Gå till innehåll

Oscar

Medlem
 Visa profil  Visa deras aktivitet

  • Innehållsantal

    14

  • Gick med

  • Besökte senast

 Innehållstyp 

Inlägg postade av Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej igen,

    Detta verkar ha gjort susen, många härliga knep och kommandon jag inte hade en aning om hur man fick fram i Vista! Lärt mig massor. Tack!

    HJT-loggen:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 18:30:57, on 2008-10-12

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32Dwm.exe

    C:Windowssystem32taskeng.exe

    C:WindowsExplorer.EXE

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:Program FilesAdobeReader 8.0Readerreader_sl.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:WindowsPLFSetI.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Windowssystem32wbemunsecapp.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    C:Program FilesAcerAcer VCMVC.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    O1 - Hosts: ::1 localhost

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe

    O4 - HKLM..Run: [PLFSetI] C:WindowsPLFSetI.exe

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 7524 bytes

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Fil jmcr_ms.ico mottagen 2008.10.12 13:50:22 (CET)

    Resultat: 0/36 (0%)

    Antivirus Version Senaste Uppdatering Resultat

    AhnLab-V3 2008.10.10.1 2008.10.10 -

    AntiVir 7.8.1.34 2008.10.11 -

    Authentium 5.1.0.4 2008.10.11 -

    Avast 4.8.1248.0 2008.10.11 -

    AVG 8.0.0.161 2008.10.11 -

    BitDefender 7.2 2008.10.12 -

    CAT-QuickHeal 9.50 2008.10.11 -

    ClamAV 0.93.1 2008.10.12 -

    DrWeb 4.44.0.09170 2008.10.12 -

    eSafe 7.0.17.0 2008.10.08 -

    eTrust-Vet 31.6.6141 2008.10.10 -

    Ewido 4.0 2008.10.12 -

    F-Prot 4.4.4.56 2008.10.11 -

    F-Secure 8.0.14332.0 2008.10.12 -

    Fortinet 3.113.0.0 2008.10.12 -

    GData 19 2008.10.12 -

    Ikarus T3.1.1.34.0 2008.10.12 -

    K7AntiVirus 7.10.491 2008.10.11 -

    Kaspersky 7.0.0.125 2008.10.12 -

    McAfee 5403 2008.10.11 -

    Microsoft 1.4005 2008.10.12 -

    NOD32 3515 2008.10.11 -

    Norman 5.80.02 2008.10.10 -

    Panda 9.0.0.4 2008.10.12 -

    PCTools 4.4.2.0 2008.10.12 -

    Prevx1 V2 2008.10.12 -

    Rising 20.65.42.00 2008.10.10 -

    SecureWeb-Gateway 6.7.6 2008.10.11 -

    Sophos 4.34.0 2008.10.12 -

    Sunbelt 3.1.1716.1 2008.10.12 -

    Symantec 10 2008.10.12 -

    TheHacker 6.3.1.0.108 2008.10.11 -

    TrendMicro 8.700.0.1004 2008.10.10 -

    VBA32 3.12.8.6 2008.10.12 -

    ViRobot 2008.10.10.1416 2008.10.10 -

    VirusBuster 4.5.11.0 2008.10.11 -

    Övrig information

    File size: 15086 bytes

    Fil jmcr_mmc.ico mottagen 2008.10.12 13:53:00 (CET)

    Resultat: 0/36 (0%)

    Antivirus Version Senaste Uppdatering Resultat

    AhnLab-V3 2008.10.10.1 2008.10.10 -

    AntiVir 7.8.1.34 2008.10.11 -

    Authentium 5.1.0.4 2008.10.11 -

    Avast 4.8.1248.0 2008.10.11 -

    AVG 8.0.0.161 2008.10.11 -

    BitDefender 7.2 2008.10.12 -

    CAT-QuickHeal 9.50 2008.10.11 -

    ClamAV 0.93.1 2008.10.12 -

    DrWeb 4.44.0.09170 2008.10.12 -

    eSafe 7.0.17.0 2008.10.08 -

    eTrust-Vet 31.6.6141 2008.10.10 -

    Ewido 4.0 2008.10.12 -

    F-Prot 4.4.4.56 2008.10.11 -

    F-Secure 8.0.14332.0 2008.10.12 -

    Fortinet 3.113.0.0 2008.10.12 -

    GData 19 2008.10.12 -

    Ikarus T3.1.1.34.0 2008.10.12 -

    K7AntiVirus 7.10.491 2008.10.11 -

    Kaspersky 7.0.0.125 2008.10.12 -

    McAfee 5403 2008.10.11 -

    Microsoft 1.4005 2008.10.12 -

    NOD32 3515 2008.10.11 -

    Norman 5.80.02 2008.10.10 -

    Panda 9.0.0.4 2008.10.12 -

    PCTools 4.4.2.0 2008.10.12 -

    Prevx1 V2 2008.10.12 -

    Rising 20.65.42.00 2008.10.10 -

    SecureWeb-Gateway 6.7.6 2008.10.11 -

    Sophos 4.34.0 2008.10.12 -

    Sunbelt 3.1.1716.1 2008.10.12 -

    Symantec 10 2008.10.12 -

    TheHacker 6.3.1.0.108 2008.10.11 -

    TrendMicro 8.700.0.1004 2008.10.10 -

    VBA32 3.12.8.6 2008.10.12 -

    ViRobot 2008.10.10.1416 2008.10.10 -

    VirusBuster 4.5.11.0 2008.10.11 -

    Övrig information

    File size: 15086 bytes

    Fil Suyin.reg mottagen 2008.10.12 13:55:27 (CET)

    Resultat: 0/36 (0%)

    Antivirus Version Senaste Uppdatering Resultat

    AhnLab-V3 2008.10.10.1 2008.10.10 -

    AntiVir 7.8.1.34 2008.10.11 -

    Authentium 5.1.0.4 2008.10.11 -

    Avast 4.8.1248.0 2008.10.11 -

    AVG 8.0.0.161 2008.10.11 -

    BitDefender 7.2 2008.10.12 -

    CAT-QuickHeal 9.50 2008.10.11 -

    ClamAV 0.93.1 2008.10.12 -

    DrWeb 4.44.0.09170 2008.10.12 -

    eSafe 7.0.17.0 2008.10.08 -

    eTrust-Vet 31.6.6141 2008.10.10 -

    Ewido 4.0 2008.10.12 -

    F-Prot 4.4.4.56 2008.10.11 -

    F-Secure 8.0.14332.0 2008.10.12 -

    Fortinet 3.113.0.0 2008.10.12 -

    GData 19 2008.10.12 -

    Ikarus T3.1.1.34.0 2008.10.12 -

    K7AntiVirus 7.10.491 2008.10.11 -

    Kaspersky 7.0.0.125 2008.10.12 -

    McAfee 5403 2008.10.11 -

    Microsoft 1.4005 2008.10.12 -

    NOD32 3515 2008.10.11 -

    Norman 5.80.02 2008.10.10 -

    Panda 9.0.0.4 2008.10.12 -

    PCTools 4.4.2.0 2008.10.12 -

    Prevx1 V2 2008.10.12 -

    Rising 20.65.42.00 2008.10.10 -

    SecureWeb-Gateway 6.7.6 2008.10.11 -

    Sophos 4.34.0 2008.10.12 -

    Sunbelt 3.1.1716.1 2008.10.12 -

    Symantec 10 2008.10.12 -

    TheHacker 6.3.1.0.108 2008.10.11 -

    TrendMicro 8.700.0.1004 2008.10.10 -

    VBA32 3.12.8.6 2008.10.12 -

    ViRobot 2008.10.10.1416 2008.10.10 -

    VirusBuster 4.5.11.0 2008.10.11 -

    Övrig information

    File size: 4838 bytes

    (Jag tog bort msnfix-filen och tömde papperskorgen.

