Gå till innehåll

Tessa

Medlem
  • Innehållsantal

    24
  • Gick med

  • Besökte senast

Allt postat av Tessa

  1. Ny logg: ComboFix 10-05-07.07 - Carlsson 2010-05-09 17:35:51.5.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.209 [GMT 2:00] Körs från: c:\documents and settings\Carlsson\Skrivbord\ComboFix.exe Använda kommandoväxlar :: c:\documents and settings\Carlsson\Skrivbord\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ipnhc (((((((((((((((((((((((( Filer Skapade från 2010-04-09 till 2010-05-09 )))))))))))))))))))))))))))))) . 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2010-05-08 11:52 . 2010-05-08 11:52 -------- d-----w- c:\windows\system32\config\systemprofile\Tracing 2010-05-08 11:51 . 2010-05-08 11:51 -------- d-----r- c:\documents and settings\LocalService\Favoriter 2010-04-22 16:29 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-24 08:53 . 2010-04-24 08:53 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2010-04-24 08:52 . 2010-02-23 21:53 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-24 08:50 . 2010-04-24 08:50 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-18 09:59 . 2004-10-15 17:04 -------- d-----w- c:\documents and settings\Carlsson\Application Data\AdobeUM 2010-04-18 09:20 . 2004-10-06 15:51 -------- d-----w- c:\program\Delade filer\Adobe 2010-04-17 16:03 . 2009-05-18 17:58 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Spotify 2010-04-16 15:48 . 2010-02-13 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-04-16 15:33 . 2010-02-13 10:18 -------- d-----w- c:\documents and settings\Carlsson\Application Data\skypePM 2010-04-12 17:22 . 2009-11-10 13:44 79488 ----a-w- c:\documents and settings\Carlsson\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-04-10 08:57 . 2010-04-10 08:57 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2010-03-28 15:27 . 2001-09-28 12:00 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27 . 2001-09-28 12:00 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55 . 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:55 . 2008-08-24 16:30 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-18 05:54 . 2008-08-24 16:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17 . 2002-09-09 12:08 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19 . 2002-09-09 12:08 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2002-08-28 23:59 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:09 . 2002-09-09 11:18 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09 . 2002-09-09 13:18 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-13 10:18 . 2010-02-13 10:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-02-12 04:35 . 2002-09-09 12:06 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2002-08-28 23:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((( SnapShot@2010-05-09_11.59.46 ))))))))))))))))))))))))))))))))))))))))) . + 2010-05-09 15:43 . 2010-05-09 15:43 16384 c:\windows\Temp\Perflib_Perfdata_63c.dat . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] c:\documents and settings\Tessas\Program\Autostart\ Adobe Gamma.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] c:\documents and settings\All Users\Start-meny\Program\Autostart\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-12-14 25214] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program\\NetMeeting\\conf.exe"= "c:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"= "c:\\Program\\Messenger\\msmsgs.exe"= "c:\\Program\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\Spotify\\spotify.exe"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\AVG\\AVG9\\avgupd.exe"= "c:\\Program\\AVG\\AVG9\\avgnsx.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-24 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-02-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\AVG\AVG9\avgwdsvc.exe [2010-03-18 308064] S2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-05-30 12661] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-02-29 716272] . Innehållet i mappen 'Schemalagda aktiviteter': 2010-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-05-09 c:\windows\Tasks\Symantec NetDetect.job - c:\program\Symantec\LiveUpdate\NDETECT.EXE [2005-01-22 15:08] 2010-05-09 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-18 20:18] . . ------- Extra genomsökning ------- . uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-09 18:07 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A8A45CF7-6BE6-B2C1-72491EAB2E9A6B2B}\{B617CAED-A840-2A11-665EBDF0B9E06934}\{20694653-0A9D-BD70-6F24016076B199C3}*] "1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44, fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'explorer.exe'(3336) c:\windows\system32\webcheck.dll . ------------------------ Andra processer som körs ------------------------ . c:\program\AVG\AVG9\avgchsvx.exe c:\program\AVG\AVG9\avgrsx.exe c:\program\AVG\AVG9\avgcsrvx.exe c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program\Bonjour\mDNSResponder.exe c:\program\Java\jre6\bin\jqs.exe c:\windows\system32\MsPMSPSv.exe c:\program\AVG\AVG9\avgnsx.exe c:\program\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe . ************************************************************************** . Sluttid: 2010-05-09 18:12:51 - datorn startades om. ComboFix-quarantined-files.txt 2010-05-09 16:12 ComboFix2.txt 2010-05-09 14:45 ComboFix3.txt 2010-05-09 12:01 ComboFix4.txt 2010-05-09 10:12 ComboFix5.txt 2010-05-09 15:34 Före genomsökningen: 34 824 867 840 byte ledigt Efter genomsökningen: 34 817 851 392 byte ledigt - - End Of File - - 7CAD028EFF077F5E58642CF46851B67B
