe"
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files (x86)\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office14\officesas\officeSASscheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files (x86)\microsoft office\office14\ONBttnIE.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files (x86)\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files (x86)\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files (x86)\microsoft office\office14\ONBttnIELinkedNotes.dll
LSP: c:\program files (x86)\f-secure\fsps\program\FSLSP.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {FD60E04A-8F1B-4AC4-8F53-EC5124D610BA} - hxxp://www.buypass.no/support/jnipcsc5/JniPcscUpdate_5.2.0.0.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~4\office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
mRun-x64: [VX1000] c:\windows\vVX1000.exe
mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
mRun-x64: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun-x64: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
================= FIREFOX ===================
FF - ProfilePath - c:\users\busters\appdata\roaming\mozilla\firefox\profiles\lawp3tqw.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=zpwhtygjntrz&scc=1<mpl=default<mplcache=2
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files (x86)\f-secure\nrs\litmus-ff@f-secure.com\components\litmus-ff.dll
FF - plugin: c:\progra~2\micros~4\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~4\office14\NPSPWRAP.DLL
FF - plugin: c:\program files (x86)\google\picasa3\npPicasa3.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");
============= SERVICES / DRIVERS ===============
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\f-secure\hips\drivers\fshs.sys [2009-11-9 57920]
R1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [2009-10-26 44480]
R1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-10-26 92160]
R1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\f-secure\anti-virus\minifilter\fsvista.sys [2009-11-9 14904]
R2 F-Secure Gatekeeper Handler Starter;FSGKHS;c:\program files (x86)\f-secure\anti-virus\fsgk32st.exe [2009-11-9 215648]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files (x86)\seagate\seagatemanager\sync\FreeAgentService.exe [2008-7-30 161064]
R2 TeamViewer4;TeamViewer 4;c:\program files (x86)\teamviewer\version4\TeamViewer_Service.exe [2009-10-7 185640]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\f-secure\anti-virus\minifilter\fsgk.sys [2009-11-9 151168]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\f-secure\orsp client\fsorsp.exe [2009-11-9 55936]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt64win7.sys [2009-3-1 187392]
S3 cxbu0x64;CardMan 3x21;c:\windows\system32\drivers\cxbu0x64.sys [2009-6-24 172544]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2009-10-29 50612600]
S3 ose64;Office 64 Source Engine;c:\program files\common files\microsoft shared\source engine\OSE.EXE [2009-9-26 174424]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26 4924336]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 15208]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2009-11-4 53312]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files (x86)\f-secure\anti-virus\win2k\fsfilter.sys [2009-11-9 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files (x86)\f-secure\anti-virus\win2k\fsrec.sys [2009-11-9 25184]
=============== Created Last 30 ================
2009-12-02 14:39:45 0 d-----w- c:\program files (x86)\Trend Micro
2009-11-29 15:51:40 0 d-----w- c:\users\busters\SecurityScans
2009-11-29 15:51:26 0 d-----w- c:\program files\Microsoft Baseline Security Analyzer 2