    Det ska nog vara allt för den här gången  :)

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej,

    C:Windowsupdater.MSNFix är en "msnfix-fil" säger systemet. Den är på 48kb.

    Virustotal sökningar:

    Fil jmcr.sys mottagen 2008.10.12 13:42:49 (CET)

    Resultat: 1/36 (2.78%)

    Antivirus Version Senaste Uppdatering Resultat

    AhnLab-V3 2008.10.10.1 2008.10.10 -

    AntiVir 7.8.1.34 2008.10.11 -

    Authentium 5.1.0.4 2008.10.11 -

    Avast 4.8.1248.0 2008.10.11 -

    AVG 8.0.0.161 2008.10.11 -

    BitDefender 7.2 2008.10.12 -

    CAT-QuickHeal 9.50 2008.10.11 -

    ClamAV 0.93.1 2008.10.12 -

    DrWeb 4.44.0.09170 2008.10.12 -

    eSafe 7.0.17.0 2008.10.08 -

    eTrust-Vet 31.6.6141 2008.10.10 -

    Ewido 4.0 2008.10.12 -

    F-Prot 4.4.4.56 2008.10.11 -

    F-Secure 8.0.14332.0 2008.10.12 -

    Fortinet 3.113.0.0 2008.10.12 -

    GData 19 2008.10.12 -

    Ikarus T3.1.1.34.0 2008.10.12 -

    K7AntiVirus 7.10.491 2008.10.11 -

    Kaspersky 7.0.0.125 2008.10.12 -

    McAfee 5403 2008.10.11 -

    Microsoft 1.4005 2008.10.12 -

    NOD32 3515 2008.10.11 -

    Norman 5.80.02 2008.10.10 -

    Panda 9.0.0.4 2008.10.12 -

    PCTools 4.4.2.0 2008.10.12 -

    Prevx1 V2 2008.10.12 -

    Rising 20.65.42.00 2008.10.10 -

    SecureWeb-Gateway 6.7.6 2008.10.11 -

    Sophos 4.34.0 2008.10.12 -

    Sunbelt 3.1.1716.1 2008.10.12 -

    Symantec 10 2008.10.12 -

    TheHacker 6.3.1.0.108 2008.10.11 -

    TrendMicro 8.700.0.1004 2008.10.10 -

    VBA32 3.12.8.6 2008.10.12 suspected of Win32.BrokenEmbeddedSignature  (paranoid heuristics)

    ViRobot 2008.10.10.1416 2008.10.10 -

    VirusBuster 4.5.11.0 2008.10.11 -

    Övrig information

    File size: 84240 bytes

    Fil jmcr_xd.ico mottagen 2008.10.12 13:46:50 (CET)

    Resultat: 0/36 (0%)

    Antivirus Version Senaste Uppdatering Resultat

    AhnLab-V3 2008.10.10.1 2008.10.10 -

    AntiVir 7.8.1.34 2008.10.11 -

    Authentium 5.1.0.4 2008.10.11 -

    Avast 4.8.1248.0 2008.10.11 -

    AVG 8.0.0.161 2008.10.11 -

    BitDefender 7.2 2008.10.12 -

    CAT-QuickHeal 9.50 2008.10.11 -

    ClamAV 0.93.1 2008.10.12 -

    DrWeb 4.44.0.09170 2008.10.12 -

    eSafe 7.0.17.0 2008.10.08 -

    eTrust-Vet 31.6.6141 2008.10.10 -

    Ewido 4.0 2008.10.12 -

    F-Prot 4.4.4.56 2008.10.11 -

    F-Secure 8.0.14332.0 2008.10.12 -

    Fortinet 3.113.0.0 2008.10.12 -

    GData 19 2008.10.12 -

    Ikarus T3.1.1.34.0 2008.10.12 -

    K7AntiVirus 7.10.491 2008.10.11 -

    Kaspersky 7.0.0.125 2008.10.12 -

    McAfee 5403 2008.10.11 -

    Microsoft 1.4005 2008.10.12 -

    NOD32 3515 2008.10.11 -

    Norman 5.80.02 2008.10.10 -

    Panda 9.0.0.4 2008.10.12 -

    PCTools 4.4.2.0 2008.10.12 -

    Prevx1 V2 2008.10.12 -

    Rising 20.65.42.00 2008.10.10 -

    SecureWeb-Gateway 6.7.6 2008.10.11 -

    Sophos 4.34.0 2008.10.12 -

    Sunbelt 3.1.1716.1 2008.10.12 -

    Symantec 10 2008.10.12 -

    TheHacker 6.3.1.0.108 2008.10.11 -

    TrendMicro 8.700.0.1004 2008.10.10 -

    VBA32 3.12.8.6 2008.10.12 -

    ViRobot 2008.10.10.1416 2008.10.10 -

    VirusBuster 4.5.11.0 2008.10.11 -

    Övrig information

    File size: 15086 bytes

    Fler filer kommer, får inte plats med allt i samma post.

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej,

    updater.MSNFix är den filen som finns med liknande namn under C:Windows.

    Det som saknades i Combofix:

    ComboFix 08-10-11.01 - Oscar 2008-10-11 22:50:21.1 - NTFSx86

    Microsoft® Windows Vista Home Premium  6.0.6001.1.1252.1.1053.18.1974 [GMT 2:00]

    Running from: C:UsersOscarDesktopComboFix.exe

    * Created a new restore point

    .

    (((((((((((((((((((((((((  Files Created from 2008-09-11 to 2008-10-11  )))))))))))))))))))))))))))))))

    .