  2. Datorn fungerar utmärkt vad jag upplever nu, inga varningar, pop up-fönster eller annat segande.
  3. Ny Comfix-logg: ComboFix 10-05-07.07 - Carlsson 2010-05-09 16:35:32.4.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.347 [GMT 2:00] Körs från: c:\documents and settings\Carlsson\Skrivbord\ComboFix.exe Använda kommandoväxlar :: c:\documents and settings\Carlsson\Skrivbord\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . (((((((((((((((((((((((( Filer Skapade från 2010-04-09 till 2010-05-09 )))))))))))))))))))))))))))))) . 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2010-05-08 11:52 . 2010-05-08 11:52 -------- d-----w- c:\windows\system32\config\systemprofile\Tracing 2010-05-08 11:51 . 2010-05-08 11:51 -------- d-----r- c:\documents and settings\LocalService\Favoriter 2010-04-24 08:53 . 2010-04-24 08:53 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2010-04-24 08:50 . 2010-04-24 08:50 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-22 16:29 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe 2010-04-10 08:57 . 2010-04-10 08:57 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-24 08:52 . 2010-02-23 21:53 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-18 09:59 . 2004-10-15 17:04 -------- d-----w- c:\documents and settings\Carlsson\Application Data\AdobeUM 2010-04-18 09:20 . 2004-10-06 15:51 -------- d-----w- c:\program\Delade filer\Adobe 2010-04-17 16:03 . 2009-05-18 17:58 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Spotify 2010-04-16 15:48 . 2010-02-13 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-04-16 15:33 . 2010-02-13 10:18 -------- d-----w- c:\documents and settings\Carlsson\Application Data\skypePM 2010-04-12 17:22 . 2009-11-10 13:44 79488 ----a-w- c:\documents and settings\Carlsson\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-03-28 15:27 . 2001-09-28 12:00 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27 . 2001-09-28 12:00 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55 . 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:55 . 2008-08-24 16:30 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-18 05:54 . 2008-08-24 16:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17 . 2002-09-09 12:08 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19 . 2002-09-09 12:08 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2002-08-28 23:59 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:09 . 2002-09-09 11:18 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09 . 2002-09-09 13:18 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-13 10:18 . 2010-02-13 10:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-02-12 04:35 . 2002-09-09 12:06 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2002-08-28 23:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] c:\documents and settings\Tessas\Program\Autostart\ Adobe Gamma.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] c:\documents and settings\All Users\Start-meny\Program\Autostart\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-12-14 25214] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program\\NetMeeting\\conf.exe"= "c:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"= "c:\\Program\\Messenger\\msmsgs.exe"= "c:\\Program\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\Spotify\\spotify.exe"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\AVG\\AVG9\\avgupd.exe"= "c:\\Program\\AVG\\AVG9\\avgnsx.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-24 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-02-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\AVG\AVG9\avgwdsvc.exe [2010-03-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-05-30 12661] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-02-29 716272] . Innehållet i mappen 'Schemalagda aktiviteter': 2010-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-05-09 c:\windows\Tasks\Symantec NetDetect.job - c:\program\Symantec\LiveUpdate\NDETECT.EXE [2005-01-22 15:08] 2010-05-09 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-18 20:18] . . ------- Extra genomsökning ------- . uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-09 16:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A8A45CF7-6BE6-B2C1-72491EAB2E9A6B2B}\{B617CAED-A840-2A11-665EBDF0B9E06934}\{20694653-0A9D-BD70-6F24016076B199C3}*] "1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44, fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'winlogon.exe'(568) c:\windows\system32\igfxsrvc.dll c:\windows\system32\hccutils.DLL - - - - - - - > 'explorer.exe'(2920) c:\windows\system32\webcheck.dll . Sluttid: 2010-05-09 16:45:27 ComboFix-quarantined-files.txt 2010-05-09 14:45 ComboFix2.txt 2010-05-09 12:01 ComboFix3.txt 2010-05-09 10:12 ComboFix4.txt 2010-05-08 16:22 Före genomsökningen: 34 828 873 728 byte ledigt Efter genomsökningen: 34 832 982 016 byte ledigt - - End Of File - - 1F362810D5AB478810C22EE4089988DD Ny DDS-logg: DDS (Ver_10-03-17.01) - NTFSx86 Run by Carlsson at 16:49:15,68 on 2010-05-09 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.138 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program\AVG\AVG9\avgchsvx.exe C:\Program\AVG\AVG9\avgrsx.exe C:\Program\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program\AVG\AVG9\avgwdsvc.exe C:\Program\Bonjour\mDNSResponder.exe C:\Program\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\MsPMSPSv.exe C:\Program\AVG\AVG9\avgnsx.exe C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\Internet Explorer\iexplore.exe C:\Documents and Settings\Carlsson\Skrivbord\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program\avg\avg9\avgssie.dll BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [msnmsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background StartupFolder: c:\docume~1\tessas\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adober~1.lnk - c:\program\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft office\office10\OSA.EXE IE: Convert link target to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program\avg\avg9\avgpp.dll Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxsrvc.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-24 216200] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-24 29512] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\avg\avg9\avgwdsvc.exe [2010-3-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\svkp.