Kuffs

Så, nu har jag gjort allt inkluderat steg 5s instruktioner. Tror aldrig datorn haft så många skyddsprogram som nu, så nu ska den vara i toppform. Återigen, tusen tack för hjälpen. Mvh Adam

Körde precis en mallware..scan och den hittar inte några infekterade filer, samtidigt som datorn (hittils) fungerar utmärkt..... ...så det verkar iallfall som den blivit botad Vill tacka dig hemskt mycket för hjälpen, du är en räddande ängel. Mvh Adam

Ursäkta att svaret dröjde, men nu har jag gjort alla intruktioner jag fick av dig. Här kommer ComboFix-loggen: ComboFix 09-10-08.04 - Adam 2009-10-10 19:08.2.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1023.589 [GMT 2:00] Körs från: c:\documents and settings\Adam\Skrivbord\ComboFix.exe Använda kommandoväxlar :: c:\documents and settings\Adam\Skrivbord\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_otiffylgngux (((((((((((((((((((((((( Filer Skapade från 2009-09-10 till 2009-10-10 )))))))))))))))))))))))))))))) . 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\documents and settings\Adam\Application Data\Malwarebytes 2009-10-09 21:13 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2009-10-09 21:13 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-09 21:11 . 2009-10-09 21:11 -------- d-----w- c:\program\Trend Micro 2009-09-30 07:56 . 2009-09-30 07:56 -------- d-----w- C:\EA Sports 2009-09-30 07:55 . 1996-11-06 10:10 301568 ----a-w- c:\windows\unin041d.exe 2009-09-25 05:57 . 2009-09-25 05:57 -------- d-sh--w- c:\documents and settings\Jessica\IETldCache . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-08 16:27 . 2008-08-26 17:13 -------- d-----w- c:\program\DC++ 2009-09-20 12:04 . 2008-09-01 21:17 19882 ----a-w- c:\documents and settings\Adam\Application Data\wklnhst.dat 2009-09-01 20:26 . 2008-08-22 14:54 -------- d-----w- c:\documents and settings\Adam\Application Data\Apple Computer 2009-08-28 09:22 . 2008-08-28 13:29 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-28 09:22 . 2008-08-28 13:29 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 09:22 . 2008-08-28 13:29 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-27 17:20 . 2009-01-13 13:33 883 ----a-w- c:\windows\eReg.dat 2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\program\EA GAMES 2009-08-27 17:15 . 2007-10-02 08:04 -------- d--h--w- c:\program\InstallShield Installation Information 2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\program\GameSpy Arcade 2009-08-27 17:11 . 2008-08-22 14:53 -------- d-----w- c:\program\Apple Software Update 2009-08-27 17:09 . 2009-08-27 17:09 -------- d-----w- c:\program\Safari 2009-08-27 17:08 . 2009-08-27 17:07 -------- d-----w- c:\program\iTunes 2009-08-27 17:08 . 2009-08-27 17:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-08-27 17:07 . 2009-08-27 17:07 -------- d-----w- c:\program\iPod 2009-08-27 17:06 . 2009-08-27 17:05 -------- d-----w- c:\program\QuickTime 2009-08-27 17:01 . 2009-08-27 17:01 -------- d-----w- c:\program\Bonjour 2009-08-27 11:34 . 2008-09-08 20:43 -------- d-----w- c:\documents and settings\Adam\Application Data\AdobeUM 2009-08-05 09:01 . 2008-04-01 16:40 205312 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-03 13:07 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll 2009-08-03 13:07 . 2009-08-03 13:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll 2009-08-03 13:07 . 2009-08-03 13:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe 2009-07-17 19:04 . 2003-04-24 12:00 58880 ----a-w- c:\windows\system32\atl.dll . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-09-02 09:58 1107200 ----a-w- c:\program\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program\Java\j2re1.4.2_02\bin\jusched.exe" [2008-01-09 32881] "ATIPTA"="c:\ati-cpanel\atiptaxx.exe" [2003-12-12 335872] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AVG8_TRAY"="c:\program\AVG\AVG8\avgtray.exe" [2009-10-06 2023704] "HP Software Update"="c:\program\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "QuickTime Task"="c:\program\QuickTime\qttask.exe" [2009-05-26 413696] "AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472] "iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128] "Malwarebytes Anti-Malware (reboot)"="c:\program\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-02-26 65024] "PRISMSTA.EXE"="PRISMSTA.EXE" - c:\windows\system32\PRISMSTA.exe [2003-08-04 215552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users.WINDOWS\Start-meny\Program\Autostart\ GA311 Smart Wizard Utility.lnk - c:\program\NETGEAR GA311 Adapter\GA311.exe [2003-11-6 270336] HP Digital Imaging Monitor.lnk - c:\program\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520] Microsoft Office.lnk - c:\program\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-08-28 09:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\DC++\\DCPlusPlus.exe"= "c:\\Program\\AVG\\AVG8\\avgemc.exe"= "c:\\Program\\AVG\\AVG8\\avgupd.exe"= "c:\\Program\\Microsoft Games\\Age of Empires II\\EMPIRES2.EXE"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\EA GAMES\\Battlefield 1942\\BF1942.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-28 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-08-28 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\program\AVG\AVG8\avgemc.exe [2009-06-25 908056] R2 avg8wd;AVG Free8 WatchDog;c:\program\AVG\AVG8\avgwdsvc.exe [2009-06-25 297752] R2 LANPkt;Realtek LANPkt Protocol;c:\windows\system32\drivers\LANPkt.sys [2003-09-17 8440] R3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2003-08-15 11237] S3 NetgearGA311;NETGEAR GA311 Gigabit Adapter Driver;c:\windows\system32\drivers\G311N6.sys [2008-08-22 70144] S3 PRISM_A00;CREATIX 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [2008-04-01 362688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Innehållet i mappen 'Schemalagda aktiviteter': 2009-10-07 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34] . . ------- Extra genomsökning ------- . uInternet Settings,ProxyOverride = *.local IE: E&xportera till Microsoft Excel - c:\program\MICROS~4\Office10\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-10 19:14 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_USERS\S-1-5-21-73586283-1767777339-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:61,b2,b2,bd,9b,19,1e,b3,37,ac,86,00,0f,58,0c,a9,a3,33,85,ee,fc,15,9c, 0c,75,29,3f,8b,0e,82,5c,2c,2b,ba,09,b4,a5,9e,09,4b,35,63,da,1a,4a,d1,d1,1b,\ "??"=hex:de,ec,cb,c5,06,e7,c3,66,ce,d0,8a,cb,aa,58,dd,54 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'explorer.exe'(2852) c:\windows\system32\webcheck.dll . ------------------------ Andra processer som körs ------------------------ . c:\program\Lavasoft\Ad-Aware\aawservice.exe c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program\Bonjour\mDNSResponder.exe c:\program\AVG\AVG8\avgrsx.exe c:\program\AVG\AVG8\avgnsx.exe c:\program\AVG\AVG8\avgcsrvx.exe c:\windows\system32\wscntfy.exe c:\program\iPod\bin\iPodService.exe . ************************************************************************** . Sluttid: 2009-10-10 19:19 - datorn startades om. ComboFix-quarantined-files.txt 2009-10-10 17:18 ComboFix2.txt 2009-10-10 15:25 Före genomsökningen: 94 183 940 096 byte ledigt Efter genomsökningen: 94 148 317 184 byte ledigt 165 --- E O F --- 2009-09-23 21:14 ...och här kommer Hijack loggen: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:33:09, on 2009-10-10 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\ATI-CPanel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\PRISMSTA.EXE C:\Program\AVG\AVG8\avgtray.exe C:\Program\HP\HP Software Update\HPWuSchd2.exe C:\Program\iTunes\iTunesHelper.exe C:\Program\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\NETGEAR GA311 Adapter\GA311.exe C:\Program\HP\Digital Imaging\bin\hpqtra08.exe C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program\AVG\AVG8\avgwdsvc.exe C:\Program\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program\AVG\AVG8\avgemc.exe C:\Program\AVG\AVG8\avgrsx.exe C:\Program\AVG\AVG8\avgnsx.exe C:\Program\AVG\AVG8\avgcsrvx.exe C:\Program\iPod\bin\iPodService.exe C:\WINDOWS\system32\msiexec.exe C:\Program\Java\jre6\bin\jqs.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program\Java\jre6\bin\jusched.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program\NETGEAR GA311 Adapter\GA311.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre6\bin\jp2iexp.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219401493281 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219401574734 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe -- End of file - 6814 bytes