    2008-10-10 13:36 . 2008-10-10 13:36 <KAT> d-------- C:UsersAll UsersMalwarebytes

    2008-10-10 13:36 . 2008-10-10 13:36 <KAT> d-------- C:ProgramDataMalwarebytes

    2008-10-10 13:36 . 2008-10-10 13:37 <KAT> d-------- C:Program FilesMalwarebytes' Anti-Malware

    2008-10-10 13:36 . 2008-09-10 00:04 38,528 --a------ C:WindowsSystem32driversmbamswissarmy.sys

    2008-10-10 13:36 . 2008-09-10 00:03 17,200 --a------ C:WindowsSystem32driversmbam.sys

    2008-10-09 19:34 . 2008-10-09 19:34 <KAT> d-------- C:Program FilesTrend Micro

    2008-10-09 19:29 . 2008-10-09 19:29 <KAT> d-------- C:Program FilesCCleaner

    2008-10-09 09:46 . 2008-10-09 09:46 <KAT> d-------- C:Program FilesmIRC

    2008-10-05 11:56 . 2008-10-05 11:56 <KAT> d-------- C:Program FilesPanda Security

    2008-10-05 11:56 . 2008-06-19 17:24 28,544 --a------ C:WindowsSystem32driverspavboot.sys

    2008-10-04 21:10 . 2008-10-04 21:10 49,152 --a------ C:Windowsupdater.MSNFix

    2008-09-27 11:52 . 2008-10-02 09:53 <KAT> d-------- C:Installerade spel

    2008-09-18 12:05 . 2008-09-18 12:05 14,336 --a------ C:WindowsSystem32driversPN31Snoop.sys

    2008-09-18 09:45 . 2008-07-19 07:09 1,811,656 --a------ C:WindowsSystem32wuaueng.dll

    2008-09-18 09:45 . 2008-07-19 05:44 1,524,736 --a------ C:WindowsSystem32wucltux.dll

    2008-09-18 09:45 . 2008-07-19 07:09 563,912 --a------ C:WindowsSystem32wuapi.dll

    2008-09-18 09:45 . 2008-07-18 22:08 163,904 --a------ C:WindowsSystem32wuwebv.dll

    2008-09-18 09:45 . 2008-07-19 05:44 83,456 --a------ C:WindowsSystem32wudriver.dll

    2008-09-18 09:45 . 2008-07-19 07:10 53,448 --a------ C:WindowsSystem32wuauclt.exe

    2008-09-18 09:45 . 2008-07-19 07:10 45,768 --a------ C:WindowsSystem32wups2.dll

    2008-09-18 09:45 . 2008-07-19 07:10 36,552 --a------ C:WindowsSystem32wups.dll

    2008-09-18 09:45 . 2008-07-18 20:44 31,232 --a------ C:WindowsSystem32wuapp.exe

    2008-09-17 20:14 . 2008-09-17 20:14 0 --ah----- C:WindowsSystem32driversMsft_User_WpdFs_01_00_00.Wdf

    2008-09-14 19:11 . 2008-09-25 17:20 <KAT> d-------- C:UsersOscar.crossftp

    2008-09-14 19:05 . 2008-09-14 19:05 <KAT> d-------- C:UsersAll UsersGoogle

    2008-09-14 19:05 . 2008-09-14 21:29 <KAT> d-------- C:Program FilesGoogle

    2008-09-14 19:03 . 2008-09-14 19:04 <KAT> d-------- C:Program FilesJava

    2008-09-14 19:01 . 2008-09-14 19:01 <KAT> d-------- C:Program FilesCommon FilesJava

    2008-09-14 10:52 . 2008-09-16 14:34 <KAT> d-------- C:Program FilesReClock

    2008-09-14 10:37 . 2008-09-14 10:37 <KAT> d-------- C:Program FilesVistaCodecPack

    2008-09-14 10:36 . 2008-09-14 10:36 <KAT> d-------- C:UsersAll UsersVistaCodecs

    2008-09-14 10:36 . 2008-09-14 10:36 <KAT> d-------- C:ProgramDataVistaCodecs

    2008-09-14 10:13 . 2008-09-14 10:14 <KAT> d-------- C:Program FilesMediaplayer classic

    2008-09-13 20:31 . 2008-09-14 19:47 <KAT> d-------- C:Program FilesCoreCodec

    2008-09-13 20:28 . 2008-09-13 20:28 <KAT> d-------- C:Program FilesRealMedia

    2008-09-13 20:28 . 2008-09-13 20:28 <KAT> d-------- C:Program FilesOpenSource Flash Video Splitter

    2008-09-13 20:28 . 2008-09-13 20:28 <KAT> d-------- C:Program FilesDSP-worx

    2008-09-13 20:28 . 2008-09-13 20:28 <KAT> d-------- C:Program FilesDScaler5

    2008-09-13 20:28 . 2008-09-13 20:28 <KAT> d-------- C:Program FilesDirectVobSub

    2008-09-13 09:59 . 2008-09-13 09:59 <KAT> d-------- C:UsersAll Userssentinel

    2008-09-13 09:59 . 2008-09-13 09:59 <KAT> d-------- C:ProgramDatasentinel

    2008-09-13 09:58 . 2008-09-13 09:59 <KAT> d-------- C:WindowsSystem32PAV

    2008-09-13 09:58 . 2008-10-11 22:33 <KAT> d-------- C:Program FilesPanda Antivirus 2008

    2008-09-13 09:58 . 2007-03-15 17:38 54,832 --a------ C:WindowsSystem32pavcpl.cpl

    2008-09-13 09:58 . 2007-02-15 19:02 50,736 --a------ C:WindowsSystem32avldr.dll

    2008-09-13 09:58 . 2007-09-28 13:24 46,648 --a------ C:WindowsSystem32driversamm8660.sys

    2008-09-13 09:58 . 2008-09-13 09:58 218 --a------ C:WindowsSystem32PavCPL.dat

    2008-09-13 09:56 . 2008-09-13 09:56 <KAT> d-------- C:Program FilesCommon FilesPanda Software

    2008-09-13 09:56 . 2007-07-12 13:49 178,872 --a------ C:WindowsSystem32driversPavProc.sys

    2008-09-13 09:56 . 2007-05-23 15:40 38,968 --a------ C:WindowsSystem32driversShlDrv51.sys

    2008-09-13 09:41 . 2008-09-13 09:41 <KAT> d-------- C:Program FilesDAEMON Tools Lite

    2008-09-13 03:20 . 2008-05-06 20:10 749,568 --a------ C:WindowsAcerStore.exe

    2008-09-13 03:20 . 2008-06-13 03:29 2,479 --ahs---- C:Patch.rev

    2008-09-13 03:20 . 2008-09-13 03:20 1,300 --a------ C:WindowsAceStore.cfg

    2008-09-13 03:19 . 2008-01-10 21:44 199,176 --a------ C:WindowsGVUni.exe

    2008-09-13 03:18 . 2008-09-13 03:18 <KAT> d-------- C:WindowsUsers

    2008-09-13 03:18 . 2008-04-28 16:29 3,658,752 --a------ C:WindowsSystem32driversNETw5v32.sys

    2008-09-13 03:18 . 2008-04-19 02:09 2,756,608 --a------ C:WindowsSystem32NETw5r32.dll

    2008-09-13 03:18 . 2008-04-19 02:08 659,456 --a------ C:WindowsSystem32NETw5c32.dll

    2008-09-13 03:18 . 2007-12-04 01:11 207,368 --a------ C:WindowsUNINST32.EXE

    2008-09-13 03:18 . 2006-11-03 07:29 21,264 --a------ C:WindowsSystem32driversDKbFltr.sys

    2008-09-13 03:18 . 2008-09-13 03:18 1,276 --a------ C:WindowsSystem32AcerScre.cfg

    2008-09-12 17:33 . 2008-04-03 22:56 1,079,840 --a------ C:WindowsSystem32nvcpluir.dll

    2008-09-12 17:33 . 2008-04-03 22:56 768,544 --a------ C:WindowsSystem32nvcplui.exe

