HJT logga efter att antivirusprogrammet skrikit om Doos. K trojan

XP Dude · February 26, 2009

*********************************************

2009-06-06:

Tråden är låst då problemet är löst.

Tycker du att den är felaktigt låst, var god kontakta

*********************************************

Hej!

Igår kalibrerade jag min skärm med Spyder 2 2.2 och surfade en stund efter detta stod datron på en stund o när ja skulle stänga av hade mitt AVG Free antivirus en varning om ett "Threat" Någon som vill tolka denna logg?

Tack på förhand!

// XP dude

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:49:52, on 2009-02-26

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\McAfee\SiteAdvisor\McSACore.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\Program\AVG\AVG8\avgemc.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\WINDOWS\TEMP\9600.tmp

C:\Program\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\EXPERTool\TBPanel.exe

C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Adobe\Adobe Photoshop CS3\Photoshop.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Windows Live\Messenger\msnmsgr.exe

C:\Program\Windows Live\Messenger\usnsvc.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program\AVG\AVG8\avgssie.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program\mcafee\SITEAD~1\mcieplg.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [smcService] C:\Program\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [GAINWARD] C:\Program\EXPERTool\TBPanel.exe /A

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: adni18_BL-Clock.lnk = C:\Documents and Settings\Fredrik\Skrivbord\adni18_BL-Clock.exe

O4 - Startup: Hyalo-Calendar by adni18.lnk = C:\Documents and Settings\Fredrik\Skrivbord\Hyalo-Calendar Gadget by adni18.exe

O4 - Global Startup: ColorVisionStartup.lnk = C:\Program\ColorVision\Utility\ColorVisionStartup.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1231922808437

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre...ows-i586-jc.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program\mcafee\SITEAD~1\mcieplg.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll

O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program\Delade filer\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program\Delade filer\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Unknown owner - C:\Program\Delade filer\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program\Sygate\SPF\smc.exe

O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program\Delade filer\Sony Shared\AVLib\SsBeSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program\Delade filer\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program\Delade filer\Sony Shared\AVLib\SSScsiSV.exe

--

End of file - 9865 bytes

// XP Dude

February 26, 2009

Hej XP Dude!

Ser i din TM HJT-logga redan nu att du har råkat ut för en Trojan/Agent som skall åtgärdas. Så vi tar till ComboFix på direkten.

ComboFix för Windows XP och Windows Vista:

Skriv ut nedanstående eller kopiera det till ett textdokument och spara det till skrivbordet:

Läs/Följ Instruktionerna mycket noga

ComboFix förhindrar automatisk körning av CD, disketter och USB-enheter för att göra det lättare att rensa datorn och skydda datorn mot infektioner i framtiden. Det kan bli problem t ex om du har internet via ett USB-modem eller USB-nätverkskort.

Säg då till i stället för att köra ComboFix.

Hämta hem ComboFix från nedanstående länk

=> ComboFix.exe

# Spara ComboFix till skrivbordet "Mycket viktigt"

Du bör installera Microsoft Windows Recovery Console eftersom det gör det möjligt att starta datorn i ett särskild återställningsläge vilket kan vara bra om något händer med datorn under de kommande procedurerna.

Notera: Om Microsoft Windows Recovery Console redan finns installerat på datorn, kommer ComboFix att gå vidare med scanningen:

Windows Vista-Användare:

Windows Vista-användare kan använda sin Windows DVD för att starta upp i Vista återställningsmiljön.

=> Vista återställningsmiljön "Engelsk Text"

Windows XP-Användare:

Installera Microsoft Windows Recovery Console:

# Surfa till http://support.microsoft.com/kb/310994

# Se till att språket på sidan matchar språket i Windows (språk väljs i högerkolumnen) om du inte har XP Media Center Edition för då ska du ha engelska.

# Scrolla ner till rubriken Hämta programfilen för installationsdisketterna

# Välj rätt nedladdning utifrån vilken Service Pack du har installerat till XP. Om du har SP3 så välj SP2.

# Om du har XP Media Center Edition så välj XP Professional.

# Spara den nedladdade filen på Skrivbordet.

# Ta tag i filen du sparade ner till skrivbordet => Dra filen med musen över Skrivbordet och släpp den på ComboFix-ikonen. ComboFix kommer nu att installera Återställningskonsolen.

