l_lefty

November 9, 2008

Hej

Min vän var tvungen att sticka med datorn igen så nu har jag den inte längre här. Men innan det gjorde jag som du sa, och med en uppdaterad anti-malwere scan och fix så försvann den där rutan.

Kalas!

Men jag ska kanske hälsa på honom snart och kommer då ta en titt på datorn då. Kanske jag kan lägga upp en HJT-log här då.

Men tusen tack Malou för din hjälp. Vet inte hur jag ska kunna tacka dig tillräckligt.

Ska fundera lite på det, så återkommer jag när jag kommit på ngt.

Ha det fint så länge!

Mvh, L

November 7, 2008

Hej igen,

Tror inte det är Symantec som flaggar för Trojan-Keylogger Win32 Fung. Det ser ut som ett windowsfönster och heter windows security alert.

Nu har jag uppdaterat Malwarebytes Anti-Malware och kört. Hittade två fel som jag tog bort. Sen körde jag en ny TM HJT och klistrar in den loggen nedan. Men först loggen från malwarebytes anti-malware:

Malwarebytes' Anti-Malware 1.30

Databasversion: 1371

Windows 5.1.2600 Service Pack 2

2008-11-07 17:25:20

mbam-log-2008-11-07 (17-25-20).txt

Skanningstyp: Snabb skanning

Antal skannade objekt: 70705

Förfluten tid: 8 minute(s), 51 second(s)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 0

Infekterade registervärden: 1

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 1

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

Infekterade registernycklar:

(Inga illasinnade poster hittades)

Infekterade registervärden:

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunasus32 (Rogue.PersonalDefender2009) -> Quarantined and deleted successfully.

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

C:Documents and SettingsMattias BergströmApplication DataGooglemupd1_2_12916358.exe (Rogue.PersonalDefender2009) -> Delete on reboot.

___________________________________________________________________________________

Å så HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:02:49, on 2008-11-07

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32Ati2evxx.exe

C:Program FilesCommon FilesSymantec SharedccSetMgr.exe

C:WINDOWSExplorer.EXE

C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe

C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe

C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe

C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe

C:WINDOWSsystem32spoolsv.exe

C:AcerEmpowering TechnologyePerformanceMemCheck.exe

C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe

c:Program FilesWIDCOMMBluetooth Softwarebinbtwdins.exe

C:WINDOWSeHomeehRecvr.exe

C:WINDOWSeHomeehSched.exe

C:Program FilesJavajre6binjqs.exe

C:Program FilesCommon FilesLightScribeLSSrvc.exe

C:Program FilesNorton AntiVirusnavapsvc.exe

C:Program FilesNorton AntiVirusIWPNPFMntor.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSsystem32wscntfy.exe

C:WINDOWSsystem32dllhost.exe

C:WINDOWSsystem32wbemwmiapsrv.exe

C:WINDOWSehomeehtray.exe

C:WINDOWSeHomeehmsas.exe

C:WINDOWSRTHDCPL.EXE

C:AcerEmpowering TechnologyeDataSecurityeDSloader.exe

C:AcerEmpowering TechnologyePowerePower_DMC.exe

C:Program FilesSynapticsSynTPSynTPEnh.exe

C:PROGRA~1LAUNCH~1LManager.exe

C:AcerEmpowering TechnologyeRecoveryeRAgent.exe

C:Program FilesCommon FilesSymantec SharedccApp.exe

C:WINDOWSVM305_STI.EXE

C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe

C:WINDOWSsystem32rundll32.exe

C:Program FilesATI TechnologiesATI.ACECLI.EXE

C:Program FilesQuickTimeqttask.exe

C:Program FilesJavajre6binjusched.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32ctfmon.exe

C:WINDOWSsystem32wbemunsecapp.exe

C:Program FilesMSN MessengerMsnMsgr.Exe

C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

C:AcerEmpowering TechnologyAcer.Empowering.Framework.Launcher.exe

C:Program FilesWIDCOMMBluetooth SoftwareBTTray.exe

C:Program FilesNikonPictureProjectNkbMonitor.exe

C:Program FilesATI TechnologiesATI.ACEcli.exe

C:WINDOWSsystem32wuauclt.exe

C:Program FilesCommon FilesSymantec SharedSecurity ConsoleNSCSRVCE.EXE

C:Program FilesMessengermsmsgs.exe

C:Program FilesTrend MicroHijackThislinus.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.hotmail.com/