    2008-09-12 17:33 . 2008-04-03 22:56 442,368 --a------ C:WindowsSystem32nvuninst.exe

    2008-09-12 17:33 . 2008-04-03 22:56 420,384 --a------ C:WindowsSystem32nvcpl.cpl

    2008-09-12 17:33 . 2008-04-03 22:56 313,888 --a------ C:WindowsSystem32nvexpbar.dll

    2008-09-12 16:24 . 2008-09-12 16:24 <KAT> d-------- C:EGIS_Drive

    2008-09-12 16:20 . 2008-09-12 16:21 <KAT> d-------- C:Program FilesFlashFXP

    2008-09-12 16:00 . 2008-09-23 14:53 <KAT> dr------- C:UsersOscarVideos

    2008-09-12 15:41 . 2008-09-12 15:41 717,296 --a------ C:WindowsSystem32driverssptd.sys

    2008-09-12 15:23 . 2008-09-12 15:23 <KAT> d-------- C:WindowsPCHEALTH

    2008-09-12 15:20 . 2008-09-12 15:20 <KAT> d-------- C:UsersAll UsersWLInstaller

    2008-09-12 15:20 . 2008-09-12 15:20 <KAT> d-------- C:ProgramDataWLInstaller

    2008-09-12 15:20 . 2008-09-12 15:23 <KAT> d-------- C:Program FilesWindows Live

    2008-09-12 15:20 . 2008-09-12 15:23 <KAT> d--hsc--- C:Program FilesCommon FilesWindowsLiveInstaller

    2008-09-12 15:10 . 2008-07-16 03:32 2,048 --a------ C:WindowsSystem32tzres.dll

    2008-09-12 15:08 . 2007-11-08 11:04 11,967,524 --a------ C:WindowsSystem32korwbrkr.lex

    2008-09-12 12:39 . 2008-09-12 12:39 <KAT> d-------- C:Program FilesMSXML 4.0

    2008-09-12 12:36 . 2008-06-26 03:45 12,240,896 --a------ C:WindowsSystem32NlsLexicons0007.dll

    2008-09-12 12:35 . 2008-09-12 12:35 <KAT> d-------- C:Program FilesuTorrent

    2008-09-12 12:33 . 2008-04-26 10:08 1,314,816 --a------ C:WindowsSystem32quartz.dll

    2008-09-12 12:12 . 2008-09-12 12:12 <KAT> d-------- C:UsersOscarOption

    2008-09-12 12:05 . 2008-09-12 12:05 0 --a------ C:WindowsAcerStore.TAG

    2008-09-12 12:02 . 2008-09-12 12:02 <KAT> d-------- C:Program FilesAcer Inc

    2008-09-12 12:02 . 2008-09-12 12:02 92 --a------ C:WindowsGridV.UNI

    2008-09-12 11:59 . 2008-09-15 17:46 <KAT> d-------- C:Program FilesAcer Arcade Deluxe

    2008-09-12 11:55 . 2008-09-12 11:55 <KAT> d-------- C:UsersAll UserseSobi

    2008-09-12 11:55 . 2008-09-12 11:55 <KAT> d-------- C:ProgramDataeSobi

    2008-09-12 11:55 . 2008-10-10 08:58 <KAT> d-------- C:Program FileseSobi

    2008-09-12 11:54 . 2008-02-25 16:28 238,080 --a------ C:WindowsSystem32ITEIO_64.dll

    2008-09-12 11:54 . 2008-02-25 16:29 14,544 --a------ C:WindowsSystem32driversTVicPort.sys

    2008-09-12 11:54 . 2008-02-25 16:29 6,080 --a------ C:WindowsSystem32driverszntport.sys

    2008-09-12 11:53 . 2008-10-11 18:55 0 --a------ C:WindowsSystem32LogConfigTemp.xml

    2008-09-12 11:52 . 2008-09-12 11:52 <KAT> d-------- C:UsersAll UsersYahoo! Companion

    2008-09-12 11:52 . 2008-09-12 11:52 <KAT> d-------- C:ProgramDataYahoo! Companion

    2008-09-12 11:52 . 2008-04-30 16:00 204,800 --a------ C:WindowsSystem32SysHook.dll

    2008-09-12 11:50 . 2008-09-12 11:50 <KAT> d-------- C:Program FilesLaunch Manager

    2008-09-12 11:50 . 2008-09-12 11:50 83 --a------ C:WindowsLManager.UNI

    2008-09-12 11:49 . 2008-09-12 11:49 <KAT> d-------- C:Program FilesSuYin

    2008-09-12 11:49 . 2007-03-29 16:48 626,688 --a------ C:WindowsImage.dll

    2008-09-12 11:49 . 2008-04-25 12:09 506,368 --a------ C:WindowsAcer Crystal Eye webcam.EXE

    2008-09-12 11:49 . 2007-04-20 06:30 222,382 --a------ C:WindowsAcer Crystal Eye webcam.ico

    2008-09-12 11:49 . 2007-10-23 10:56 200,704 --a------ C:WindowsPLFSetI.exe

    2008-09-12 11:49 . 2008-04-22 13:21 9,216 --a------ C:Windowsusbvideo_reg.exe

    2008-09-12 11:49 . 2008-02-25 11:13 4,838 --a------ C:WindowsSuyin.reg

    2008-09-12 11:49 . 2008-09-12 11:49 125 --a------ C:WindowsxUninstall.bat

    2008-09-12 11:49 . 2007-10-29 13:35 36 --a------ C:WindowsPidList.ini

    2008-09-12 11:48 . 2008-09-12 11:48 <KAT> d-------- C:WindowsSystem32RTCOM

    2008-09-12 11:48 . 2008-09-12 11:48 <KAT> d-------- C:WindowsJMCR_DIR

    2008-09-12 11:48 . 2008-03-14 03:48 290,816 --a------ C:WindowsRTKVADDA.EXE

    2008-09-12 11:48 . 2008-04-12 03:55 84,240 --a------ C:WindowsSystem32driversjmcr.sys

    2008-09-12 11:48 . 2007-10-26 19:26 15,086 --a------ C:WindowsSystem32jmcr_xd.ico

    2008-09-12 11:48 . 2007-10-26 18:55 15,086 --a------ C:WindowsSystem32jmcr_ms.ico

    2008-09-12 11:48 . 2007-10-26 17:58 15,086 --a------ C:WindowsSystem32jmcr_mmc.ico

    2008-09-12 11:48 . 2007-11-15 01:18 553 --a------ C:WindowsUSetup.iss

    2008-09-12 11:47 . 2008-09-12 11:47 <KAT> d-------- C:Program FilesRealtek

    2008-09-12 11:46 . 2008-09-12 11:46 <KAT> d-------- C:CLSetup

    2008-09-12 11:46 . 2008-09-12 11:46 20 --a------ C:Medion.ini

    2008-09-12 11:40 . 2008-09-12 12:06 <KAT> d-------- C:UsersAll UsersNVIDIA

    2008-09-12 11:40 . 2008-09-12 12:06 <KAT> d-------- C:ProgramDataNVIDIA

    2008-09-12 11:39 . 2008-09-12 11:39 <KAT> dr------- C:UsersOscarSearches

    2008-09-12 11:39 . 2008-09-12 16:18 <KAT> dr------- C:UsersOscarContacts

    2008-09-12 11:39 . 2008-09-14 18:47 <KAT> d--hs---- C:$RECYCLE.BIN

    2008-09-12 11:38 . 2008-09-17 20:41 <KAT> dr------- C:UsersOscarSaved Games

    Tack igen!