Körde en mallware- scan och det verkar som glaide32 har raderats(?) från datorn, dock är de 2 andra infektionerna kvar likväl. Även om rapportern visar att de är deleted så hittas de igen när jag kör en ny scan Postar loggenhär: Malwarebytes' Anti-Malware 1.41 Databasversion: 2936 Windows 5.1.2600 Service Pack 3 2009-10-10 17:42:44 mbam-log-2009-10-10 (17-42-44).txt Skanningstyp: Snabb skanning Antal skannade objekt: 129304 Förfluten tid: 5 minute(s), 8 second(s) Infekterade minnesprocesser: 0 Infekterade minnesmoduler: 0 Infekterade registernycklar: 0 Infekterade registervärden: 0 Infekterade registerdataposter: 2 Infekterade mappar: 0 Infekterade filer: 0 Infekterade minnesprocesser: (Inga illasinnade poster hittades) Infekterade minnesmoduler: (Inga illasinnade poster hittades) Infekterade registernycklar: (Inga illasinnade poster hittades) Infekterade registervärden: (Inga illasinnade poster hittades) Infekterade registerdataposter: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\System32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. Infekterade mappar: (Inga illasinnade poster hittades) Infekterade filer: (Inga illasinnade poster hittades)

Hej Cecilia och tack för det snabba svaret! Har nu kört igenom combofix och fårr loggen: ComboFix 09-10-08.04 - Adam 2009-10-10 17:15.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1023.646 [GMT 2:00] Körs från: c:\documents and settings\Adam\Skrivbord\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Adam\Application Data\iniasd.txt c:\recycler\S-1-5-21-343818398-57989841-725345543-1003 c:\windows\Installer\9c826.msp c:\windows\system32\drivers\glaide32.sys c:\windows\system32\pagefileconfig.vbs . ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_glaide32 (((((((((((((((((((((((( Filer Skapade från 2009-09-10 till 2009-10-10 )))))))))))))))))))))))))))))) . 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\documents and settings\Adam\Application Data\Malwarebytes 2009-10-09 21:13 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2009-10-09 21:13 . 2009-10-09 21:13 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2009-10-09 21:13 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-09 21:11 . 2009-10-09 21:11 -------- d-----w- c:\program\Trend Micro 2009-09-30 07:56 . 2009-09-30 07:56 -------- d-----w- C:\EA Sports 2009-09-30 07:55 . 1996-11-06 10:10 301568 ----a-w- c:\windows\unin041d.exe 2009-09-25 05:57 . 2009-09-25 05:57 -------- d-sh--w- c:\documents and settings\Jessica\IETldCache . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-08 16:27 . 2008-08-26 17:13 -------- d-----w- c:\program\DC++ 2009-09-20 12:04 . 2008-09-01 21:17 19882 ----a-w- c:\documents and settings\Adam\Application Data\wklnhst.dat 2009-09-01 20:26 . 2008-08-22 14:54 -------- d-----w- c:\documents and settings\Adam\Application Data\Apple Computer 2009-08-28 09:22 . 2008-08-28 13:29 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-28 09:22 . 2008-08-28 13:29 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 09:22 . 2008-08-28 13:29 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-27 17:20 . 2009-01-13 13:33 883 ----a-w- c:\windows\eReg.dat 2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\program\EA GAMES 2009-08-27 17:15 . 2007-10-02 08:04 -------- d--h--w- c:\program\InstallShield Installation Information 2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\program\GameSpy Arcade 2009-08-27 17:11 . 2008-08-22 14:53 -------- d-----w- c:\program\Apple Software Update 2009-08-27 17:09 . 2009-08-27 17:09 -------- d-----w- c:\program\Safari 2009-08-27 17:08 . 