2009-11-29 10:42:39 149280 ----a-w- c:\windows\syswow64\javaws.exe
2009-11-29 10:42:39 145184 ----a-w- c:\windows\syswow64\javaw.exe
2009-11-29 10:42:39 145184 ----a-w- c:\windows\syswow64\java.exe
2009-11-28 18:42:03 455680 ----a-w- c:\windows\system32\deploytk.dll
2009-11-28 18:41:52 0 d-----w- c:\program files\Java
2009-11-28 18:32:55 0 d-----w- c:\program files (x86)\Secunia
2009-11-25 10:11:20 2048 ----a-w- c:\windows\syswow64\tzres.dll
2009-11-25 10:11:20 2048 ----a-w- c:\windows\system32\tzres.dll
2009-11-19 00:39:48 0 d-----w- c:\program files\Microsoft Synchronization Services
2009-11-19 00:39:38 0 d-----w- c:\program files\common files\DESIGNER
2009-11-19 00:38:47 0 d-----w- c:\program files\Microsoft Sync Framework
2009-11-19 00:38:47 0 d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-11-19 00:36:51 0 d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2009-11-19 00:35:45 0 d-----w- c:\program files\Microsoft Analysis Services
2009-11-19 00:35:45 0 d-----w- c:\program files (x86)\Microsoft Analysis Services
2009-11-19 00:35:09 0 d-----w- c:\programdata\Microsoft Help
2009-11-19 00:35:09 0 d-----w- c:\program files\Microsoft Office
2009-11-18 10:31:39 0 d-----w- c:\users\busters\appdata\roaming\PingPlotter
2009-11-18 10:18:16 0 d-----w- c:\program files (x86)\PingPlotter Pro
2009-11-18 07:21:47 0 d-----w- c:\program files\Microsoft LifeCam
2009-11-18 07:21:47 0 d-----w- c:\program files (x86)\Microsoft LifeCam
2009-11-11 00:29:02 715698 ----a-w- c:\windows\cscmondump.bin
2009-11-10 19:12:40 128651 ----a-w- c:\windows\cscmon.bin
2009-11-10 19:11:09 22280 ----a-w- c:\windows\system32\cnat.exe
2009-11-10 19:11:08 149536 ----a-w- c:\windows\system32\drivers\CFRMD.sys
2009-11-09 10:53:54 0 d-----w- c:\program files\Paint.NET
2009-11-09 09:57:47 0 d-----w- c:\program files (x86)\F-Secure
2009-11-07 15:53:44 196608 ----a-w- c:\windows\syswow64\anfysave.scr
2009-11-04 19:48:47 53312 ----a-w- c:\windows\system32\drivers\pssdk42.sys
2009-11-04 19:46:27 0 d---a-w- c:\programdata\TEMP
2009-11-03 06:28:40 5958656 ----a-w- c:\windows\syswow64\mshtml.dll
2009-11-02 19:32:12 0 d-----w- c:\program files (x86)\Raxco
==================== Find3M ====================
2009-11-29 10:42:25 411368 ----a-w- c:\windows\syswow64\deploytk.dll
2009-11-16 22:18:36 44 ---h--w- c:\program files (x86)\279fb068.tmp
2009-11-09 09:58:30 638616 ----a-w- c:\windows\system32\perfh01D.dat
2009-11-09 09:58:30 130328 ----a-w- c:\windows\system32\perfc01D.dat
2009-11-02 19:42:06 226688 ------w- c:\windows\system32\MpSigStub.exe
2009-10-30 00:29:08 2146304 ----a-w- c:\windows\syswow64\GPhotos.scr
2009-10-27 23:43:49 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WUDFUsbccidDriver_01_09_00.Wdf
2009-10-27 11:06:49 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2009-10-27 08:47:56 9216 ----a-w- c:\windows\system32\CSC.exe
2009-10-26 18:08:10 12878848 ----a-w- c:\program files\Seagate Manager Installer.msi
2009-10-26 18:08:03 3584 ----a-w- c:\program files\1033.MST
2009-10-26 18:07:58 6187 ----a-w- c:\program files\0x0409.ini
2009-10-26 14:36:39 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-10-26 13:52:38 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2009-09-26 02:33:02 1600856 ----a-w- c:\windows\system32\FM20.DLL
2009-09-26 02:33:00 31600 ----a-w- c:\windows\system32\FM20ENU.DLL
2009-09-11 16:15:30 845848 ----a-w- c:\windows\system32\igfxcfg.exe
2009-09-11 16:15:30 491032 ----a-w- c:\windows\system32\igfxsrvc.exe
2009-09-11 16:15:30 385560 ----a-w- c:\windows\system32\hkcmd.exe
2009-09-11 16:15:30 363544 ----a-w- c:\windows\system32\igfxpers.exe
2009-09-11 16:15:30 215576 ----a-w- c:\windows\system32\igfxext.exe