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-5-30 12661] =============== Created Last 30 ================ 2010-05-09 08:41:18 0 dcsha-r- C:\cmdcons 2010-05-08 15:49:23 77312 ----a-w- c:\windows\MBR.exe 2010-05-08 15:49:22 98816 ----a-w- c:\windows\sed.exe 2010-05-08 15:49:22 256512 ----a-w- c:\windows\PEV.exe 2010-05-08 15:49:22 161792 ----a-w- c:\windows\SWREG.exe 2010-05-08 13:23:57 0 d-----w- c:\docume~1\carlsson\applic~1\Malwarebytes 2010-05-08 13:23:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23:15 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-05-08 13:23:13 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23:12 0 d-----w- c:\program\Malwarebytes' Anti-Malware 2010-04-22 16:29:58 293376 ------w- c:\windows\system32\browserchoice.exe ==================== Find3M ==================== 2010-04-24 08:52:52 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-03-28 15:27:28 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27:28 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:54:58 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17:42 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19:40 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-17 12:09:32 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09:30 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-14 19:32:57 58728 ----a-w- c:\windows\fonts\scriptina.zip 2010-02-12 04:35:03 100864 ----a-w- c:\windows\system32\6to4svc.dll 2009-05-20 17:34:42 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012009052020090521\index.dat ============= FINISH: 16:49:44,70 =============== Attach.txt
  4. Ny logg: ComboFix 10-05-07.07 - Carlsson 2010-05-09 13:51:57.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.346 [GMT 2:00] Körs från: c:\documents and settings\Carlsson\Skrivbord\ComboFix.exe Använda kommandoväxlar :: c:\documents and settings\Carlsson\Skrivbord\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FILE :: "c:\windows\system32\hjwkzkorga.exe" "c:\windows\system32\msxsltsso.dll" . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\hjwkzkorga.exe . (((((((((((((((((((((((( Filer Skapade från 2010-04-09 till 2010-05-09 )))))))))))))))))))))))))))))) . 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2010-05-08 11:52 . 2010-05-08 11:52 -------- d-----w- c:\windows\system32\config\systemprofile\Tracing 2010-05-08 11:51 . 2010-05-08 11:51 -------- d-----r- c:\documents and settings\LocalService\Favoriter 2010-04-24 08:53 . 2010-04-24 08:53 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2010-04-24 08:50 . 2010-04-24 08:50 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-22 16:29 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe 2010-04-10 08:57 . 2010-04-10 08:57 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-24 08:52 . 2010-02-23 21:53 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-18 09:59 . 2004-10-15 17:04 -------- d-----w- c:\documents and settings\Carlsson\Application Data\AdobeUM 2010-04-18 09:20 . 2004-10-06 15:51 -------- d-----w- c:\program\Delade filer\Adobe 2010-04-17 16:03 . 2009-05-18 17:58 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Spotify 2010-04-16 15:48 . 2010-02-13 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-04-16 15:33 . 2010-02-13 10:18 -------- d-----w- c:\documents and settings\Carlsson\Application Data\skypePM 2010-04-12 17:22 . 2009-11-10 13:44 79488 ----a-w- c:\documents and settings\Carlsson\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-03-28 15:27 . 2001-09-28 12:00 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27 . 2001-09-28 12:00 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55 . 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:55 . 2008-08-24 16:30 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-18 05:54 . 2008-08-24 16:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17 . 2002-09-09 12:08 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19 . 2002-09-09 12:08 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2002-08-28 23:59 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:09 . 2002-09-09 11:18 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09 . 2002-09-09 13:18 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-13 10:18 . 2010-02-13 10:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-02-12 04:35 . 2002-09-09 12:06 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2002-08-28 23:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] c:\documents and settings\Tessas\Program\Autostart\ Adobe Gamma.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] c:\documents and settings\All Users\Start-meny\Program\Autostart\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-12-14 25214] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program\\NetMeeting\\conf.exe"= "c:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"= "c:\\Program\\Messenger\\msmsgs.exe"= "c:\\Program\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\Spotify\\spotify.exe"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\AVG\\AVG9\\avgupd.exe"= "c:\\Program\\AVG\\AVG9\\avgnsx.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-24 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-02-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\AVG\AVG9\avgwdsvc.exe [2010-03-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-05-30 12661] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-02-29 716272] . Innehållet i mappen 'Schemalagda aktiviteter': 2010-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-05-09 c:\windows\Tasks\Symantec NetDetect.job - c:\program\Symantec\LiveUpdate\NDETECT.EXE [2005-01-22 15:08] 2010-05-09 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-18 20:18] . . ------- Extra genomsökning ------- . uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-09 13:59 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A8A45CF7-6BE6-B2C1-72491EAB2E9A6B2B}\{B617CAED-A840-2A11-665EBDF0B9E06934}\{20694653-0A9D-BD70-6F24016076B199C3}*] "1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44, fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'winlogon.exe'(568) c:\windows\system32\igfxsrvc.dll c:\windows\system32\hccutils.DLL . Sluttid: 2010-05-09 14:01:50 ComboFix-quarantined-files.txt 2010-05-09 12:01 ComboFix2.txt 2010-05-09 10:12 ComboFix3.txt 2010-05-08 16:22 Före genomsökningen: 34 839 040 000 byte ledigt Efter genomsökningen: 34 842 673 152 byte ledigt - - End Of File - - DD8A54B5DD2F5873B43D82148E1FFFC1
  5. Logg från SystemLook: SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 12:19 on 09/05/2010 by Carlsson (Administrator - Elevation successful) Invalid Context: filefindndis.sys -=End Of File=-
