Något att bita i

StefanT · November 9, 2008

*********************************************

2009-01-08:

Tråden är nu låst.

Tycker du att den är felaktigt låst, var god kontakta

*********************************************

Hej.

Vet inte vad jag har för **** i datorn eller hur jag får bort det. Norton Internet Security 2006 kraschar efter halva scanningen. Hoppas ngn kan hjälpa mej.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:41:22, on 2008-11-09

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:WINDOWSsystem32csrss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32svchost.exe

C:ProgramDelade filerSymantec SharedccSetMgr.exe

C:ProgramDelade filerSymantec SharedccEvtMgr.exe

C:ProgramDelade filerSymantec SharedccProxy.exe

C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

C:ProgramDelade filerSymantec SharedSNDSrvc.exe

C:ProgramDelade filerSymantec SharedSPBBCSPBBCSvc.exe

C:ProgramDelade filerSymantec SharedCCPD-LCsymlcsvc.exe

C:WINDOWSsystem32LEXBCES.EXE

C:WINDOWSsystem32LEXPPS.EXE

C:WINDOWSsystem32spoolsv.exe

C:ProgramSymantecLiveUpdateALUSchedulerSvc.exe

C:WINDOWSSystem32svchost.exe

C:ProgramDellOpenManageClientIap.exe

C:ProgramMicrosoft SQL ServerMSSQL$SPCSBinnsqlservr.exe

C:ProgramNorton Internet SecurityNorton AntiVirusnavapsvc.exe

C:ProgramFightersconfigservice.exe

C:WINDOWSsystem32svchost.exe

C:ProgramFighterslicenseservice.exe

C:ProgramFightersupdateservice.exe

C:ProgramFightersScannerService.exe

C:WINDOWSsystem32wbemwmiprvse.exe

C:ProgramWindows Media PlayerWMPNetwk.exe

C:WINDOWSsystem32wbemwmiprvse.exe

C:WINDOWSSystem32alg.exe

C:WINDOWSExplorer.EXE

C:WINDOWSSystem32regsvr32.exe

C:ProgramMacrogamingSweetIMSweetIM.exe

C:ProgramJavajre1.6.0_05binjusched.exe

C:ProgramFightersspywarefighterSpywarefighterUser.exe

C:ProgramQuickTimeqttask.exe

C:ProgramInternet ExplorerIEXPLORE.EXE

C:ProgramWindows LiveMessengermsnmsgr.exe

C:WINDOWSsystem32LXSUPMON.EXE

C:WINDOWSservice.exe

C:WINDOWSsystem32igfxpers.exe

C:WINDOWSsystem32hkcmd.exe

C:ProgramCyberLinkPowerDVDDVDLauncher.exe

C:ProgramDelade filerSymantec SharedccApp.exe

C:WINDOWSsystem32ctfmon.exe

C:ProgramWindows Media PlayerWMPNSCFG.exe

C:ProgramGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

C:GarmingStart.exe

c:programfightersspywarefighterSPYWAREfighterTray.exe

C:ProgramDelade filerMicrosoft SharedWindows LiveWLLoginProxy.exe

C:ProgramDelade filerSymantec SharedSecurity ConsoleNSCSRVCE.EXE

C:ProgramInternet Exploreriexplore.exe

C:WINDOWSsystem32NOTEPAD.EXE

C:ProgramTrend MicroHijackThisCatha.exe

C:ProgramMessengermsmsgs.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://dellsearchedit.myway.com/samisc/del...ebar.jhtml?p=EB

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = https://upplandsbro.skola24.se/

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www1.euro.dell.com/content/default....;l=sv&s=gen

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:ProgramMyWaySASrchAsDedeSrcAs.dll (file missing)

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:ProgramMacrogamingSweetIMBarForIEtoolbar.dll