2009-09-11 16:15:30 1002008 ----a-w- c:\windows\syswow64\igxpun.exe
2009-09-11 16:15:28 165912 ----a-w- c:\windows\system32\igfxtray.exe
2009-09-11 16:15:28 106008 ----a-w- c:\windows\system32\difx64.exe
2009-09-11 16:14:02 1312768 ----a-w- c:\windows\system32\igfxCoIn_v1912.dll
2009-09-11 16:04:56 5472256 ----a-w- c:\windows\system32\igdumd64.dll
2009-09-11 16:00:22 3829760 ----a-w- c:\windows\syswow64\igdumd32.dll
2009-09-11 15:58:04 536576 ----a-w- c:\windows\syswow64\igdumdx32.dll
2009-09-11 15:56:40 3474432 ----a-w- c:\windows\system32\igd10umd64.dll
2009-09-11 15:53:44 2551808 ----a-w- c:\windows\syswow64\igd10umd32.dll
2009-09-11 15:50:50 4445184 ----a-w- c:\windows\system32\ig4dev64.dll
2009-09-11 15:50:46 6426624 ----a-w- c:\windows\system32\ig4icd64.dll
2009-09-11 15:46:56 2686976 ----a-w- c:\windows\syswow64\ig4dev32.dll
2009-09-11 15:46:30 4104192 ----a-w- c:\windows\syswow64\ig4icd32.dll
2009-09-11 15:41:48 27648 ----a-w- c:\windows\system32\igfxexps.dll
2009-09-11 15:41:44 372224 ----a-w- c:\windows\system32\igfxTMM.dll
2009-09-11 15:41:42 246272 ----a-w- c:\windows\system32\igfxpph.dll
2009-09-11 15:41:26 142336 ----a-w- c:\windows\system32\igfxdo.dll
2009-09-11 15:41:14 55808 ----a-w- c:\windows\system32\igfxsrvc.dll
2009-09-11 15:40:38 107520 ----a-w- c:\windows\system32\hccutils.dll
2009-09-11 15:40:32 261120 ----a-w- c:\windows\system32\igfxdev.dll
2009-09-11 15:40:00 5694976 ----a-w- c:\windows\system32\igfxress.dll
2009-09-11 15:36:10 59392 ----a-w- c:\windows\syswow64\oemdspif.dll
2009-09-11 15:34:58 218112 ----a-w- c:\windows\syswow64\igfxdv32.dll
2009-09-10 06:28:22 311808 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 05:52:05 257024 ----a-w- c:\windows\syswow64\msv1_0.dll
2009-09-05 05:56:22 64512 ----a-w- c:\windows\syswow64\msfeedsbs.dll
2009-07-14 07:43:11 37052 ----a-w- c:\windows\inf\perflib\041d\perfd.dat
2009-07-14 07:43:11 37052 ----a-w- c:\windows\inf\perflib\041d\perfc.dat
2009-07-14 07:43:11 294764 ----a-w- c:\windows\inf\perflib\041d\perfi.dat
2009-07-14 07:43:11 294764 ----a-w- c:\windows\inf\perflib\041d\perfh.dat
2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
============= FINISH: 17:41:36,63 ===============
#7
Skrivet 02 december 2009 - 17:48
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 2009-10-26 15:14:36
System Uptime: 2009-12-02 15:26:16 (2 hours ago)
Motherboard: MSI | | Boston
Processor: Intel® Pentium® Dual CPU E2160 @ 1.80GHz | Socket 775 | 1800/800mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 328 GiB total, 207,598 GiB free.
D: is FIXED (NTFS) - 8 GiB total, 7,67 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 466 GiB total, 401,983 GiB free.
G: is Removable
H: is Removable
I: is Removable
J: is Removable
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP39: 2009-11-18 08:19:11 - Removed Microsoft LifeCam
RP40: 2009-11-18 08:20:44 - DirectX har installerats
RP41: 2009-11-19 01:34:33 - Installed Microsoft Office Professional Plus 2010
RP43: 2009-11-21 23:38:50 - Paint.NET v3.5.1
RP44: 2009-11-23 19:26:23 - Installed Playkanaler
RP45: 2009-11-23 19:39:14 - Removed Playkanaler
RP46: 2009-11-25 11:10:37 - Windows Update
RP47: 2009-11-28 19:40:27 - Removed Java 6 Update 17
RP48: 2009-11-28 19:41:36 - Installed Java 6 Update 17 (64-bit)
RP49: 2009-11-29 00:35:31 - Removed Java 6 Update 13
RP50: 2009-11-29 08:41:12 - OpenOffice.org 3.1 togs bort
RP51: 2009-11-29 11:42:04 - Installed Java 6 Update 17
RP52: 2009-11-29 16:50:59 - Installed Microsoft Baseline Security Analyzer 2.1
RP53: 2009-11-29 21:06:22 - Installed Windows Media Player Firefox Plugin
RP54: 2009-12-02 09:50:48 - Removed PerfectDisk 10 Home Edition.