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    HJT-log:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 10:36:12, on 2008-10-12

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32Dwm.exe

    C:Windowssystem32taskeng.exe

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Windowssystem32wbemunsecapp.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe

    C:Windowssystem32conime.exe

    C:WindowsExplorer.exe

    C:Program FilesPanda Antivirus 2008Apvxdwin.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesInternet Explorerieuser.exe

    C:Program FilesInternet Exploreriexplore.exe

    C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesAcerAcer VCMVC.exe

    C:Windowssystem32SearchFilterHost.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe

    O4 - HKLM..Run: [PLFSetI] C:WindowsPLFSetI.exe

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 8648 bytes

    Mvh oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej,

    skickar två inlägg då de båda loggarna innehåller för många tecken.

    Combofix:

    ComboFix 08-10-11.01 - Oscar 2008-10-11 22:50:21.1 - NTFSx86

    Microsoft® Windows Vista Home Premium  6.0.6001.1.1252.1.1053.18.1974 [GMT 2:00]

    Running from: C:UsersOscarDesktopComboFix.exe

    * Created a new restore point

    ((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2008-10-11 16:52 84 ----a-w C:Program Filesqtsh.txt

    2008-10-10 06:58 --------- d--h--w C:Program FilesInstallShield Installation Information

    2008-10-10 06:57 --------- d-----w C:Program FilesAcer GameZone

    2008-09-15 15:44 --------- d-----w C:ProgramDataCyberLink

    2008-09-14 08:37 --------- d-----w C:Program FilesVistaCodecPack

    2008-09-14 08:36 --------- d-----w C:ProgramDataVistaCodecs

    2008-09-13 01:18 28,728 ----a-w C:Windowssystem32driversmsahci.sys

    2008-09-13 01:18 21,560 ----a-w C:Windowssystem32driversatapi.sys

    2008-09-12 13:36 --------- d-----w C:Program FilesMicrosoft Works

    2008-09-12 13:12 --------- d-----w C:Program FilesWindows Mail

    2008-09-12 10:49 --------- d-----w C:ProgramDataMicrosoft Help

    2008-09-12 10:05 --------- d-----w C:ProgramDataMcAfee

    2008-09-12 10:05 --------- d-----w C:Program FilesAcer

    2008-09-12 09:51 --------- d-----w C:Program FilesYahoo!

    2008-09-12 09:47 319,456 ----a-w C:WindowsDIFxAPI.dll

    2008-09-12 09:47 315,392 ----a-w C:WindowsHideWin.exe

    2008-09-12 09:44 --------- d-----w C:ProgramDataSiteAdvisor

    2008-09-12 09:35 --------- d-sh--w C:ProgramDataStart-meny

    2008-09-12 09:35 --------- d-sh--w C:ProgramDataSkrivbord

    2008-09-12 09:35 --------- d-sh--w C:ProgramDataMallar

    2008-09-12 09:35 --------- d-sh--w C:ProgramDataFavoriter

    2008-09-12 09:35 --------- d-sh--w C:ProgramDataDokument

    2008-09-12 09:35 --------- d-sh--w C:Program FilesDelade filer

    2008-08-02 03:26 36,864 ----a-w C:WindowsSystem32cdd.dll

    2008-07-31 03:32 460,288 ----a-w C:WindowsAppPatchAcSpecfc.dll

    2008-07-31 03:32 28,160 ----a-w C:WindowsSystem32Apphlpdm.dll

    2008-07-31 03:32 2,154,496 ----a-w C:WindowsAppPatchAcGenral.dll

    2008-07-31 03:32 173,056 ----a-w C:WindowsAppPatchAcXtrnal.dll

    2008-07-31 01:13 4,240,384 ----a-w C:WindowsSystem32GameUXLegacyGDFs.dll

    2008-01-21 02:43 174 --sha-w C:Program Filesdesktop.ini

    .

    (((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersegisPSDP]

    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

    [HKEY_CLASSES_ROOTCLSID{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

    2008-03-04 23:38 121392 --a------ C:Program FilesAcerEmpowering TechnologyeDataSecurityx86PSDProtect.dll

    [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

    "MsnMsgr"="C:Program FilesWindows LiveMessengerMsnMsgr.Exe" [2007-10-18 5724184]

    "DAEMON Tools Lite"="C:Program FilesDAEMON Tools Litedaemon.exe" [2008-08-08 490952]

    "swg"="C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe" [2008-09-14 171448]

    "WMPNSCFG"="C:Program FilesWindows Media PlayerWMPNSCFG.exe" [2008-01-21 202240]

    "uTorrent"="C:Program FilesuTorrentuTorrent.exe" [2008-10-08 270128]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

    "SynTPEnh"="C:Program FilesSynapticsSynTPSynTPEnh.exe" [2008-02-22 1037608]

    "Adobe Reader Speed Launcher"="c:Program FilesAdobeReader 8.0ReaderReader_sl.exe" [2007-03-08 40048]

    "NvCplDaemon"="C:Windowssystem32NvCpl.dll" [2008-04-03 13535776]

    "NvMediaCenter"="C:Windowssystem32NvMcTray.dll" [2008-04-03 92704]

    "LManager"="C:PROGRA~1LAUNCH~1LManager.exe" [2008-04-01 793096]

    "eAudio"="C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe" [2008-03-07 544768]

    "eDataSecurity Loader"="C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe" [2008-03-04 526896]

    "ePower_DMC"="C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe" [2008-04-30 397312]

    "APVXDWIN"="C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" [2007-10-04 455984]

    "SunJavaUpdateSched"="C:Program FilesJavajre1.6.0_07binjusched.exe" [2008-06-10 144784]

    "WarReg_PopUp"="C:Program FilesAcerWR_PopUpWarReg_PopUp.exe" [2008-01-29 303104]

    "PLFSetI"="C:WindowsPLFSetI.exe" [2007-10-23 200704]

    "RtHDVCpl"="RtHDVCpl.exe" [2008-04-25 C:WindowsRtHDVCpl.exe]

    "Skytel"="Skytel.exe" [2007-11-21 C:WindowsSkyTel.exe]

    C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup

    Acer VCM.lnk - C:Program FilesAcerAcer VCMAcerVCM.exe [2008-09-12 1216512]

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]

    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyavldr]

    2007-02-15 19:02 50736 C:WindowsSystem32avldr.dll

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]

    "msacm.divxa32"= divxa32.acm

    [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalPskSvcRetail]

    @="Service"

    [HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBkupTray]

    --a------ 2008-04-06 22:42 34040 C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe

    [HKLM~servicessharedaccessparametersfirewallpolicyDomainProfileAuthorizedApplicationsList]

    "C:Program FilesFlashFXPFlashFXP.exe"= C:Program FilesFlashFXPFlashFXP.exe:*:Enabled:FlashFXP v3

    [HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]