O2 - BHO: (no name) - {0005B3DD-A43D-432D-915B-1933D975E360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {000B187F-D25F-4BEF-8E7F-220666FB7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {000B67BA-A43D-432D-915B-1933D975E360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {001630FE-D25F-4BEF-8E7F-220666FB7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {0016CF75-A43D-432D-915B-1933D975E360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {002C61FD-D25F-4BEF-8E7F-220666FB7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {002D9EEA-A43D-432D-915B-1933D975E360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {0058C3FB-D25F-4BEF-8E7F-220666FB7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {005B3DD4-A43D-432D-915B-1933D975E360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {00b187f6-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {00b67ba9-a43d-432d-915b-1933d975e360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {01630fed-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {016cf752-a43d-432d-915b-1933d975e360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {02c61fdb-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {02d9eea5-a43d-432d-915b-1933d975e360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {058c3fb7-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {05b3dd4b-a43d-432d-915b-1933d975e360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: (no name) - {0b187f6f-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {0b67ba96-a43d-432d-915b-1933d975e360} - C:WINDOWSsystem32jhrxxbid.dll

O2 - BHO: mxlivemedia browser enhancer - {15f1de2b-e547-f1d4-f82d-d5bfd4ee2e0e} - C:WINDOWSsystem32tuyrgsacxlt.dll

O2 - BHO: (no name) - {1630fede-d25f-4bef-8e7f-220666fb7830} - C:WINDOWSsystem32qalrjiqr.dll

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:ProgramMyWaySASrchAsDedeSrcAs.dll (file missing)

O2 - BHO: (no name) - {75ABCF92-9764-4DFA-A83F-5142C3905052} - C:WINDOWSsystem32ssqPjIxy.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:ProgramJavajre1.6.0_05binssv.dll

O2 - BHO: (no name) - {79117664-7a50-429c-b3af-6cdf9e1886ce} - C:WINDOWSsystem32qoMeEULB.dll (file missing)

O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:ProgramDelade filerMicrosoft SharedWindows LiveWindowsLiveLogin.dll

O2 - BHO: {329c2ac8-6dfe-7d19-9c64-9ad4821d18c9} - {9c81d128-4da9-46c9-91d7-efd68ca2c923} - C:WINDOWSsystem32bjxykt.dll

O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:ProgramDelade filerSymantec SharedAdBlockingNISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:ProgramNorton Internet SecurityNorton AntiVirusNavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:programgooglegoogletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:ProgramGoogleGoogleToolbarNotifier3.1.807.1746swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:ProgramWindows Live Toolbarmsntb.dll

O2 - BHO: (no name) - {DEB85B3B-8AFC-4567-BC39-46DA44C17C61} - C:WINDOWSsystem32bYomLefg.dll

O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:ProgramDelade filerSymantec SharedAdBlockingNISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:ProgramNorton Internet SecurityNorton AntiVirusNavShExt.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:ProgramMacrogamingSweetIMBarForIEtoolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:programgooglegoogletoolbar1.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:ProgramWinamp Toolbarwinamptb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:ProgramWindows Live Toolbarmsntb.dll

O4 - HKLM..Run: [symantec PIF AlertEng] "C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"

O4 - HKLM..Run: [C:WINDOWSsystem32kdihl.exe] C:WINDOWSsystem32kdihl.exe

O4 - HKLM..Run: [lsmnvboumq] C:WINDOWSSystem32regsvr32.exe /s "C:WINDOWSsystem32tuyrgsacxlt.dll"

O4 - HKLM..Run: [Windows Updater] updater.com

O4 - HKLM..Run: [WinampAgent] C:ProgramWinampwianmpa.exe

O4 - HKLM..Run: [sweetIM] C:ProgramMacrogamingSweetIMSweetIM.exe

O4 - HKLM..Run: [sunJavaUpdateSched] "C:ProgramJavajre1.6.0_05binjusched.exe"

O4 - HKLM..Run: [spywarefighterguard] C:ProgramFightersspywarefighterSpywarefighterUser.exe