OBS: Denna procedur kan ta lång tid så det gäller att du har tålamod under installationen av Återställningskonsolen. Du bör även godkänna/tillåta allt via skyddsprogrammen (antivirus/brandväggen etc..) för ett lyckat resultat.

# När det är klart så kommer ComboFix att fråga om du vill fortsätta med att scanna, där väljer du No/Nej.

Gå nu vidare med ComboFix-Scanningen:

Dra ur internetanslutningen och stäng av alla program du ser inklusive antivirusprogram, antispionprogram och brandvägg.

1: Dubbelklicka på ComboFix för att starta den

2: Följ anvisningarna som visas på skärmen.

3: När den är färdig så skall en text-logg komma upp, kopiera och klistra in den hit till din tråd

Kan även hittas här => (C:\ComboFix.txt)

4: Gör en ny TM HJT-logg, kopiera även in den.

VIKTIGT! Klicka INTE på Combofix-fönstret med musen när ComboFix körs annars kan scanningen hänga upp sig.

OBS:

Kontrollera att antivirusprogram/antispionprogram mm är återaktiverade innan du ansluter till Internet.

OBSERVERA:

Verktyget/Programmet kan ge problem med uppkopplingen (tex trådlös).

Om problem uppstår prova då nedanstående.

Gå till => Kontrollpanelen => Nätverksanslutningar => högerklicka på din Internetanslutning => välj Reparera

Och/Eller

Starta om datorn.

Lycka till

MVH/Malou

XP Dude · February 26, 2009

Hej Malou!

Här kommer loggan från ComboFix:

ComboFix 09-02-25.02 - Fredrik 2009-02-26 16:09:36.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1053.18.2047.1528 [GMT 1:00]

Körs från: c:\documents and settings\Fredrik\Skrivbord\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

FW: Sygate Personal Firewall *disabled*

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\~.exe

c:\windows\system32\crypts.dll

c:\windows\system32\wpv401232632526.cpx

.

(((((((((((((((((((((((( Filer Skapade från 2009-01-26 till 2009-02-26 ))))))))))))))))))))))))))))))

.

2009-02-26 00:25 . 2009-02-26 00:27 <KAT> d-------- c:\documents and settings\Fredrik\.housecall6.6

2009-02-25 17:33 . 2004-03-29 16:23 90,112 --a------ c:\windows\unvise32.exe

2009-02-25 17:32 . 2009-02-25 17:33 <KAT> d-------- c:\program\ColorVision

2009-02-16 19:47 . 2009-02-16 19:47 <KAT> d-------- c:\program\Recuva

2009-02-08 18:19 . 2009-02-08 18:19 <KAT> d-------- c:\documents and settings\All Users\SonicStage

2009-02-08 18:11 . 2009-02-08 18:11 <KAT> d-------- c:\documents and settings\All Users\Application Data\Sony Corporation

2009-02-08 18:10 . 2009-02-08 18:11 <KAT> d-------- c:\program\Sony

2009-02-08 18:10 . 2009-02-08 18:10 <KAT> d-------- c:\program\Delade filer\Sony Shared

2009-02-08 18:10 . 2009-02-08 18:19 <KAT> d-------- c:\documents and settings\Fredrik\Application Data\Sony Corporation

2009-01-30 16:25 . 2009-01-30 16:25 268 --ah----- C:\sqmdata01.sqm

2009-01-30 16:25 . 2009-01-30 16:25 244 --ah----- C:\sqmnoopt01.sqm

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-20 23:33 --------- d-----w c:\documents and settings\All Users\Application Data\DriverCure

2009-02-19 18:03 --------- d-----w c:\documents and settings\Fredrik\Application Data\uTorrent

2009-02-16 18:22 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-02-16 18:21 --------- d-----w c:\program\SpywareBlaster

2009-02-08 19:11 --------- d-----w c:\program\Steam

2009-02-08 17:11 --------- d--h--w c:\program\InstallShield Installation Information

2009-02-08 17:10 --------- d-----w c:\program\Delade filer\InstallShield

2009-02-07 18:57 --------- d-----w c:\documents and settings\Fredrik\Application Data\Microgaming

2009-02-06 12:34 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-02-06 12:34 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-02-06 12:34 10,520 ----a-w c:\windows\system32\avgrsstx.dll

2009-02-04 20:56 --------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-01-18 16:25 --------- d-----w c:\program\EXPERTool