    "{A215901A-51B1-4665-BA62-23DA081A624E}"= UDP:C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe

    "{CDD4D48D-02D1-41B7-B7F0-C8A0DE41A02C}"= UDP:C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe

    "{5570B819-9047-4F7D-AD41-EB39B072550A}"= TCP:C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe

    "{0DC5CBE2-0F88-4983-8265-8081B1BDC877}"= TCP:C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe

    "{10D2D61F-0799-4BDB-B88E-0AF97ED2A52F}"= UDP:C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe

    "{F658716A-E3BB-46E9-825D-BBF74177B3DD}"= TCP:C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe

    "{398233E2-5388-4CFD-897E-48B852FE7EB0}"= c:Program FilesCyberlinkPowerDirectorPDR.EXE:CyberLink PowerDirector

    "{72D2556D-FCD1-4723-A05D-660DDD2BD85D}"= C:Program FilesAcerAcer VCMVC.exe:Acer VCM

    "{614194BE-186C-4788-B433-84D170115FB2}"= C:Program FilesAcer Arcade DeluxeAcer Arcade DeluxeAcer Arcade Deluxe.exe:_this_program_will_be_deleted

    "{1D731B58-17E7-4F8B-89EA-3AD4DEAE6450}"= C:Program FilesAcer Arcade DeluxeHomeMediaHomeMedia.exe:Acer HomeMedia

    "{662456CB-37D0-457C-B57F-4A339AEB4C25}"= UDP:C:Program FilesuTorrentuTorrent.exe:µTorrent (TCP-In)

    "{2F45CF1D-95B9-4131-9163-F6BFD96702DE}"= TCP:C:Program FilesuTorrentuTorrent.exe:µTorrent (UDP-In)

    "{8B7D4F9F-6E32-4C9E-B2B3-23EA8D6657A0}"= C:Program FilesWindows LiveMessengerlivecall.exe:Windows Live Messenger (Phone)

    "TCP Query User{A9272C38-6B5F-4B4E-A078-971682AF2ADC}C:program filesutorrentutorrent.exe"= UDP:C:program filesutorrentutorrent.exe:µTorrent

    "UDP Query User{22E79620-AFFC-4A64-ABA4-FEAE2F9E1C0A}C:program filesutorrentutorrent.exe"= TCP:C:program filesutorrentutorrent.exe:µTorrent

    "{4CB61E6B-D6A7-479E-970A-7F8F9A86A9F1}"= UDP:C:Program FilesAcer Arcade DeluxeAcer Arcade DeluxeAcer Arcade Deluxe.exe:_this_program_will_be_deleted

    "TCP Query User{8D13F410-8DB1-420D-9F89-5EDDEC1EAB0D}C:program filesjavajre1.6.0_07binjavaw.exe"= UDP:C:program filesjavajre1.6.0_07binjavaw.exe:Java Platform SE binary

    "UDP Query User{B50B64EC-FAFD-4419-A830-D5846FD7F7C5}C:program filesjavajre1.6.0_07binjavaw.exe"= TCP:C:program filesjavajre1.6.0_07binjavaw.exe:Java Platform SE binary

    "{51F761AD-F0F7-4D4F-A6DF-485F1B052ACB}"= UDP:C:Program FilesReClockConfig.exe:Configure ReClock

    "{9BE143BC-B396-4DCC-9992-A229859C0949}"= TCP:C:Program FilesReClockConfig.exe:Configure ReClock

    "TCP Query User{CD4FB210-0862-43DB-8D28-7959CB4F8A25}C:installerade spelempires2.exe"= UDP:C:installerade spelempires2.exe:Age of Empires II

    "UDP Query User{BBF2F156-3A1B-4586-B3A5-C0983ACE591A}C:installerade spelempires2.exe"= TCP:C:installerade spelempires2.exe:Age of Empires II

    "TCP Query User{0FCE1DF2-3764-460B-B8E7-BE736B515E5B}C:windowssystem32dplaysvr.exe"= UDP:C:windowssystem32dplaysvr.exe:Hjälpprogram för Microsoft DirectPlay

    "UDP Query User{B617AD64-75C8-45EB-A93A-98A29FA265EB}C:windowssystem32dplaysvr.exe"= TCP:C:windowssystem32dplaysvr.exe:Hjälpprogram för Microsoft DirectPlay

    "{AB8FDE28-2BB5-4349-A373-0FC7F5009998}"= UDP:C:Installerade spelciv4Colonization.exe:Sid Meier's Civilization IV Colonization

    "{D8996808-ED49-475A-9582-0CF5A1D5F0C5}"= TCP:C:Installerade spelciv4Colonization.exe:Sid Meier's Civilization IV Colonization

    "TCP Query User{1A414370-856A-42AB-A3D7-980AF4EF3D60}C:program filesmircmirc.exe"= UDP:C:program filesmircmirc.exe:mIRC

    "UDP Query User{46FA3D1B-82BC-4654-AFBC-17C6B3CD9FA0}C:program filesmircmirc.exe"= TCP:C:program filesmircmirc.exe:mIRC

    [HKLM~servicessharedaccessparametersfirewallpolicyStandardProfileAuthorizedApplicationsList]

    "C:Program FilesFlashFXPFlashFXP.exe"= C:Program FilesFlashFXPFlashFXP.exe:*:Enabled:FlashFXP v3

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSfsu.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSfsu.exe:*:Enabled:eDSfsu

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx86encryption.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx86encryption.exe:*:Enabled:encryption

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx86decryption.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx86decryption.exe:*:Enabled:decryption

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSMgr.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSMgr.exe:*:Enabled:eDSMgr

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStbmngr.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStbmngr.exe:*:Enabled:eDStbmngr

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDSfsu.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDSfsu.exe:*:Enabled:eDSfsu

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx64encryption.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx64encryption.exe:*:Enabled:encryption

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx64decryption.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx64decryption.exe:*:Enabled:decryption

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDSMgr.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDSMgr.exe:*:Enabled:eDSMgr

    "C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDStbmngr.exe"= C:Program FilesAcerEmpowering TechnologyeDataSecurityx64eDStbmngr.exe:*:Enabled:eDStbmngr

    R0 pavboot;pavboot;C:Windowssystem32driverspavboot.sys [2008-06-19 28544]

    R1 ShldDrv;Panda File Shield Driver;C:Windowssystem32DRIVERSShlDrv51.sys [2007-05-23 38968]

    R2 AmFSM;AmFSM;C:Windowssystem32DRIVERSamm8660.sys [2007-09-28 46648]

    R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe [2008-03-03 16384]

    R2 ETService;Empowering Technology Service;C:Program FilesAcerEmpowering TechnologyServiceETService.exe [2008-03-21 24576]

    R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe [2008-04-06 50424]

    R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe [2008-04-04 131072]

    R2 PavProc;Panda Process Protection Driver;C:Windowssystem32DRIVERSPavProc.sys [2007-07-12 178872]

    R2 PskSvcRetail;Panda PSK service;C:Program FilesPanda Antivirus 2008PskSvc.exe [2007-03-21 27696]

    R2 RS_Service;Raw Socket Service;C:Program FilesAcerAcer VCMRS_Service.exe [2008-01-10 233472]

    R3 NETw5v32;Kortdrivrutin för Windows Vista 32-bitars för Intel® Wireless WiFi Link;C:Windowssystem32DRIVERSNETw5v32.sys [2008-04-28 3658752]

    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:Windowssystem32driversnvhda32v.sys [2008-04-03 43552]

    R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:Windowssystem32DRIVERSyk60x86.sys [2008-02-21 299008]

    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:Windowssystem32DRIVERSb57nd60x.sys [2008-01-21 179712]

    S3 JMCR;JMCR;C:Windowssystem32DRIVERSjmcr.sys [2008-04-12 84240]

    S4 ErrDev;Microsoft Hardware Error Device Driver;C:Windowssystem32driverserrdev.sys [2008-01-21 6656]

    S4 MegaSR;MegaSR;C:Windowssystem32driversmegasr.sys [2008-01-21 386616]

    *Newly Created Service* - PROCEXP90

    .