O4 - HKLM..Run: [QuickTime Task] "C:ProgramQuickTimeqttask.exe" -atboottime

O4 - HKLM..Run: [Messenger Service] service.exe

O4 - HKLM..Run: [LXSUPMON] C:WINDOWSsystem32LXSUPMON.EXE RUN

O4 - HKLM..Run: [lphc7d9j0egfn] C:WINDOWSsystem32lphc7d9j0egfn.exe

O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k

O4 - HKLM..Run: [igfxtray] C:WINDOWSsystem32igfxtray.exe

O4 - HKLM..Run: [igfxpers] C:WINDOWSsystem32igfxpers.exe

O4 - HKLM..Run: [igfxhkcmd] C:WINDOWSsystem32hkcmd.exe

O4 - HKLM..Run: [DVDLauncher] "C:ProgramCyberLinkPowerDVDDVDLauncher.exe"

O4 - HKLM..Run: [ccApp] "C:ProgramDelade filerSymantec SharedccApp.exe"

O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:ProgramAdobeReader 8.0ReaderReader_sl.exe"

O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [WMPNSCFG] C:ProgramWindows Media PlayerWMPNSCFG.exe

O4 - HKCU..Run: [swg] C:ProgramGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

O4 - HKCU..Run: [MsnMsgr] "C:ProgramWindows LiveMessengermsnmsgr.exe" /background

O4 - HKCU..Run: [gStart] C:GarmingStart.exe

O4 - HKCU..Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:ProgramDelade filerAheadLibNMBgMonitor.exe"

O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')

O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')

O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

O8 - Extra context menu item: &Winamp Toolbar Search - C:Documents and SettingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html

O8 - Extra context menu item: &Windows Live Search - res://C:ProgramWindows Live Toolbarmsntb.dll/search.htm

O8 - Extra context menu item: Add to AMV Converter... - C:ProgramMP3 Player Utilities 4.15AMVConvertergrab.html

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:ProgramMICROS~2OFFICE11EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:ProgramMP3 Player Utilities 4.15MediaManagergrab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgramJavajre1.6.0_05binssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgramJavajre1.6.0_05binssv.dll

O9 - Extra button: Blogga detta - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:ProgramWindows LiveWriterWriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blogga detta i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:ProgramWindows LiveWriterWriterBrowserExtension.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:ProgramMICROS~2OFFICE11REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgramMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgramMessengermsmsgs.exe

O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O17 - HKLMSystemCCSServicesTcpip..{7EF5BB9B-24D6-4AA6-A938-6D497EBDCA75}: NameServer = 85.255.112.74;85.255.112.191

O17 - HKLMSystemCCSServicesTcpip..{F5198715-F56E-4D20-A279-1A0FA879F9D2}: NameServer = 85.255.112.74;85.255.112.191

O20 - AppInit_DLLs: bjxykt.dll

O20 - Winlogon Notify: qomeeulb - qoMeEULB.dll (file missing)

O20 - Winlogon Notify: ssqPjIxy - C:WINDOWSSYSTEM32ssqPjIxy.dll

O20 - Winlogon Notify: wvukjbcb - wvUkJbcB.dll (file missing)

O23 - Service: Automatisk LiveUpdate-schemaläggare - Symantec Corporation - C:ProgramSymantecLiveUpdateALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:ProgramNorton Internet SecurityccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:ProgramNorton Internet SecuritycomHost.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:ProgramGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

O23 - Service: Iap - Dell Inc - C:ProgramDellOpenManageClientIap.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE

O23 - Service: LiveUpdate - Symantec Corporation - C:ProgramSymantecLIVEUP~1LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec Corporation - C:ProgramNorton Internet SecurityNorton AntiVirusnavapsvc.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:ProgramIntelNCSSyncNetSvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSecurity ConsoleNSCSRVCE.EXE

O23 - Service: PTK License-FIGHTERS-4665699 (ptk license-fighters-4665699) - SPAMfighter - C:ProgramFighterslicenseservice.exe

O23 - Service: PTK Live Update-FIGHTERS-4665699 (ptk live update-fighters-4665699) - SPAMfighter - C:ProgramFightersupdateservice.exe

O23 - Service: PTK Scanner-FIGHTERS-4665699 (ptk scanner-fighters-4665699) - SPAMfighter - C:ProgramFightersScannerService.exe