2009-01-18 16:23 --------- d-----w c:\program\AMD

2009-01-18 16:22 --------- d-----w c:\program\Delade filer\Wise Installation Wizard

2009-01-17 23:22 --------- d-----w c:\documents and settings\Fredrik\Application Data\AVGTOOLBAR

2009-01-17 09:41 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2009-01-16 20:35 --------- d-----w c:\program\McAfee

2009-01-16 13:20 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor

2009-01-16 13:19 --------- d-----w c:\program\Delade filer\McAfee

2009-01-16 13:19 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-01-15 23:26 --------- d-----w c:\program\SIW

2009-01-15 17:21 --------- d-----w c:\documents and settings\Fredrik\Application Data\vlc

2009-01-15 17:18 --------- d-----w c:\program\VideoLAN

2009-01-15 15:07 --------- d-----w c:\program\uTorrent

2009-01-14 09:28 --------- d-----w c:\program\Windows Live

2009-01-14 09:27 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller

2009-01-14 09:20 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-01-14 09:20 --------- d-----w c:\program\Java

2009-01-14 08:46 --------- d-----w c:\program\MSECache

2009-01-13 22:01 --------- dcsh--w c:\program\Delade filer\WindowsLiveInstaller

2009-01-13 21:53 --------- d-----w c:\documents and settings\Fredrik\Application Data\Logitech

2009-01-13 21:53 --------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd

2009-01-13 21:52 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-01-13 21:52 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2009-01-13 21:52 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf

2009-01-13 21:52 --------- d-----w c:\program\Logitech

2009-01-13 21:52 --------- d-----w c:\program\Delade filer\Logishrd

2009-01-13 21:52 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech

2009-01-13 21:15 --------- d-----w c:\program\AVG

2009-01-13 21:08 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet

2009-01-13 21:07 --------- d-----w c:\program\Windows Desktop Search

2009-01-13 21:05 --------- d-----w c:\program\Delade filer\Adobe

2009-01-13 21:03 --------- d-----w c:\program\Delade filer\Control Panels

2009-01-13 21:02 --------- d-----w c:\documents and settings\All Users\Application Data\ALM

2009-01-13 20:53 --------- d-----w c:\program\QuickTime

2009-01-13 20:49 --------- d-----w c:\program\Trend Micro

2009-01-13 20:49 --------- d-----w c:\program\CCleaner

2009-01-13 20:42 --------- d-----w c:\program\Bonjour

2009-01-13 20:40 --------- d-----w c:\program\Delade filer\Macrovision Shared

2009-01-13 19:59 --------- d-----w c:\program\Sygate

2009-01-13 19:44 --------- d-----w c:\documents and settings\Fredrik\Application Data\Windows Search

2009-01-13 18:47 --------- d-----w c:\program\ParetoLogic

2009-01-13 18:47 --------- d-----w c:\program\Delade filer\ParetoLogic

2009-01-13 18:47 --------- d-----w c:\documents and settings\Fredrik\Application Data\DriverCure

2009-01-13 18:47 --------- d-----w c:\documents and settings\All Users\Application Data\ParetoLogic

2009-01-13 18:47 --------- d-----w c:\documents and settings\All Users\Application Data\Downloaded Installations

2009-01-13 18:33 --------- d-----w c:\program\Setup Files

2009-01-13 18:14 --------- d-----w c:\program\Windows Media Connect 2

2009-01-13 17:16 --------- d-----w c:\program\AGEIA Technologies

2009-01-13 17:13 --------- d-----w c:\program\SystemRequirementsLab

2009-01-13 17:04 --------- d-----w c:\program\microsoft frontpage

2009-01-13 17:03 --------- d-----w c:\program\Onlinetjänster

2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE

2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"GAINWARD"="c:\program\EXPERTool\TBPanel.exe" [2008-12-03 2181672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]

"SmcService"="c:\program\Sygate\SPF\smc.exe" [2004-10-15 2577632]

"Acrobat Assistant 8.0"="c:\program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]

"Adobe_ID0EYTHM"="c:\program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160]

"AVG8_TRAY"="c:\program\AVG\AVG8\avgtray.exe" [2009-02-06 1601304]

"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-01-14 136600]

"amd_dc_opt"="c:\program\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.EXE]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start-meny\Program\Autostart\