    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-eRecoveryService - (no file)

    .

    ------- Supplementary Scan -------

    .

    R0 -: HKCU-Main,Start Page = hxxp://www.google.se/

    R0 -: HKLM-Main,Start Page = hxxp://sv.intl.acer.yahoo.com

    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2008-10-11 22:53:45

    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    Completion time: 2008-10-11 22:54:29

    ComboFix-quarantined-files.txt  2008-10-11 20:54:19

    Pre-Run: 79 756 001 280 byte ledigt

    Post-Run: 79,515,049,984 byte ledigt

    293 --- E O F --- 2008-10-07 16:00:14

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej,

    => McAfee Network Agent <= trodde jag var avinstallerat och borttaget. :)

    Vad gäller Avenger följde jag instruktioner exakt och kopierade in:

    Files to delete:

    C:Windowsupdater.com

    i textrutan, inget annat. Jag körde execute och fick startat om datorn enl. instruktion. Så långt allt väl, jag fick dock inte upp någon logga med avenger (C:avenger.txt). Den finns inte heller om jag söker efter filen. Bifogar iaf en ny HJT-logga återigen.

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 19:04:51, on 2008-10-11

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32Dwm.exe

    C:Windowssystem32taskeng.exe

    C:WindowsExplorer.EXE

    C:Windowssystem32conime.exe

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:WindowsPLFSetI.exe

    C:Program FilesDAEMON Tools Litedaemon.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Windowssystem32wbemunsecapp.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesInternet Explorerieuser.exe

    C:Program FilesInternet Exploreriexplore.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe

    C:Windowssystem32NOTEPAD.EXE

    C:Windowssystem32SearchFilterHost.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://sv.intl.acer.yahoo.com

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [Windows Updater] updater.com

    O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe

    O4 - HKLM..Run: [PLFSetI] C:WindowsPLFSetI.exe

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 8880 bytes

    Tack igen, Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej igen,

    här kommer Hjt-loggan:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 08:26:14, on 2008-10-11

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32taskeng.exe

    C:Windowssystem32Dwm.exe

    C:WindowsExplorer.EXE

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:Program FilesAdobeReader 8.0Readerreader_sl.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:WindowsPLFSetI.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Windowssystem32wbemunsecapp.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesAcerAcer VCMVC.exe

    C:Windowssystem32SearchFilterHost.exe

    C:Program FilesInternet Explorerieuser.exe

    C:Windowssystem32conime.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://sv.intl.acer.yahoo.com

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [Windows Updater] updater.com

    O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe

    O4 - HKLM..Run: [PLFSetI] C:WindowsPLFSetI.exe

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKCU..Run: [sidebar] C:Program Fileswindows sidebarsidebar.exe /autoRun

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 8995 bytes

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej,

    jag har från början helt stängt/inaktiverat alla funktioner av Windows defender. Den här gången inaktiverade jag även windows firewall. Trots detta blockeras Malwarebytes' Anti-Malware att starta upp och göra sista cleanen av de tre trojanerna efter omstart utav Windows. Citat: "Windows har blockerat ett eller flera program från att starta automatiskt." (Windows syftar här på Malwarebytes). Jag väljer då att tillåta/köra programmet via den lilla ikonen med text som dyker upp i nedre, högra hörnet av skärmen. Ändå finns virusen kvar vid nästa scan.

    Jag har kört fast här och vet inte riktigt hur jag skall gå tillväga. Tycker mig ha följt Era instruktioner punktvis exakt.

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Nya tag!  :)

    här kommer Malwarebytes' Anti-Malware log:

    Malwarebytes' Anti-Malware 1.28

    Databasversion: 1248

    Windows 6.0.6001 Service Pack 1

    2008-10-10 13:43:18

    mbam-log-2008-10-10 (13-43-18).txt

    Skanningstyp: Snabb skanning

    Antal skannade objekt: 40283

    Förfluten tid: 1 minute(s), 43 second(s)

    Infekterade minnesprocesser: 0

    Infekterade minnesmoduler: 0

    Infekterade registernycklar: 0

    Infekterade registervärden: 0

    Infekterade registerdataposter: 0

    Infekterade mappar: 0

    Infekterade filer: 3

    Infekterade minnesprocesser:

    (Inga illasinnade poster hittades)

    Infekterade minnesmoduler:

    (Inga illasinnade poster hittades)

    Infekterade registernycklar:

    (Inga illasinnade poster hittades)

    Infekterade registervärden:

    (Inga illasinnade poster hittades)

    Infekterade registerdataposter:

    (Inga illasinnade poster hittades)

    Infekterade mappar:

    (Inga illasinnade poster hittades)

    Infekterade filer:

    C:UsersDefaultMy DocumentsMy MusicMy Music.url (Trojan.Zlob) -> Delete on reboot.

    C:UsersDefaultMy DocumentsMy PicturesMy Pictures.url (Trojan.Zlob) -> Delete on reboot.

    C:UsersDefaultMy DocumentsMy VideosMy Video.url (Trojan.Zlob) -> Delete on reboot.

    Obs: dessa 3 filer finns fortfarande kvar om jag kör om snabb scan efter omstart. :(

    Här är den nya HJT-loggen:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 14:12:27, on 2008-10-10

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32taskeng.exe

    C:Windowssystem32Dwm.exe

    C:WindowsExplorer.EXE

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:Program FilesAdobeReader 8.0Readerreader_sl.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesDAEMON Tools Litedaemon.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Program FilesuTorrentuTorrent.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Windowssystem32wbemunsecapp.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesAcerAcer VCMVC.exe

    C:Windowssystem32SearchFilterHost.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://sv.intl.acer.yahoo.com

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [Windows Updater] updater.com

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKCU..Run: [sidebar] C:Program Fileswindows sidebarsidebar.exe /autoRun

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 8800 bytes

    Kommer tillbaks online först senare ikväll tyvärr, tack igen!

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    Hej igen!

    Tack så hemskt mycket för din tid, jag är oerhört tacksam! Här kommer loggan från msnfix och sedan Hijack.