O23 - Service: PTK SharedAccess-FIGHTERS-4665699 (ptk sharedaccess-fighters-4665699) - SPAMfighter - C:ProgramFightersconfigservice.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:ProgramNorton Internet SecurityNorton AntiVirusSAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSPBBCSPBBCSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:ProgramDelade filerSymantec SharedCCPD-LCsymlcsvc.exe

O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:ProgramDelade filerSymantec SharedSupport Controlsssrc.exe

O24 - Desktop Component 0: (no name) - http://www.microsoft.com/windows/plus/imag...ish_150x106.jpg

--

End of file - 16491 bytes

November 9, 2008

Hej StefanT!

Vad jag kan tyda av din TM HJT-logga så har du råkat ut för en riktigt rejäl Vundoinfektion.

Skriv ut nedanstående eller kopiera det till ett textdokument och spara det till skrivbordet:

Läs/Följ instruktionerna noga:

Hämta hem Malwarebytes Anti-Malware:

http://www.besttechie.net/tools/mbam-setup.exe

1: Spara installationsfilen till skrivbordet

2: För att påbörja installationen dubbelklicka på mbam-setup.exe

3: Bocka för nedanstående

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

4: Klicka på Slutför

Om där finns uppdateringar kommer dessa att installeras.

Då ovanstående är gjort gå vidare med nedanstående procedur:

1: När programmet startar så välj Utför snabb scanning

2: Klicka på knappen Scanna

3: Scanningen kommer nu att ta en stund

3: När programmet scannat klart klicka Ok och sedan Visa resultat

4: Bocka för allt och klicka på Remove Selected

5: Då borttagningen är klar kommer en textfil i Anteckningar att öppnas upp med en logg. Kopiera/klistra in den loggan hit till din tråd.

6: Gör en ny TM HJT-logga kopiera in den hit så får vi se hur den ser ut.

MVH/Malou

StefanT · November 9, 2008

Tack för hjälpen. Malwarebytes Anti-Malware hittade 303 infekterade filer. Nu är jag en glad datorägare igen --!!

//Stefan

November 9, 2008

Hej StefanT!

Varsegod och härligt att höra att du är glad igen ;)

Men kopiera gärna in loggarna hit som jag bad om så vi kan kontrollera så att systemet är rent.

MVH/Malou

StefanT · November 9, 2008

Ska göra det när jag kommer hem från jobbet

//Stefan

November 9, 2008

Ska göra det när jag kommer hem från jobbet
//Stefan

Ok låter bra. Så tar jag en titt på dem imorgon

Anledningen till att jag vill se loggarna är för att som du förhoppningsvis förstår försäkra mig om att allt är rent och fint. Och att Malwarebytes Anti-Malware hittat samt åtgärdat det mesta. För det fanns en hel del otyg i din TM HJT-logga och det är inte säkert att Malwarebytes Anti-Malware klarar av att hitta/åtgärda resterande. Vi kan behöva ta till ytterligare skarpa verktyg för att åtgärda resterande. Detta är då för att hjälpa dig i all välmening så att du verkligen får ett rent och fint system igen ;)

MVH/Malou

StefanT · November 10, 2008

Hej igen

Ingen är tacksammare än jag att det blir fullständigt virusfritt. Provade både med Spywarefighter och Norton innan, men jag borde loggat in på den här sidan direkt istället. Ha en bra dag..

M.v.h

Stefan

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:51:45, on 2008-11-10

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:ProgramDelade filerSymantec SharedccSetMgr.exe

