hhanni

hm, jag har också fått ett sånt virus, malware lyckades jag ta bort själv. Cecilia här är en DDS-logg DDS (Ver_09-12-01.01) - NTFSx86 Run by gare at 10:06:35,20 on 2010-01-07 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1015.544 [GMT 1:00] AV: PC Tools AntiVirus 6.0.0.19 *On-access scanning enabled* (Outdated) {832E7172-E406-4bb2-8B19-6D29F2C93A98} AV: Malware Defense *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\WINDOWS\Explorer.EXE C:\Program\Analog Devices\SoundMAX\SMax4PNP.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\igfxpers.exe C:\Program\Microsoft Office\Office12\GrooveMonitor.exe C:\Program\Java\jre6\bin\jusched.exe C:\Program\PC Tools AntiVirus\PCTAV.exe C:\Program\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\Electronic Arts\EADM\Core.exe C:\DOCUME~1\GARE~1\LOKALA~1\Temp\settdebugx.exe C:\Program\WIDCOMM\Bluetooth Software\BTTray.exe C:\DOCUME~1\GARE~1\LOKALA~1\Temp\wscsvc32.exe C:\Program\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program\Bonjour\mDNSResponder.exe C:\Program\Java\jre6\bin\jqs.exe C:\Program\PC Tools AntiVirus\PCTAVSvc.exe C:\Program\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Windows Live\Toolbar\wltuser.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\ägare\Skrivbord\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://facebook.se/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program\delade filer\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program\bitcomet\tools\BitCometBHO_1.2.8.7.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program\windows live\toolbar\wltcore.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [EA Core] "c:\program\electronic arts\eadm\Core.exe" -silent uRun: [settdebugx.exe] c:\docume~1\gare~1\lokala~1\temp\settdebugx.exe uRun: [Malware Defense] "c:\program\malware defense\mdefense.exe" -noscan mRun: [soundMAXPnP] c:\program\analog devices\soundmax\SMax4PNP.exe mRun: [soundMAX] c:\program\analog devices\soundmax\Smax4.exe /tray mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [Adobe Reader Speed Launcher] "c:\program\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [GrooveMonitor] "c:\program\microsoft office\office12\GrooveMonitor.exe" mRun: [EPSON Stylus C48 Series] c:\windows\system32\spool\drivers\w32x86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB001" /M "Stylus C48" mRun: [sunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe" mRun: [PCTAVApp] "c:\program\pc tools antivirus\PCTAV.exe" /MONITORSCAN mRun: [QlbCtrl.exe] c:\program\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\gare~1\start-~1\program\autost~1\skrmur~1.lnk - c:\program\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\bttray.lnk - c:\program\widcomm\bluetooth software\BTTray.exe IE: &D&ownload &with BitComet - c:\program\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program\bitcomet\BitComet.exe/AddAllLink.htm IE: E&xportera till Microsoft Excel - c:\program\micros~2\office12\EXCEL.EXE/3000 IE: Skicka till &Bluetooth-enhet... - c:\program\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program\widcomm\bluetooth software\btsendto_ie.htm IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program\bitcomet\tools\BitCometBHO_1.2.8.7.dll/206 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~2\office12\REFIEBAR.DLL LSP: c:\program\delade filer\pc tools\lsp\PCTLsp.dll DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1225903211231 DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program\microsoft office\office12\GrooveShellExtensions.dll ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-8-10 130936] R2 AVFilter;AVFilter;c:\windows\system32\drivers\AVFilter.sys [2008-11-25 21904] R2 PCTAVSvc;PC Tools AntiVirus Engine;c:\program\pc tools antivirus\PCTAVSvc.exe [2008-11-25 826600] R3 AVHook;AVHook;c:\windows\system32\drivers\AVHook.sys [2008-11-25 28560] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2008-11-5 88192] =============== Created Last 30 ================ 2010-01-07 09:01:13 0 d--h--r- c:\documents and settings\ägare\Recent 2010-01-07 07:46:51 856 ----a-w- c:\windows\system32\krl32mainweq.dll 2010-01-07 07:35:25 55056 ---ha-w- c:\windows\system32\mlfcache.dat 2010-01-03 14:30:59 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2010-01-03 14:30:59 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2010-01-03 14:29:38 0 d-----w- c:\program\iPod 2010-01-03 14:29:31 0 d-----w- c:\program\iTunes 2010-01-03 14:29:31 0 d-----w- c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2010-01-03 14:28:50 0 d-----w- c:\program\Bonjour 2010-01-03 14:26:41 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2010-01-03 14:26:41 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2010-01-03 14:25:43 0 d-----w- c:\program\delade filer\Apple ==================== Find3M ==================== 2010-01-07 08:55:18 80260 ----a-w- c:\windows\system32\perfc01D.dat 2010-01-07 08:55:18 437918 ----a-w- c:\windows\system32\perfh01D.dat 2010-01-07 08:50:02 4980736 ---ha-w- c:\documents and settings\ägare\NTUSER.DAT 2009-10-29 07:44:35 916480 ----a-w- c:\windows\system32\wininet.dll 2009-10-21 05:40:44 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:40:44 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-13 10:38:09 270848 ----a-w- c:\windows\system32\oakley.dll 2009-10-12 13:40:17 79872 ----a-w- c:\windows\system32\raschap.dll 2009-10-12 13:40:17 150016 ----a-w- c:\windows\system32\rastls.dll 2008-11-06 11:41:42 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008102720081103\index.dat 2008-11-06 11:41:42 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008110620081107\index.dat ============= FINISH: 10:07:36,96 ===============