  6. Ny Combofix-logg: ComboFix 10-05-07.07 - Carlsson 2010-05-09 11:55:55.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.209 [GMT 2:00] Körs från: c:\documents and settings\Carlsson\Skrivbord\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\msxsltsso.dll Infekterad kopia av c:\windows\system32\drivers\ndis.sys hittades och desinficerades. Återställd kopia från - c:\windows\ServicePackFiles\i386\ndis.sys . (((((((((((((((((((((((( Filer Skapade från 2010-04-09 till 2010-05-09 )))))))))))))))))))))))))))))) . 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2010-05-08 11:52 . 2010-05-08 11:52 -------- d-----w- c:\windows\system32\config\systemprofile\Tracing 2010-05-08 11:51 . 2010-05-08 11:51 -------- d-----r- c:\documents and settings\LocalService\Favoriter 2010-05-07 21:18 . 2010-05-07 21:18 50990 ----a-w- c:\windows\system32\hjwkzkorga.exe 2010-04-22 16:29 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-24 08:53 . 2010-04-24 08:53 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2010-04-24 08:52 . 2010-02-23 21:53 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-24 08:50 . 2010-04-24 08:50 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-18 09:59 . 2004-10-15 17:04 -------- d-----w- c:\documents and settings\Carlsson\Application Data\AdobeUM 2010-04-18 09:20 . 2004-10-06 15:51 -------- d-----w- c:\program\Delade filer\Adobe 2010-04-17 16:03 . 2009-05-18 17:58 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Spotify 2010-04-16 15:48 . 2010-02-13 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-04-16 15:33 . 2010-02-13 10:18 -------- d-----w- c:\documents and settings\Carlsson\Application Data\skypePM 2010-04-12 17:22 . 2009-11-10 13:44 79488 ----a-w- c:\documents and settings\Carlsson\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-04-10 08:57 . 2010-04-10 08:57 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2010-03-28 15:27 . 2001-09-28 12:00 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27 . 2001-09-28 12:00 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55 . 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:55 . 2008-08-24 16:30 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-18 05:54 . 2008-08-24 16:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17 . 2002-09-09 12:08 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19 . 2002-09-09 12:08 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2002-08-28 23:59 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:09 . 2002-09-09 11:18 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09 . 2002-09-09 13:18 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-13 10:18 . 2010-02-13 10:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-02-12 04:35 . 2002-09-09 12:06 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2002-08-28 23:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] c:\documents and settings\Tessas\Program\Autostart\ Adobe Gamma.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] c:\documents and settings\All Users\Start-meny\Program\Autostart\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-12-14 25214] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program\\NetMeeting\\conf.exe"= "c:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"= "c:\\Program\\Messenger\\msmsgs.exe"= "c:\\Program\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\Spotify\\spotify.exe"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\AVG\\AVG9\\avgupd.exe"= "c:\\Program\\AVG\\AVG9\\avgnsx.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-24 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-02-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\AVG\AVG9\avgwdsvc.exe [2010-03-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-05-30 12661] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-02-29 716272] . Innehållet i mappen 'Schemalagda aktiviteter': 2010-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-05-08 c:\windows\Tasks\Symantec NetDetect.job - c:\program\Symantec\LiveUpdate\NDETECT.EXE [2005-01-22 15:08] 2010-05-09 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-18 20:18] . . ------- Extra genomsökning ------- . uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . - - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - - SSODL-GootkitSSO-{1571BC9F-9909-4A1F-BDA3-147F855B1EA5} - c:\windows\System32\msxsltsso.dll ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-09 12:06 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A8A45CF7-6BE6-B2C1-72491EAB2E9A6B2B}\{B617CAED-A840-2A11-665EBDF0B9E06934}\{20694653-0A9D-BD70-6F24016076B199C3}*] "1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44, fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'explorer.exe'(3092) c:\windows\system32\webcheck.dll . ------------------------ Andra processer som körs ------------------------ . c:\program\AVG\AVG9\avgchsvx.exe c:\program\AVG\AVG9\avgrsx.exe c:\program\AVG\AVG9\avgcsrvx.exe c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program\Bonjour\mDNSResponder.exe c:\program\Java\jre6\bin\jqs.exe c:\windows\system32\MsPMSPSv.exe c:\program\AVG\AVG9\avgnsx.exe . ************************************************************************** . Sluttid: 2010-05-09 12:12:24 - datorn startades om. ComboFix-quarantined-files.txt 2010-05-09 10:12 ComboFix2.txt 2010-05-08 16:22 Före genomsökningen: 34 926 772 224 byte ledigt Efter genomsökningen: 34 902 216 704 byte ledigt - - End Of File - - 47ACA1C1A37A742D5E340C320559338C
  7. Jag fick ingen svarslänk, fick bara upp en sida med texten: "0 bytes size received / Se ha recibido un archivo vacio". Testade flera gånger.
  8. När jag skickar c:\Windows\system32\drivers\ndis.sys får jag bara upp ett fönster med texten: "0 bytes size received / Se ha recibido un archivo vacio"
  9. Nu har jag laddat upp filerna på Virustotal: http://www.virustotal.com/sv/analisis/7660a9f917b4f40f24a76fb670e8d6c93449e871c3cbcd60529a379066805595-1272896193 http://www.virustotal.com/sv/analisis/8412ebd8bd424648725ad778ede540f678a42d8af36ec0c1f344cb51ca52d6a1-1273394863 http://www.virustotal.com/sv/analisis/255cb5fe173d96a443f25278a8139aa22c4fd722e44bb073cb7950345a610679-1273258018 http://www.virustotal.com/vt/sv/recepcion?7ec35c1a8b8ea25cab8630445e1898a2 Nu efter att jag installerade återställningskonsolen kan jag inte längre inaktivera anslutningen, och det vill jag ju kunna göra...