C:ProgramDelade filerSymantec SharedccEvtMgr.exe

C:ProgramDelade filerSymantec SharedccProxy.exe

C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

C:ProgramDelade filerSymantec SharedSNDSrvc.exe

C:ProgramDelade filerSymantec SharedSPBBCSPBBCSvc.exe

C:ProgramDelade filerSymantec SharedCCPD-LCsymlcsvc.exe

C:WINDOWSExplorer.EXE

C:WINDOWSsystem32LEXBCES.EXE

C:WINDOWSsystem32LEXPPS.EXE

C:WINDOWSsystem32spoolsv.exe

C:ProgramSymantecLiveUpdateALUSchedulerSvc.exe

C:WINDOWSSystem32svchost.exe

C:ProgramDellOpenManageClientIap.exe

C:ProgramMicrosoft SQL ServerMSSQL$SPCSBinnsqlservr.exe

C:ProgramNorton Internet SecurityNorton AntiVirusnavapsvc.exe

C:ProgramFightersconfigservice.exe

C:WINDOWSsystem32svchost.exe

C:ProgramFighterslicenseservice.exe

C:ProgramFightersupdateservice.exe

C:ProgramFightersScannerService.exe

C:ProgramMacrogamingSweetIMSweetIM.exe

C:ProgramJavajre1.6.0_05binjusched.exe

C:ProgramFightersspywarefighterSpywarefighterUser.exe

C:ProgramQuickTimeqttask.exe

C:WINDOWSsystem32LXSUPMON.EXE

C:WINDOWSsystem32igfxpers.exe

C:WINDOWSsystem32hkcmd.exe

C:ProgramCyberLinkPowerDVDDVDLauncher.exe

C:ProgramDelade filerSymantec SharedccApp.exe

C:WINDOWSsystem32ctfmon.exe

C:ProgramWindows Media PlayerWMPNSCFG.exe

C:ProgramGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

C:ProgramWindows LiveMessengermsnmsgr.exe

C:GarmingStart.exe

C:ProgramDelade filerSymantec SharedSecurity ConsoleNSCSRVCE.EXE

C:WINDOWSsystem32wuauclt.exe

C:ProgramSymantecLIVEUP~1LUCOMS~1.EXE

C:ProgramSymantecLiveUpdateAUpdate.exe

C:ProgramSymantecLiveUpdateLuCallbackProxy.exe

C:ProgramTrend MicroHijackThisCatha.exe

C:ProgramSymantecLiveUpdateLuCallbackProxy.exe

C:ProgramMessengermsmsgs.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://dellsearchedit.myway.com/samisc/del...ebar.jhtml?p=EB

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = https://upplandsbro.skola24.se/

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www1.euro.dell.com/content/default....;l=sv&s=gen

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Länkar

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:ProgramMacrogamingSweetIMBarForIEtoolbar.dll

O2 - BHO: mxlivemedia browser enhancer - {15f1de2b-e547-f1d4-f82d-d5bfd4ee2e0e} - C:WINDOWSsystem32tuyrgsacxlt.dll (file missing)

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:ProgramMyWaySASrchAsDedeSrcAs.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:ProgramJavajre1.6.0_05binssv.dll

O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:ProgramDelade filerMicrosoft SharedWindows LiveWindowsLiveLogin.dll

O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:ProgramDelade filerSymantec SharedAdBlockingNISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:ProgramNorton Internet SecurityNorton AntiVirusNavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:programgooglegoogletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:ProgramGoogleGoogleToolbarNotifier3.1.807.1746swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:ProgramWindows Live Toolbarmsntb.dll

O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:ProgramDelade filerSymantec SharedAdBlockingNISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:ProgramNorton Internet SecurityNorton AntiVirusNavShExt.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:ProgramMacrogamingSweetIMBarForIEtoolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:programgooglegoogletoolbar1.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:ProgramWinamp Toolbarwinamptb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:ProgramWindows Live Toolbarmsntb.dll

O4 - HKLM..Run: [symantec PIF AlertEng] "C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe" /a /m "C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}AlertEng.dll"

O4 - HKLM..Run: [C:WINDOWSsystem32kdihl.exe] C:WINDOWSsystem32kdihl.exe

O4 - HKLM..Run: [Windows Updater] updater.com

O4 - HKLM..Run: [WinampAgent] C:ProgramWinampwianmpa.exe

O4 - HKLM..Run: [sweetIM] C:ProgramMacrogamingSweetIMSweetIM.exe

O4 - HKLM..Run: [sunJavaUpdateSched] "C:ProgramJavajre1.6.0_05binjusched.exe"