==== Installed Programs ======================
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2 - Svenska
Buypass Smartkorttest
CCleaner
F-Secure Internet Security 2010
F-Secure PSC Prerequisites
FileHippo.com Update Checker
Google Chrome
HijackThis 2.0.2
HP Update
Java 6 Update 17
Malwarebytes' Anti-Malware
Microsoft Choice Guard
Microsoft Corporation
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.5)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Picasa 3
PIXresizer 2.0.4
Realtek High Definition Audio Driver
Revo Uninstaller 1.83
Seagate Manager Installer
Secunia PSI
Skype web features
Skype 4.1
Spotify
TeamViewer 4
Watson
Windows Live Communications Platform
Windows Live Essentials
Windows Live inloggningsassistenten
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Upload Tool
Windows Media Player Firefox Plugin
VLC media player 1.0.3
==== End Of File ===========================
#8
Skrivet 02 december 2009 - 18:20
SweetIM har ju inte så bra rykte så det är kanske inte så bra att söka via dem. I Firefox adressruta så skriver du:
about:config
Tryck dig vidare och i listan som kommer upp så letar du upp keyword.URL. Högerklicka på den raden och välj att återställa till standardvärdet.
För övrigt så kan jag inte se något skadligt. Om något kan komma in genom webbläsaren så beror det vanligen på att man har ett program eller liknande med säkerhetshål i datorn. Jag ser att du har Secunia PSI så kör en koll med det.
Citat
#9
Skrivet 02 december 2009 - 19:35
Cecilia, den 02 december 2009 - 18:20 , skrev:
Secunia PSI hittar inga problem, mer än 2 osäkra webläsare, IE8 32 o 64 bit.
Secunia.JPG 107,28K
17 Antal nedladdningarTack för hjälpen!!
Mvh
Mats H
#10
Skrivet 02 december 2009 - 20:46
Framgår det på vilket sätt de är osäkra? *nyfiken*
DDS-filerna kan du ta bort.
Här kan du läsa mina vanliga råd för en säkrare dator, men det är så klart viktigt att man använder sitt förnuft också.
http://ceblstockholm...epages.com/home
Det här inlägget har redigerats av Cecilia: 02 december 2009 - 20:48
#11
Skrivet 02 december 2009 - 21:15
Cecilia, den 02 december 2009 - 20:46 , skrev:
Framgår det på vilket sätt de är osäkra? *nyfiken*
DDS-filerna kan du ta bort.
Här kan du läsa mina vanliga råd för en säkrare dator, men det är så klart viktigt att man använder sitt förnuft också.
http://ceblstockholm...epages.com/home
Secuniaunsec.JPG 234,54K
17 Antal nedladdningarHär är Secunias värdring.
Ditt dokument, har jag!
Tack för all hjälp!
Mvh
Mats H
#12
Skrivet 02 december 2009 - 22:15
NOS GetPlus är ett ActiveX-tillägg som är installerat i 32-bitars Internet Explorer så det bör du ta bort (Internet-alternativ - någon flik - Hantera tillägg).
#13
Skrivet 02 december 2009 - 22:42
Mozilla och Google Chrome är våra favoriter.
Vilket leder mig tbx till F-Secure, vilket jag tycker borde skydda mot sådana här angrepp, med alla SKYDD på!
Funderar nu allvarligt på att kasta ut det, trots 6½ månad kvar på licensen.
Har de inte uppdaterat sina system på sådana här virus?
Det får en att undra.
Ska väl fråga dem imorgon!!
#14
Skrivet 02 december 2009 - 22:47
#15
Skrivet 02 december 2009 - 23:08
När tom gratis, program funkar som motmedel!
Tja, får kolla runt lite men ska plåga F-Secure lite, som nu blir F-.(in)Secure!
Kommer ju från Finland!
#16
Skrivet 03 december 2009 - 00:49
God natt!
#17
Skrivet 03 december 2009 - 01:00
#18
Skrivet 03 december 2009 - 07:07
Cecilia, den 03 december 2009 - 01:00 , skrev:
OK! Återstår att se då!
Har du en länk till dessa resultat, vore intressant att se!
Har ju min F-..Secure licens kvar, om detta mot förmodan skulle visa sig vara sämre på ngt sätt.
Mvh
Mats H
#19
Skrivet 03 december 2009 - 09:23
Med DeepGuard aktiverad hade troligen F-Secure klarat uppgiften bättre, och med konfigurationen Proactive Security hade CIS troligen klarat 100 %…
Det här inlägget har redigerats av JoWa: 03 december 2009 - 09:24
#20
Skrivet 03 december 2009 - 09:47
JoWa, den 03 december 2009 - 09:23 , skrev:
Med DeepGuard aktiverad hade troligen F-Secure klarat uppgiften bättre, och med konfigurationen Proactive Security hade CIS troligen klarat 100 %
Deep Guard var aktiverad, det var liksom kruxet tycker jag!