2009-08-27 17:07 -------- d-----w- c:\program\iTunes 2009-08-27 17:08 . 2009-08-27 17:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-08-27 17:07 . 2009-08-27 17:07 -------- d-----w- c:\program\iPod 2009-08-27 17:06 . 2009-08-27 17:05 -------- d-----w- c:\program\QuickTime 2009-08-27 17:01 . 2009-08-27 17:01 -------- d-----w- c:\program\Bonjour 2009-08-27 11:34 . 2008-09-08 20:43 -------- d-----w- c:\documents and settings\Adam\Application Data\AdobeUM 2009-08-05 09:01 . 2008-04-01 16:40 205312 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-03 13:07 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll 2009-08-03 13:07 . 2009-08-03 13:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll 2009-08-03 13:07 . 2009-08-03 13:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe 2009-07-17 19:04 . 2003-04-24 12:00 58880 ----a-w- c:\windows\system32\atl.dll . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-09-02 09:58 1107200 ----a-w- c:\program\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program\Java\j2re1.4.2_02\bin\jusched.exe" [2008-01-09 32881] "ATIPTA"="c:\ati-cpanel\atiptaxx.exe" [2003-12-12 335872] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AVG8_TRAY"="c:\program\AVG\AVG8\avgtray.exe" [2009-10-06 2023704] "HP Software Update"="c:\program\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "QuickTime Task"="c:\program\QuickTime\qttask.exe" [2009-05-26 413696] "AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472] "iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128] "Malwarebytes Anti-Malware (reboot)"="c:\program\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-02-26 65024] "PRISMSTA.EXE"="PRISMSTA.EXE" - c:\windows\system32\PRISMSTA.exe [2003-08-04 215552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users.WINDOWS\Start-meny\Program\Autostart\ GA311 Smart Wizard Utility.lnk - c:\program\NETGEAR GA311 Adapter\GA311.exe [2003-11-6 270336] HP Digital Imaging Monitor.lnk - c:\program\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520] Microsoft Office.lnk - c:\program\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-08-28 09:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\DC++\\DCPlusPlus.exe"= "c:\\Program\\AVG\\AVG8\\avgemc.exe"= "c:\\Program\\AVG\\AVG8\\avgupd.exe"= "c:\\Program\\Microsoft Games\\Age of Empires II\\EMPIRES2.EXE"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\EA GAMES\\Battlefield 1942\\BF1942.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-28 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-08-28 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\program\AVG\AVG8\avgemc.exe [2009-06-25 908056] R2 avg8wd;AVG Free8 WatchDog;c:\program\AVG\AVG8\avgwdsvc.exe [2009-06-25 297752] R2 LANPkt;Realtek LANPkt Protocol;c:\windows\system32\drivers\LANPkt.sys [2003-09-17 8440] R3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2003-08-15 11237] S2 otiffylgngux;otiffylgngux;\??\c:\windows\system32\drivers\mmzfr.sys --> c:\windows\system32\drivers\mmzfr.sys [?] S3 NetgearGA311;NETGEAR GA311 Gigabit Adapter Driver;c:\windows\system32\drivers\G311N6.sys [2008-08-22 70144] S3 PRISM_A00;CREATIX 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [2008-04-01 362688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Innehållet i mappen 'Schemalagda aktiviteter': 2009-10-07 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34] . . ------- Extra genomsökning ------- . uInternet Settings,ProxyOverride = *.local IE: E&xportera till Microsoft Excel - c:\program\MICROS~4\Office10\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-10 17:22 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_USERS\S-1-5-21-73586283-1767777339-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:61,b2,b2,bd,9b,19,1e,b3,37,ac,86,00,0f,58,0c,a9,a3,33,85,ee,fc,15,9c, 0c,75,29,3f,8b,0e,82,5c,2c,2b,ba,09,b4,a5,9e,09,4b,35,63,da,1a,4a,d1,d1,1b,\ "??"