O4 - HKLM..Run: [spywarefighterguard] C:ProgramFightersspywarefighterSpywarefighterUser.exe

O4 - HKLM..Run: [QuickTime Task] "C:ProgramQuickTimeqttask.exe" -atboottime

O4 - HKLM..Run: [LXSUPMON] C:WINDOWSsystem32LXSUPMON.EXE RUN

O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k

O4 - HKLM..Run: [igfxtray] C:WINDOWSsystem32igfxtray.exe

O4 - HKLM..Run: [igfxpers] C:WINDOWSsystem32igfxpers.exe

O4 - HKLM..Run: [igfxhkcmd] C:WINDOWSsystem32hkcmd.exe

O4 - HKLM..Run: [DVDLauncher] "C:ProgramCyberLinkPowerDVDDVDLauncher.exe"

O4 - HKLM..Run: [ccApp] "C:ProgramDelade filerSymantec SharedccApp.exe"

O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:ProgramAdobeReader 8.0ReaderReader_sl.exe"

O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe

O4 - HKCU..Run: [WMPNSCFG] C:ProgramWindows Media PlayerWMPNSCFG.exe

O4 - HKCU..Run: [swg] C:ProgramGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe

O4 - HKCU..Run: [MsnMsgr] "C:ProgramWindows LiveMessengermsnmsgr.exe" /background

O4 - HKCU..Run: [gStart] C:GarmingStart.exe

O4 - HKCU..Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:ProgramDelade filerAheadLibNMBgMonitor.exe"

O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')

O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'Default user')

O7 - HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1

O8 - Extra context menu item: &Winamp Toolbar Search - C:Documents and SettingsAll UsersApplication DataWinamp ToolbarieToolbarresourcesen-USlocalsearch.html

O8 - Extra context menu item: &Windows Live Search - res://C:ProgramWindows Live Toolbarmsntb.dll/search.htm

O8 - Extra context menu item: Add to AMV Converter... - C:ProgramMP3 Player Utilities 4.15AMVConvertergrab.html

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:ProgramMICROS~2OFFICE11EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:ProgramMP3 Player Utilities 4.15MediaManagergrab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgramJavajre1.6.0_05binssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgramJavajre1.6.0_05binssv.dll

O9 - Extra button: Blogga detta - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:ProgramWindows LiveWriterWriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blogga detta i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:ProgramWindows LiveWriterWriterBrowserExtension.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:ProgramMICROS~2OFFICE11REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgramMessengermsmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgramMessengermsmsgs.exe

O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - AppInit_DLLs: bjxykt.dll

O20 - Winlogon Notify: wvukjbcb - wvUkJbcB.dll (file missing)

O23 - Service: Automatisk LiveUpdate-schemaläggare - Symantec Corporation - C:ProgramSymantecLiveUpdateALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:ProgramNorton Internet SecurityccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:ProgramDelade filerSymantec SharedccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:ProgramNorton Internet SecuritycomHost.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:ProgramGoogleCommonGoogle UpdaterGoogleUpdaterService.exe

O23 - Service: Iap - Dell Inc - C:ProgramDellOpenManageClientIap.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE

O23 - Service: LiveUpdate - Symantec Corporation - C:ProgramSymantecLIVEUP~1LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:ProgramDelade filerSymantec SharedPIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}PIFSvc.exe

O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec Corporation - C:ProgramNorton Internet SecurityNorton AntiVirusnavapsvc.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:ProgramIntelNCSSyncNetSvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSecurity ConsoleNSCSRVCE.EXE

O23 - Service: PTK License-FIGHTERS-4665699 (ptk license-fighters-4665699) - SPAMfighter - C:ProgramFighterslicenseservice.exe

O23 - Service: PTK Live Update-FIGHTERS-4665699 (ptk live update-fighters-4665699) - SPAMfighter - C:ProgramFightersupdateservice.exe

O23 - Service: PTK Scanner-FIGHTERS-4665699 (ptk scanner-fighters-4665699) - SPAMfighter - C:ProgramFightersScannerService.exe