R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sv.intl.acer.yahoo.com/

R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6binssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:Program FilesNorton AntiVirusNavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier3.1.807.1746swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesWindows Live Toolbarmsntb.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6binjp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:WINDOWSsystem32eDStoolbar.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:Program FilesNorton AntiVirusNavShExt.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesWindows Live Toolbarmsntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar3.dll

O4 - HKLM..Run: [ehTray] C:WINDOWSehomeehtray.exe

O4 - HKLM..Run: [AzMixerSel] C:Program FilesRealtekInstallShieldAzMixerSel.exe

O4 - HKLM..Run: [ntiMUI] C:Program FilesNewTech InfosystemsNTI CD & DVD-Maker 7ntiMUI.exe

O4 - HKLM..Run: [Acer ePresentation HPD] C:AcerEmpowering TechnologyePresentationePresentation.exe

O4 - HKLM..Run: [iMJPMIG8.1] "C:WINDOWSIMEimjp8_1IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM..Run: [MSPY2002] C:WINDOWSsystem32IMEPINTLGNTImScInst.exe /SYNC

O4 - HKLM..Run: [PHIME2002ASync] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /SYNC

O4 - HKLM..Run: [PHIME2002A] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /IMEName

O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM..Run: [skyTel] SkyTel.EXE

O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM..Run: [eDataSecurity Loader] C:AcerEmpowering TechnologyeDataSecurityeDSloader.exe 1

O4 - HKLM..Run: [ePower_DMC] C:AcerEmpowering TechnologyePowerePower_DMC.exe

O4 - HKLM..Run: [boot] C:AcerEmpowering TechnologyePowerBoot.exe

O4 - HKLM..Run: [synTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe

O4 - HKLM..Run: [LManager] C:PROGRA~1LAUNCH~1LManager.exe

O4 - HKLM..Run: [ATICCC] "C:Program FilesATI TechnologiesATI.ACECLIStart.exe"

O4 - HKLM..Run: [eRecoveryService] C:AcerEmpowering TechnologyeRecoveryeRAgent.exe

O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"

O4 - HKLM..Run: [bigDog305] C:WINDOWSVM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

O4 - HKLM..Run: [GrooveMonitor] "C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe"

O4 - HKLM..Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime

O4 - HKLM..Run: [symantec PIF AlertEng] "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"

O4 - HKLM..Run: [sunJavaUpdateSched] "C:Program FilesJavajre6binjusched.exe"

O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background

O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')

O4 - HKUSS-1-5-18..Run: [Picasa Media Detector] C:Program FilesPicasa2PicasaMediaDetector.exe (User 'SYSTEM')

O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')

O4 - Global Startup: Acer Empowering Technology.lnk = C:AcerEmpowering TechnologyAcer.Empowering.Framework.Launcher.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: NkbMonitor.exe.lnk = C:Program FilesNikonPictureProjectNkbMonitor.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe

O8 - Extra context menu item: &Windows Live Search - res://C:Program FilesWindows Live Toolbarmsntb.dll/search.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000

O8 - Extra context menu item: Skicka till &Bluetooth-enhet... - c:Program FilesWIDCOMMBluetooth Softwarebtsendto_ie_ctx.htm

O8 - Extra context menu item: Öppna på ny flik i bakgrunden - res://C:Program FilesWindows Live ToolbarComponentssv-semsntabres.dll.mui/229?8543bdd187e14a409a4bce25c896c274

O8 - Extra context menu item: Öppna på ny flik i förgrunden - res://C:Program FilesWindows Live ToolbarComponentssv-semsntabres.dll.mui/230?8543bdd187e14a409a4bce25c896c274

O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:Program FilesMicrosoft OfficeOffice12GrooveSystemServices.dll

O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:AcerEmpowering TechnologyePerformanceMemCheck.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:Program FilesWIDCOMMBluetooth Softwarebinbtwdins.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:Program FilesJavajre6binjqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:Program FilesNorton AntiVirusnavapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:Program FilesNorton AntiVirusIWPNPFMntor.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity ConsoleNSCSRVCE.EXE

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:Program FilesNorton AntiVirusSAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe

O23 - Service: SPBBCSvc - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe

--

End of file - 12731 bytes

November 7, 2008

Ja, det var ju lite dumt att det blev så, men men det är inga sura miner.