=hex:de,ec,cb,c5,06,e7,c3,66,ce,d0,8a,cb,aa,58,dd,54 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'explorer.exe'(2348) c:\windows\system32\webcheck.dll . ------------------------ Andra processer som körs ------------------------ . c:\program\Lavasoft\Ad-Aware\aawservice.exe c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program\Bonjour\mDNSResponder.exe c:\program\AVG\AVG8\avgrsx.exe c:\program\AVG\AVG8\avgnsx.exe c:\program\AVG\AVG8\avgcsrvx.exe c:\program\iPod\bin\iPodService.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Sluttid: 2009-10-10 17:25 - datorn startades om. ComboFix-quarantined-files.txt 2009-10-10 15:25 Före genomsökningen: 87 809 867 776 byte ledigt Efter genomsökningen: 94 177 935 360 byte ledigt WindowsXP-KB310994-SP2-Pro-BootDisk-SVE.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 176 --- E O F --- 2009-09-23 21:14

Postar en hijack logg med, om det kan hjälpa: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:53:09, on 2009-10-10 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program\Java\j2re1.4.2_02\bin\jusched.exe C:\ATI-CPanel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\PRISMSTA.EXE C:\Program\AVG\AVG8\avgtray.exe C:\Program\HP\HP Software Update\HPWuSchd2.exe C:\Program\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\Messenger\msmsgs.exe C:\Program\NETGEAR GA311 Adapter\GA311.exe C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program\HP\Digital Imaging\bin\hpqtra08.exe C:\Program\AVG\AVG8\avgwdsvc.exe C:\Program\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program\AVG\AVG8\avgemc.exe C:\Program\AVG\AVG8\avgrsx.exe C:\Program\AVG\AVG8\avgnsx.exe C:\Program\AVG\AVG8\avgcsrvx.exe C:\Program\iPod\bin\iPodService.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program\Java\j2re1.4.2_02\bin\jusched.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: GA311 Smart Wizard Utility.lnk = C:\Program\NETGEAR GA311 Adapter\GA311.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\j2re1.4.2_02\bin\npjpi142_02.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\j2re1.4.2_02\bin\npjpi142_02.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219401493281 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219401574734 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe O23 - Service: Automatiska uppdateringar (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 6584 bytes

Hej ! Har drabbats av ett envisst rootkit-virus vid namn "glaide32.sys" som jag inte lyckas få bort. Hittade en tidigare tråd med en användare med samma problem, som blev tvungen att göra en "clean install", efter att ha använt ett verktyg kallat SDfix. Så antagligen är det programemt inte rätt väg att gå, då jag vill undvika detta. Är verkligen urkass på virus, trojaner mm, så all hjälp är välkommen! Tack på förhand. Mvh Adam Här kommer själva problemet. Har AVG antivirus, men det programmet hittar inget fel När jag kört Mallwarebytes hittas själva "glade32.sys" infektionen, men verkar inte kunna ta bort den, då den fortfarande är kvar trots radering/omstart av datorn. Även två till filer finns kvar efter proceduren, vet inte om de är kopplade till glaide32, eller om de är seperata virus. Postar loggen här nedan. Uppskattar all hjälp jag kan få! Postar loggen från programmet här nedan. Malwarebytes' Anti-Malware 1.41 Databasversion: 2936 Windows 5.1.2600 Service Pack 3 2009-10-10 16:46:16 mbam-log-2009-10-10 (16-46-16).txt Skanningstyp: Snabb skanning Antal skannade objekt: 133624 Förfluten tid: 6 minute(s), 32 second(s) Infekterade minnesprocesser: 0 Infekterade minnesmoduler: 0 Infekterade registernycklar: 0 Infekterade registervärden: 0 Infekterade registerdataposter: 2 Infekterade mappar: 0 Infekterade filer: 1 Infekterade minnesprocesser: (Inga illasinnade poster hittades) Infekterade minnesmoduler: (Inga illasinnade poster hittades) Infekterade registernycklar: (Inga illasinnade poster hittades) Infekterade registervärden: (Inga illasinnade poster hittades) Infekterade registerdataposter: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\System32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. Infekterade mappar: (Inga illasinnade poster hittades) Infekterade filer: C:\WINDOWS\system32\drivers\glaide32.sys (Rootkit.Rustock) -> Delete on reboot.