O23 - Service: PTK SharedAccess-FIGHTERS-4665699 (ptk sharedaccess-fighters-4665699) - SPAMfighter - C:ProgramFightersconfigservice.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:ProgramNorton Internet SecurityNorton AntiVirusSAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:ProgramDelade filerSymantec SharedSPBBCSPBBCSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:ProgramDelade filerSymantec SharedCCPD-LCsymlcsvc.exe

O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:ProgramDelade filerSymantec SharedSupport Controlsssrc.exe

O24 - Desktop Component 0: (no name) - http://www.microsoft.com/windows/plus/imag...ish_150x106.jpg

--

End of file - 13280 bytes

November 10, 2008

Hej StefanT!

Som jag misstänkte så finns där kvar otyg i systemet.

Jag saknar även loggan från Malwarebytes Anti-Malware som jag bad om. Kopiera in den hit så jag får ta en titt även på den.

MVH/Malou

StefanT · November 10, 2008

Hej

Här kommer den loggen. Tur att det finns folk som kan analysera Fick dela den på två.....

//Stefan

Malwarebytes' Anti-Malware 1.30

Databasversion: 1375

Windows 5.1.2600 Service Pack 3

2008-11-09 18:34:58

mbam-log-2008-11-09 (18-34-58).txt

Skanningstyp: Fullständig skanning (C:|)

Antal skannade objekt: 203406

Förfluten tid: 2 hour(s), 40 minute(s), 36 second(s)

Infekterade minnesprocesser: 1

Infekterade minnesmoduler: 4

Infekterade registernycklar: 96

Infekterade registervärden: 10

Infekterade registerdataposter: 17

Infekterade mappar: 10

Infekterade filer: 163

Infekterade minnesprocesser:

C:WINDOWSservice.exe (Backdoor.Bot) -> Unloaded process successfully.

Infekterade minnesmoduler:

C:WINDOWSsystem32bYomLefg.dll (Trojan.Vundo.H) -> Delete on reboot.

C:WINDOWSsystem32bjxykt.dll (Trojan.Vundo) -> Delete on reboot.

C:WINDOWSsystem32ssqPjIxy.dll (Trojan.Vundo) -> Delete on reboot.

C:WINDOWSsystem32jhrxxbid.dll (Trojan.Vundo) -> Delete on reboot.

Infekterade registernycklar:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{79117664-7a50-429c-b3af-6cdf9e1886ce} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyqomeeulb (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{79117664-7a50-429c-b3af-6cdf9e1886ce} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9c81d128-4da9-46c9-91d7-efd68ca2c923} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{9c81d128-4da9-46c9-91d7-efd68ca2c923} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{deb85b3b-8afc-4567-bc39-46da44c17c61} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOTCLSID{deb85b3b-8afc-4567-bc39-46da44c17c61} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0005b3dd-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{0005b3dd-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000b187f-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{000b187f-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{000b67ba-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{000b67ba-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{001630fe-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{001630fe-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0016cf75-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{0016cf75-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{002c61fd-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{002c61fd-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{002d9eea-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{002d9eea-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0058c3fb-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{0058c3fb-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{005b3dd4-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{005b3dd4-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00b187f6-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{00b187f6-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{00b67ba9-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{00b67ba9-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{01630fed-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{01630fed-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{016cf752-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{016cf752-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02c61fdb-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{02c61fdb-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{02d9eea5-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{02d9eea5-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{058c3fb7-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{058c3fb7-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{05b3dd4b-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{05b3dd4b-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0b187f6f-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{0b187f6f-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{0b67ba96-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{0b67ba96-a43d-432d-915b-1933d975e360} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1630fede-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{1630fede-d25f-4bef-8e7f-220666fb7830} (Trojan.BHO.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{9c81d128-4da9-46c9-91d7-efd68ca2c923} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Delete on reboot.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyssqpjixy (Trojan.Vundo) -> Delete on reboot.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{deb85b3b-8afc-4567-bc39-46da44c17c61} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{0005b3dd-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{000b67ba-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{0016cf75-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{002d9eea-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{005b3dd4-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{00b67ba9-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{016cf752-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{02d9eea5-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{05b3dd4b-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{0b67ba96-a43d-432d-915b-1933d975e360} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTInterface{99ccfb8c-6380-4a14-8fdd-ef3e7e95335d} (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{460ac4db-b0de-4626-a0f0-175dd84dcb9b} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{4d25f926-b9fe-4682-bf72-8ab8210d6d75} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{4b18dd50-c996-44fc-ac52-0fecff82ed58} (Spyware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{79117664-7a50-429c-b3af-6cdf9e1886ce} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftInstallerProducts568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{000b187f-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{001630fe-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{002c61fd-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{0058c3fb-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{00b187f6-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{01630fed-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{02c61fdb-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{058c3fb7-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{0b187f6f-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{1630fede-d25f-4bef-8e7f-220666fb7830} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTTypeLib{b0f1f251-79bd-4ac5-bdb6-383379e50cb3} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{68354ad6-ac7e-4fe3-a19b-8f8e70ab4252} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{68354ad6-ac7e-4fe3-a19b-8f8e70ab4252} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTCLSID{d10c4db6-cb02-40f4-88ee-c0b64c02adfc} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExtStats{d10c4db6-cb02-40f4-88ee-c0b64c02adfc} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{d10c4db6-cb02-40f4-88ee-c0b64c02adfc} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOTsexvid (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSoftware Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftMS Juan (Malware.Trace) -> Delete on reboot.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftcontim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftMS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftrdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftFCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftRemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infekterade registervärden:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunmessenger service (Backdoor.Bot.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Delete on reboot.

HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerURLSearchHooks{4d25f926-b9fe-4682-bf72-8ab8210d6d75} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks{79117664-7a50-429c-b3af-6cdf9e1886ce} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunlsmnvboumq (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunlphc7d9j0egfn (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERControl PanelDesktopwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERControl PanelDesktoporiginalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERControl PanelDesktopconvertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERControl PanelDesktopscrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Infekterade registerdataposter:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLSANotification Packages (Trojan.Vundo.H) -> Data: c:windowssystem32byomlefg -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonSystem (Rootkit.DNSChanger.H) -> Data: kdihl.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLSAAuthentication Packages (Trojan.Vundo) -> Data: c:windowssystem32byomlefg -> Delete on reboot.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemNoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemNoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersDhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces{f5198715-f56e-4d20-a279-1a0fa879f9d2}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesTcpipParametersDhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesTcpipParametersInterfaces{f5198715-f56e-4d20-a279-1a0fa879f9d2}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Delete on reboot.

HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesTcpipParametersDhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.83 192.168.0.1 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesTcpipParametersInterfaces{7ef5bb9b-24d6-4aa6-a938-6d497ebdca75}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesTcpipParametersInterfaces{f5198715-f56e-4d20-a279-1a0fa879f9d2}NameServer (Trojan.DNSChanger) -> Data: 85.255.112.74;85.255.112.191 -> Quarantined and deleted successfully.

Infekterade mappar:

C:ProgramHotbar (Adware.Hotbar) -> Delete on reboot.

C:ProgramHotbarbin (Adware.Hotbar) -> Delete on reboot.

C:ProgramHotbarbin10.0.356.0 (Adware.Hotbar) -> Delete on reboot.

C:ProgramHotbarbin10.0.356.0firefox (Adware.Hotbar) -> Delete on reboot.

C:ProgramHotbarbin10.0.356.0firefoxextensions (Adware.Hotbar) -> Delete on reboot.

C:ProgramHotbarbin10.0.356.0firefoxextensionscomponents (Adware.Hotbar) -> Quarantined and deleted successfully.

C:ProgramHotbarbin10.0.356.0firefoxextensionsplugins (Adware.Hotbar) -> Quarantined and deleted successfully.

C:ProgramMyWaySA (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:ProgramMyWaySASrchAsDe (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:Documents and SettingsAll UsersApplication Data2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.

StefanT · November 10, 2008

Här kommer #2.

/Stefan