  10. Problemet är att AVG stänger av brandväggen också när jag följer de instruktioner jag fick av Cecilia tidigare. I ComboFix får jag meddelanden om att antivirusskyddet fortfarande är på: http://www.bleepingc...opic114351.html Men jag testar ändå så får vi se vad som händer.
  11. Ja det fick jag, jag svarade nej eftersom jag hade inaktiverat AVG och för att hämta var man tvungen att gå online. Tänkte att jag kunde göra det när allt var klart och jag dragit igång AVG igen. Jag ska alltså både köra ComboFix igen, OCH ladda ner filerna? Hur gör jag då jag måste inaktivera AVG för att köra ComboFix men samtidigt gå online för att hämta återställningskonsolen?
  12. Änligen klart! Här kommer loggen: ComboFix 10-05-07.07 - Carlsson 2010-05-08 18:01:11.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.206 [GMT 2:00] Körs från: c:\documents and settings\Carlsson\Skrivbord\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} VARNINIG -ÅTERSTÄLLNINGSKONSOLEN (THE RECOVERY CONSOLE) ÄR INTE INSTALLERAD PÅ DEN HÄR DATORN !! . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Carlsson\Application Data\020000005dfb0295C.manifest c:\documents and settings\Carlsson\Application Data\020000005dfb0295O.manifest c:\documents and settings\Carlsson\Application Data\020000005dfb0295P.manifest c:\documents and settings\Carlsson\Application Data\020000005dfb0295R.manifest c:\documents and settings\Carlsson\Application Data\020000005dfb0295S.manifest c:\documents and settings\Tessas\Program\Antimalware Doctor c:\documents and settings\Tessas\Program\Antimalware Doctor\Antimalware Doctor.lnk c:\documents and settings\Tessas\Program\Antimalware Doctor\Uninstall.lnk c:\program\Antivirus c:\program\Antivirus\avg_free_stf_en_8_138a1332.exe c:\windows\system32\Ijl11.dll c:\windows\system32\msxsltsso.dll c:\windows\system32\sgsnngyc.dll c:\windows\system32\ykmhbjvg.dll Infekterad kopia av c:\windows\system32\drivers\cdrom.sys hittades och desinficerades. Återställd kopia från - Kitty had a snack . ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SSHNAS (((((((((((((((((((((((( Filer Skapade från 2010-04-08 till 2010-05-08 )))))))))))))))))))))))))))))) . 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-08 13:23 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-08 13:23 . 2010-05-08 13:23 -------- d-----w- c:\program\Malwarebytes' Anti-Malware 2010-05-08 11:52 . 2010-05-08 11:52 -------- d-----w- c:\windows\system32\config\systemprofile\Tracing 2010-05-08 11:51 . 2010-05-08 11:51 -------- d-----r- c:\documents and settings\LocalService\Favoriter 2010-05-07 21:18 . 2010-05-07 21:18 50990 ----a-w- c:\windows\system32\hjwkzkorga.exe 2010-05-07 21:16 . 2010-05-07 21:16 210816 -c--a-w- c:\windows\system32\dllcache\ndis.sys 2010-04-22 16:29 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-07 21:16 . 2002-08-29 00:09 210816 ----a-w- c:\windows\system32\drivers\ndis.sys 2010-04-24 08:53 . 2010-04-24 08:53 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2010-04-24 08:52 . 2010-02-23 21:53 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-24 08:50 . 2010-04-24 08:50 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-18 09:59 . 2004-10-15 17:04 -------- d-----w- c:\documents and settings\Carlsson\Application Data\AdobeUM 2010-04-18 09:20 . 2004-10-06 15:51 -------- d-----w- c:\program\Delade filer\Adobe 2010-04-17 16:03 . 2009-05-18 17:58 -------- d-----w- c:\documents and settings\Carlsson\Application Data\Spotify 2010-04-16 15:48 . 2010-02-13 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-04-16 15:33 . 2010-02-13 10:18 -------- d-----w- c:\documents and settings\Carlsson\Application Data\skypePM 2010-04-12 17:22 . 2009-11-10 13:44 79488 ----a-w- c:\documents and settings\Carlsson\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-04-10 08:57 . 2010-04-10 08:57 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2010-03-28 15:27 . 2001-09-28 12:00 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27 . 2001-09-28 12:00 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55 . 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:55 . 2008-08-24 16:30 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-18 05:54 . 2008-08-24 16:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17 . 2002-09-09 12:08 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19 . 2002-09-09 12:08 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2002-08-28 23:59 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:09 . 2002-09-09 11:18 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09 . 2002-09-09 13:18 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-13 10:18 . 2010-02-13 10:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-02-12 04:35 . 