Jag gjorde som du sa och nedan är den nya varianten:

SmitFraudFix v2.373

Scan done at 15:03:44,68, 2008-11-07

Run from C:Documents and SettingsMattias BergstrmDesktopSmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

The filesystem type is FAT32

Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32Ati2evxx.exe

C:Program FilesCommon FilesSymantec SharedccSetMgr.exe

C:WINDOWSExplorer.EXE

C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe

C:Program FilesCommon FilesSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe

C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe

C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe

C:WINDOWSsystem32spoolsv.exe

C:AcerEmpowering TechnologyePerformanceMemCheck.exe

C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe

c:Program FilesWIDCOMMBluetooth Softwarebinbtwdins.exe

C:WINDOWSeHomeehRecvr.exe

C:WINDOWSeHomeehSched.exe

C:Program FilesJavajre6binjqs.exe

C:Program FilesCommon FilesLightScribeLSSrvc.exe

C:Program FilesNorton AntiVirusnavapsvc.exe

C:Program FilesNorton AntiVirusIWPNPFMntor.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSsystem32wscntfy.exe

C:WINDOWSsystem32dllhost.exe

C:WINDOWSsystem32wbemwmiapsrv.exe

C:WINDOWSehomeehtray.exe

C:WINDOWSRTHDCPL.EXE

C:WINDOWSeHomeehmsas.exe

C:AcerEmpowering TechnologyeDataSecurityeDSloader.exe

C:AcerEmpowering TechnologyePowerePower_DMC.exe

C:Program FilesSynapticsSynTPSynTPEnh.exe

C:PROGRA~1LAUNCH~1LManager.exe

C:AcerEmpowering TechnologyeRecoveryeRAgent.exe

C:Program FilesCommon FilesSymantec SharedccApp.exe

C:WINDOWSVM305_STI.EXE

C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe

C:WINDOWSsystem32rundll32.exe

C:Program FilesQuickTimeqttask.exe

C:Program FilesJavajre6binjusched.exe

C:WINDOWSsystem32ctfmon.exe

C:WINDOWSSystem32svchost.exe

C:Program FilesATI TechnologiesATI.ACECLI.EXE

C:Program FilesMSN MessengerMsnMsgr.Exe

C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

C:Documents and SettingsMattias BergströmApplication DataGooglemupd1_2_12916358.exe

C:AcerEmpowering TechnologyAcer.Empowering.Framework.Launcher.exe

C:WINDOWSsystem32wbemunsecapp.exe

C:Program FilesWIDCOMMBluetooth SoftwareBTTray.exe

C:Program FilesNikonPictureProjectNkbMonitor.exe

C:Program FilesATI TechnologiesATI.ACEcli.exe

C:WINDOWSsystem32wuauclt.exe

C:Program FilesCommon FilesSymantec SharedSecurity ConsoleNSCSRVCE.EXE

C:Program FilesMessengermsmsgs.exe

C:Documents and SettingsMattias BergströmDesktopSmitfraudFixPolicies.exe

C:WINDOWSsystem32cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSWeb

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsMattias Bergstrm

»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1MATTIA~1LOCALS~1Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsMattias BergstrmApplication Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1MATTIA~1FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch

!!!Attention, following keys are not inevitably infected!!!

o4Patch

Credits: Malware Analysis & Diagnostic

Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

!!!Attention, following keys are not inevitably infected!!!

IEDFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

!!!Attention, following keys are not inevitably infected!!!

VACFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

!!!Attention, following keys are not inevitably infected!!!

404Fix

Credits: Malware Analysis & Diagnostic

Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs

!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]

"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon

!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]

"Userinit"="C:WINDOWSsystem32userinit.exe,"

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5005G Wireless Network Adapter - Packet Scheduler Miniport

DNS Server Search Order: 192.168.1.1

HKLMSYSTEMCCSServicesTcpip..{E95BFD27-4B33-4642-97EA-536DEE4604EB}: DhcpNameServer=192.168.1.1

HKLMSYSTEMCS1ServicesTcpip..{E95BFD27-4B33-4642-97EA-536DEE4604EB}: DhcpNameServer=192.168.1.1

HKLMSYSTEMCS2ServicesTcpip..{E95BFD27-4B33-4642-97EA-536DEE4604EB}: DhcpNameServer=192.168.1.1

HKLMSYSTEMCCSServicesTcpipParameters: DhcpNameServer=192.168.1.1

HKLMSYSTEMCS1ServicesTcpipParameters: DhcpNameServer=192.168.1.1

HKLMSYSTEMCS2ServicesTcpipParameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

November 7, 2008

Och nu senaste TM HJT-loggen:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:48:15, on 2008-11-07