ColorVisionStartup.lnk - c:\program\ColorVision\Utility\ColorVisionStartup.exe [2006-01-31 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2008-11-07 16:41 72208 c:\program\Delade filer\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-02-06 13:34 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Logitech SetPoint.lnk]

path=c:\documents and settings\All Users\Start-meny\Program\Autostart\Logitech SetPoint.lnk

backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start-meny\Program\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverCure]

--a------ 2009-01-21 06:38 2896976 c:\program\ParetoLogic\DriverCure\DriverCure.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2009-01-16 21:48 5724184 c:\program\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pareto_Update]

--a------ 2009-01-21 06:36 189808 c:\program\Delade filer\ParetoLogic\UUS2\Pareto_Update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

--a------ 2009-01-13 20:13 1410296 c:\program\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

-ra------ 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\Program\\Delade filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=

"c:\\Program\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program\\Steam\\steamapps\\purepa1n\\counter-strike source\\hl2.exe"=

"c:\\Program\\uTorrent\\uTorrent.exe"=

"c:\\Program\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

"c:\\Program\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server

"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server

"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server

"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-13 325128]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-13 107272]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\program\AVG\AVG8\avgemc.exe [2009-01-13 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\program\AVG\AVG8\avgwdsvc.exe [2009-01-13 298264]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-01-13 10384]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program\McAfee\SiteAdvisor\McSACore.exe [2009-01-16 206096]

S2 cnaswd;cnaswd;\??\c:\windows\system32\drivers\bffctbyzwvvqqky.sys --> c:\windows\system32\drivers\bffctbyzwvvqqky.sys [?]

S3 mdxgthkn;mdxgthkn;\??\c:\docume~1\Fredrik\LOKALA~1\Temp\mdxgthkn.sys --> c:\docume~1\Fredrik\LOKALA~1\Temp\mdxgthkn.sys [?]

.

Innehållet i mappen 'Schemalagda aktiviteter':

2009-02-20 c:\windows\Tasks\DriverCure.job

- c:\program\ParetoLogic\DriverCure\DriverCure.exe [2009-01-21 06:38]

2009-02-25 c:\windows\Tasks\ParetoLogic Registration.job

- c:\program\Delade filer\ParetoLogic\UUS2\UUS.dll [2009-01-21 06:36]

2009-02-20 c:\windows\Tasks\ParetoLogic Update Version2.job

- c:\program\Delade filer\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-21 06:36]

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

HKLM-Run-AMD_Display - (no file)

.

------- Extra genomsökning -------

.

uInternet Settings,ProxyOverride = *.local

DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab

FF - ProfilePath - c:\documents and settings\Fredrik\Application Data\Mozilla\Firefox\Profiles\7e9t494f.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - component: c:\program\McAfee\SiteAdvisor\components\McFFPlg.dll

---- FIREFOX POLICY ----

c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-26 16:10:21

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]

"ImagePath"=""

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

- - - - - - - > 'winlogon.exe'(844)

c:\program\delade filer\logishrd\bluetooth\LBTWlgn.dll

c:\program\delade filer\logishrd\bluetooth\LBTServ.dll

.

Sluttid: 2009-02-26 16:11:14

ComboFix-quarantined-files.txt 2009-02-26 15:11:12

Före genomsökningen: 69 425 369 088 byte ledigt

Efter genomsökningen: 69,417,484,288 byte ledigt

210 --- E O F --- 2009-02-25 23:30:23

Ser det bättre ut nu?

Tack på förhand!

// XP Dude

February 26, 2009

Hej XP Dude!

Och vart tog en ny TM HJT-logga vägen som jag också bad om att få?

Hur mår datorn nu?

Kvarstår där några problem?

ComboFix har hittat samt åtgärdat otrevligheterna. Mycket bra.

Skall alldeles strax gå igenom resterande av Combologgan för att se om där finns ytterligare elakingar som behöver åtgärdas. tar en stund så håll ut så länge.

MVH/Malou

XP Dude · February 26, 2009

Hej igen Malou!

Oj missade HJT-loggan den kommer nu istället, ber om ursäkt för detta.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:03:40, on 2009-02-26

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\McAfee\SiteAdvisor\McSACore.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program\AVG\AVG8\avgemc.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\EXPERTool\TBPanel.exe

C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\wuauclt.exe