2002-09-09 12:06 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2002-08-28 23:37 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . ------- Sigcheck ------- [-] 2010-05-07 21:16 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [------] . . c:\windows\system32\drivers\ndis.sys [-] 2010-05-07 21:16 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [------] . . c:\windows\system32\dllcache\ndis.sys [-] 2008-04-13 19:20 . !HASH: COULD NOT OPEN FILE !!!!! . 182656 . . [------] . . c:\windows\ServicePackFiles\i386\ndis.sys [-] 2004-08-04 06:14 . !HASH: COULD NOT OPEN FILE !!!!! . 182912 . . [------] . . c:\windows\$NtServicePackUninstall$\ndis.sys . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] "msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] c:\documents and settings\Tessas\Program\Autostart\ Adobe Gamma.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] c:\documents and settings\All Users\Start-meny\Program\Autostart\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-12-14 25214] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-03-18 05:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program\\NetMeeting\\conf.exe"= "c:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"= "c:\\Program\\Messenger\\msmsgs.exe"= "c:\\Program\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program\\Spotify\\spotify.exe"= "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program\\Bonjour\\mDNSResponder.exe"= "c:\\Program\\iTunes\\iTunes.exe"= "c:\\Program\\AVG\\AVG9\\avgupd.exe"= "c:\\Program\\AVG\\AVG9\\avgnsx.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-24 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-02-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\AVG\AVG9\avgwdsvc.exe [2010-03-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\SVKP.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-05-30 12661] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-02-29 716272] . Innehållet i mappen 'Schemalagda aktiviteter': 2010-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-05-08 c:\windows\Tasks\Symantec NetDetect.job - c:\program\Symantec\LiveUpdate\NDETECT.EXE [2005-01-22 15:08] 2010-05-08 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-18 20:18] . . ------- Extra genomsökning ------- . uStart Page = hxxp://www.yahoomail.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: cnet.com\download DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . - - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - - SSODL-GootkitSSO-{92E434D8-F7F1-43D3-955B-E8E270D9738A} - c:\windows\System32\msxsltsso.dll Notify-6c5c78f6382 - c:\windows\system32\__c00C5394.dat ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-08 18:15 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe >>UNKNOWN [0x8234E0E0]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf8585f28 \Driver\ACPI -> ACPI.sys @ 0xf84f8cb8 \Driver\atapi -> atapi.sys @ 0xf848a852 IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615 ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615 ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac NDIS: -> SendCompleteHandler -> 0x0 PacketIndicateHandler -> 0x0 SendHandler -> 0x0 user & kernel MBR OK ************************************************************************** . --------------------- LÅSTA REGISTERNYCKLAR --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A8A45CF7-6BE6-B2C1-72491EAB2E9A6B2B}\{B617CAED-A840-2A11-665EBDF0B9E06934}\{20694653-0A9D-BD70-6F24016076B199C3}*] "1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44, fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLer som "laddats" under processer som körs --------------------- - - - - - - - > 'explorer.exe'(3384) c:\windows\system32\webcheck.dll . ------------------------ Andra processer som körs ------------------------ . c:\program\AVG\AVG9\avgchsvx.exe c:\program\AVG\AVG9\avgrsx.exe c:\program\AVG\AVG9\avgcsrvx.exe c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program\Bonjour\mDNSResponder.exe c:\program\Java\jre6\bin\jqs.exe c:\windows\system32\MsPMSPSv.exe c:\program\AVG\AVG9\avgnsx.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Sluttid: 2010-05-08 18:22:02 - datorn startades om. ComboFix-quarantined-files.txt 2010-05-08 16:21 Före genomsökningen: 33 402 306 560 byte ledigt Efter genomsökningen: 34 922 930 176 byte ledigt - - End Of File - - 30F76DB1E7DE3DF183FB87E01C84EB48
  13. När Malwarebytes kört klart fick jag upp detta meddelande: "Vissa poster kunde inte tas bort. En loggfil sparades till loggmappen. Din dator behöver startas om för att slutföra borttagningsprocessen. Vill du starta om datorn nu?" Har detta att göra med att jag bockade ur C:\WINDOWS\system32\Drivers\ntndis.sys? Hur går jag vidare, ska jag starta om datorn?
  14. Super! Då återkommer jag om 15 min. + tiden det tar att köra ComboFix. Tusen tack för hjälpen till er båda så länge!
  15. Anslutningen mellan modem och datorn är med kabel (alltså inte USB ). Då är det fritt fram alltså?
  16. Ja, jag stängde den när jag körde RKill. Jag vet inte om jag har USB-modem eller USB-nätverkskort, vågar jag köra ComboFix då?