    MSNFix 1.749 

    C:UsersOscarDesktopMSNFix

    Sokningen var klar pa 2008-10-09 - 23:52:33,87 By Oscar

    normalt lage   

       

    ************************ Kollar filer     

       

    ... C:Windowsupdater.com

    ... C:Windowssystem32ACER.exe

    ************************ Kollar mappar     

    Inga Mappar Funna

    ************************ Tar bort virus filer     

       

    .. OK ... C:UsersOscarAppDataLocalTempwinlogon.exe

    .. OK ... C:UsersOscarAppDataLocalTempservices.exe

    .. OK ... C:Windowssystem32cftmon.exe

    .. OK ... C:Windowsupdater.com 

    .. OK ... C:Windowssystem32ACER.exe 

    ************************ Rensar registret 

    ************************ Hostsclean

    Cleanhosts v 0.1.0.7  By Laurent

    -- Backup : C:Windowssystem32driversetchosts-20081010000854

    -- original size 0.74 Kb / 20 lines

    -- Start cleaning Hosts file ....

    -- final size 0.74 Kb / 20 lines

    -- entry Found : 0  /  Entry check : 310

    End .............................. 16.52 Secondes

    Resten av filerna tas bort efter omstart

    Inga Filer Funna

    ************************ Hostsclean

    Cleanhosts v 0.1.0.7  By Laurent

    -- Backup : C:Windowssystem32driversetchosts-20081010083745

    -- original size 0.74 Kb / 20 lines

    -- Start cleaning Hosts file ....

    -- final size 0.74 Kb / 20 lines

    -- entry Found : 0  /  Entry check : 310

    End .............................. 9.69 Secondes

    (Jag startade om datorn och avslutade rensningen).

    Nu kommer Hijack this loggen

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 08:47:18, on 2008-10-10

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32taskeng.exe

    C:Windowssystem32Dwm.exe

    C:WindowsExplorer.EXE

    C:Windowssystem32conime.exe

    C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesDAEMON Tools Litedaemon.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Windowssystem32wbemunsecapp.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesAcerAcer VCMVC.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Program FilesInternet Explorerieuser.exe

    C:Program FilesInternet Exploreriexplore.exe

    C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe

    C:Windowssystem32SearchFilterHost.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://sv.intl.acer.yahoo.com

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [Windows Updater] updater.com

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKCU..Run: [sidebar] C:Program Fileswindows sidebarsidebar.exe /autoRun

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 9053 bytes

    Förresten, angående din tidigare fråga om så är http://sv.intl.acer.yahoo.com inte min startsida, det är www.google.se som är det.. och jag har för mig att jag aldrig installerat yahoo toolbar.

    Tack!

    Mvh Oscar

    Hijackthis log - misstanke om youtube virus

    i Borttagning av virus och andra skadliga program

    Postad

    *********************************************

    2009-01-08:

    Tråden är nu låst.

    Tycker du att den är felaktigt låst, var god kontakta

    Malou

    *********************************************

    Hej,

    jag klantade till det och klickade på/installerade den falska flashplayern häromdagen. Mitt panda antivirus hittar ingenting men ändå säger windows att det har blockerat något program från att autostarta varje gång jag sätter igång datorn.

    Tänkte kopiera in min Hijackthis log. När loggen gjordes var windows defender inaktiverat och en CC regclean nyss gjord. Tack på förhand!

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 19:38:35, on 2008-10-09

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18000)

    Boot mode: Normal

    Running processes:

    C:Windowssystem32taskeng.exe

    C:Windowssystem32Dwm.exe

    C:WindowsExplorer.EXE

    C:Program FilesWindows DefenderMSASCui.exe

    C:Program FilesSynapticsSynTPSynTPEnh.exe

    C:WindowsSystem32rundll32.exe

    C:WindowsRtHDVCpl.exe

    C:Program FilesLaunch ManagerLManager.exe

    C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe

    C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe

    C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    C:Program FilesPanda Antivirus 2008ApVxdWin.exe

    C:Program FilesJavajre1.6.0_07binjusched.exe

    C:Program FilesWindows LiveMessengermsnmsgr.exe

    C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    C:Program FilesWindows Media Playerwmpnscfg.exe

    C:Program FilesuTorrentuTorrent.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:Program FilesAcerAcer VCMAcerVCM.exe

    C:Windowssystem32wbemunsecapp.exe

    C:Program FilesWindows Sidebarsidebar.exe

    C:UsersOscarAppDataLocalTempRtkBtMnt.exe

    C:Program FilesPanda Antivirus 2008WebProxy.exe

    C:Program FilesAcerAcer VCMVC.exe

    C:Program FilesAcerAcer VCMacp2HID.exe

    C:Program FilesSynapticsSynTPSynTPHelper.exe

    C:Windowssystem32conime.exe

    C:Program FilesInternet Explorerieuser.exe

    C:Program FilesInternet Exploreriexplore.exe

    C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe

    C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe

    C:Program FilesTrend MicroHijackThisoscar.exe

    R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.se/

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://sv.intl.acer.yahoo.com

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sv.intl.acer.yahoo.com

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =

    R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O1 - Hosts: ::1 localhost

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07binssv.dll

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll

    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:PROGRA~1FlashFXPIEFlash.dll

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll

    O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide

    O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

    O4 - HKLM..Run: [Adobe Reader Speed Launcher] "c:Program FilesAdobeReader 8.0ReaderReader_sl.exe"

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe

    O4 - HKLM..Run: [skytel] Skytel.exe

    O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

    O4 - HKLM..Run: [eAudio] "C:Program FilesAcerEmpowering TechnologyeAudioeAudio.exe"

    O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe

    O4 - HKLM..Run: [ePower_DMC] C:Program FilesAcerEmpowering TechnologyePowerePower_DMC.exe

    O4 - HKLM..Run: [APVXDWIN] "C:Program FilesPanda Antivirus 2008APVXDWIN.EXE" /s

    O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07binjusched.exe"

    O4 - HKLM..Run: [Windows Updater] updater.com

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [DAEMON Tools Lite] "C:Program FilesDAEMON Tools Litedaemon.exe" -autorun

    O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe

    O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe

    O4 - HKCU..Run: [uTorrent] "C:Program FilesuTorrentuTorrent.exe"

    O4 - HKCU..Run: [sidebar] C:Program Fileswindows sidebarsidebar.exe /autoRun

    O4 - HKUSS-1-5-19..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST')

    O4 - HKUSS-1-5-20..Run: [sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'NÄTVERKSTJÄNST')

    O4 - Global Startup: Acer VCM.lnk = ?

    O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:PROGRA~1JavaJRE16~1.0_0binssv.dll

    O13 - Gopher Prefix:

    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd...ows-i586-jc.cab

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:Windowssystem32agrsmsvc.exe

    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe (file missing)

    O23 - Service: MobilityService - Unknown owner - C:AcerMobility CenterMobilityService.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32nvvsvc.exe

    O23 - Service: Panda Software Controller - Panda Software International - C:Program FilesPanda Antivirus 2008PsCtrls.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:Program FilesPanda Antivirus 2008pavsrvx86.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:Program FilesPanda Antivirus 2008PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:Program FilesPanda Antivirus 2008PskSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe

    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:Program FilesAcerAcer VCMRS_Service.exe

    --

    End of file - 9338 bytes

    Mvh Oscar

×
×
  • Skapa nytt...