  17. Nu har jag kört RKill 3 ggr, den svarta rutan kommer upp och sedan inget, förutom en bekräftelse i txt-format att det är slutfört. Är det rätt? Testar att köra Malwarebytes och DDS nu (märker redan att datorn blivit piggare )
  18. Tog en himla tid att få ner. Känns som att allt bara går segare och segare. Malwarebytes hittade 66 filer ( ) så det kanske inte är så konstigt. Bifogar loggen. Vilka bör jag ta bort? mbam-log-2010-05-08 (15-59-19).txt
  19. Kan detta vara rätt från AVG (Virus vault)? "Infection";"Trojan horse Cryptic.LK";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\tyysqcc.exe";"";"2010-05-07, 23:18:28" "Infection";"Trojan horse SHeur3.VDE";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\uxq9by.exe";"";"2010-05-07, 23:18:37" "Infection";"Trojan horse Rootkit-Agent.EG";"C:\WINDOWS\system32\drivers\aec.sys";"";"2010-05-07, 23:18:37" "Infection";"Trojan horse Rootkit-Agent.EG";"C:\WINDOWS\system32\drivers\ipnhc.sys";"";"2010-05-07, 23:18:37" "Infection";"Trojan horse Downloader.Agent2.SNU";"C:\WINDOWS\system32\msxsltsso.dll";"";"2010-05-07, 23:18:38" "Infection";"Trojan horse Dropper.Generic2.GLN";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\878.exe";"";"2010-05-07, 23:18:44" "Infection";"Trojan horse Dropper.Generic2.GGE";"C:\WINDOWS\system32\nkghqexjt.exe";"";"2010-05-07, 23:23:34" "Infection";"Trojan horse Downloader.Generic9.BDXG";"C:\Documents and Settings\Carlsson\Application Data\6B1BF2894DF37D8D65C53AF902C34E41\hookdll.dll";"";"2010-05-07, 23:28:03" "Infection";"Trojan horse Cryptic.LK";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\mcillbuu.exe";"";"2010-05-07, 23:32:28" "Infection";"Trojan horse Cryptic.LK";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temporary Internet Files\Content.IE5\2212XFLK\fjnvpk[1].htm";"";"2010-05-07, 23:41:29" "Infection";"Trojan horse Cryptic.LK";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temporary Internet Files\Content.IE5\TTLWTMOA\fjnvpk[1].htm";"";"2010-05-07, 23:48:57" "Infection";"Trojan horse Generic17.BRVA";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temporary Internet Files\Content.IE5\TTLWTMOA\imwaic[1].htm";"";"2010-05-07, 23:49:01" "Infection";"Trojan horse Dropper.Generic2.GGE";"C:\Documents and Settings\Carlsson\nkghqexjt.exe";"";"2010-05-07, 23:54:31" "Infection";"Trojan horse Downloader.Agent2.SNU";"C:\WINDOWS\system32\msxsltsso.dll";"";"2010-05-08, 00:53:13" "PUP";"Adware Generic4.AFDI";"C:\WINDOWS\system32\nuwynjythpcrv.dll";"";"2010-05-08, 00:53:17" "Infection";"Trojan horse Generic17.BRVA";"C:\WINDOWS\system32\regedit.exe";"";"2010-05-08, 00:53:22" "Infection";"Trojan horse Generic17.BRVA";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\imiyus.exe";"";"2010-05-08, 08:00:19" "Infection";"Trojan horse Generic17.BRVA";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\awkvrft.exe";"";"2010-05-08, 08:00:19" "PUP";"Adware Generic4.AFDI";"C:\Documents and Settings\Carlsson\Lokala inställningar\Temp\RarSFX0\howi410.exe";"";"2010-05-08, 08:10:55" "Infection";"Trojan horse Rootkit-Agent.EG";"C:\System Volume Information\_restore{CEDDDEE4-FB13-4675-A7E6-39FDF5A67B5D}\RP1439\A0107403.sys";"";"2010-05-08, 09:35:33" "Infection";"Trojan horse Dropper.Generic2.GGE";"C:\System Volume Information\_restore{CEDDDEE4-FB13-4675-A7E6-39FDF5A67B5D}\RP1439\A0108380.exe";"";"2010-05-08, 10:24:43" "Infection";"Trojan horse Downloader.Agent2.SNU";"C:\WINDOWS\system32\msxsltsso.dll";"";"2010-05-08, 10:32:02"
  20. Här kommer DDS-loggen: DDS (Ver_10-03-17.01) - NTFSx86 Run by Carlsson at 13:10:40,37 on 2010-05-08 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.503.58 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program\AVG\AVG9\avgchsvx.exe C:\Program\AVG\AVG9\avgrsx.exe svchost.exe C:\Program\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program\AVG\AVG9\avgwdsvc.exe C:\Program\Bonjour\mDNSResponder.exe C:\WINDOWS\Explorer.EXE C:\Program\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\MsPMSPSv.exe C:\Program\AVG\AVG9\avgnsx.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\taskmgr.exe C:\Program\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe svchost.exe C:\DOCUME~1\Carlsson\LOKALA~1\Temp\khvcol.exe C:\Program\Internet Explorer\iexplore.exe C:\Program\AVG\AVG9\avgui.exe C:\DOCUME~1\Carlsson\LOKALA~1\Temp\Qxr.exe C:\Program\AVG\AVG9\avgscanx.exe C:\Program\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\Qqofia.exe C:\Documents and Settings\Carlsson\Skrivbord\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoomail.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: CvgraphObj Object: {12355f3e-90c3-41aa-8705-15969af7f210} - c:\windows\vgraph.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program\avg\avg9\avgssie.dll BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File mRun: [28218] c:\docume~1\carlsson\lokala~1\temp\khvcol.exe mRunServices: [virtual] winit.exe mRunServices: [winprotect] winprotect.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE mExplorerRun: [50pfo] c:\docume~1\carlsson\lokala~1\temp\uxq9by.exe StartupFolder: c:\docume~1\tessas\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\tessas\program\autost~1\antima~1.lnk - c:\documents and settings\carlsson\application data\6b1bf2894df37d8d65c53af902c34e41\gotnewupdate000.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adober~1.lnk - c:\program\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft office\office10\OSA.EXE IE: Convert link target to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportera till Microsoft Excel - c:\program\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program\avg\avg9\avgpp.dll Notify: 6c5c78f6382 - c:\windows\system32\__c00C5394.dat Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxsrvc.dll Notify: __c002DF46 - c:\windows\system32\__c002DF46.dat Notify: __c00625B0 - c:\windows\system32\__c00625B0.dat Notify: __c009CC40 - c:\windows\system32\__c009CC40.dat Notify: __c00D8E43 - c:\windows\system32\__c00D8E43.dat Notify: __c00F6C71 - c:\windows\system32\__c00F6C71.dat SSODL: GootkitSSO - {F9C48D19-7C91-4DCD-945E-A7A4149436F0} - c:\windows\system32\msxsltsso.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-24 216200] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-24 29512] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-23 242896] R2 avg9wd;AVG Free WatchDog;c:\program\avg\avg9\avgwdsvc.exe [2010-3-18 308064] S0 ipnhc;ipnhc; [x] S2 SVKP;SVKP;\??\c:\windows\system32\svkp.sys --> c:\windows\system32\SVKP.sys [?] S3 RioS50;RioS50 driver;c:\windows\system32\drivers\RioS50.sys [2005-5-30 12661] =============== Created Last 30 ================ 2010-05-07 21:20:14 0 d-----w- c:\docume~1\carlsson\applic~1\Smart-Ads-Solutions 2010-05-07 21:19:04 1 ----a-w- c:\documents and settings\carlsson\oashdihasidhasuidhiasdhiashdiuasdhasd 2010-05-07 21:18:30 0 d-----w- c:\program\Smart-Ads-Solutions 2010-05-07 21:18:18 50990 ----a-w- c:\windows\system32\hjwkzkorga.exe 2010-05-07 21:18:09 0 d-----w- c:\program\ezLife 2010-05-07 21:17:12 175104 ----a-w- c:\windows\Qqofia.exe 2010-05-07 21:16:56 210816 -c--a-w- c:\windows\system32\dllcache\ndis.sys 2010-05-07 21:16:41 216576 ----a-w- c:\windows\system32\sshnas21.dll 2010-05-07 21:16:37 24064 -c--a-w- C:\lsass.exe 2010-05-07 21:16:13 36743 ----a-w- c:\windows\system32\net.net 2010-05-02 23:06:14 298496 ----a-w- c:\windows\system32\ykmhbjvg.dll 2010-05-02 23:05:46 319488 ----a-w- c:\windows\system32\sgsnngyc.dll 2010-04-22 16:29:58 293376 ------w- c:\windows\system32\browserchoice.exe ==================== Find3M ==================== 2010-05-07 21:16:57 210816 ----a-w- c:\windows\system32\drivers\ndis.sys 2010-04-24 08:52:52 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-03-28 15:27:28 47992 ----a-w- c:\windows\system32\perfc01D.dat 2010-03-28 15:27:28 315338 ----a-w- c:\windows\system32\perfh01D.dat 2010-03-18 05:55:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-18 05:54:58 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-10 06:17:42 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:19:40 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-17 12:09:32 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:09:30 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-14 19:32:57 58728 ----a-w- c:\windows\fonts\scriptina.zip 2010-02-12 04:35:03 100864 ----a-w- c:\windows\system32\6to4svc.dll 2009-05-20 17:34:42 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012009052020090521\index.dat ============= FINISH: 13:15:02,96 =============== Attach.txt
  21. Hejsan! Otroligt tacksam för hjälp, dessa bitar är jag helt novis på. När jag öppnade en webbsida fick jag upp det där vanliga meddelandet med texten "du har femhundrasjuttioelva möjliga hot, ladda ner xx för att få bort dem, bla bla". Klickade bort det och då fick jag upp ett meddelande från Windows som sa att nya program hade installerats. Efter det fick jag meddelande på meddelande från AVG om virus. Körde en scan där 12 filer hittades. Under tiden ploppar det upp falska varningsmeddelanden, en fejkscan börjar rulla och flera fönster öppnas i explorer. Skickade 10/12 till "vault" men fick inte bort ovanstående. Körde ett par virusscan igen och det var bara dessa två som visades. Sista gången kör jag nu och just i detta nu är jag uppe i över 10 st igen. Datorn är otroligt seg när det gäller att ladda webbsidor och det öppnas nya fönster i expolorer sporadiskt (som jag klickar bort, vissa har AVG blockerat direkt). Hur hittar jag rätt logg i AVG (vad ska den visa)? Ska genast fixa loggen från DDS!
  22. Surfade runt igår och lyckades dra på mig all möjlig s*it. Det mesta lyckades jag få bort med AVG men inte "Trojan horse Generic17.BKCS". Nu när jag kör AVG för 10:e gången efter den första rensningen har jag plötsligt över 10 found threats - igen. Verkar som att den lilla rackaren förökar sig... Vore extremt tacksam för en detljerad steg för steg-beskrivning hur jag får bort detta. Det verkar hålla till i C:\WINDOWS\system32\svchost.exe och C:\WINDOWS\system32\services.exe.
×
×
  • Skapa nytt...