Virushjälp Trojan Horse Generic 14 BPXC

MrO · Oktober 4, 2009

ja nåt har gått snett för så här lång tid ska det inte ta,gör om installationen med combo

simmesimme · Oktober 4, 2009

ok, installerat igen, stängt ner virusskydd och dubbelklickat på combo-ikonen på skrivbordet så får vi se om det händer något den här gången.

ja nåt har gått snett för så här lång tid ska det inte ta,gör om installationen med combo

MrO · Oktober 4, 2009

Ok lycka till då

simmesimme · Oktober 4, 2009

Ok lycka till då

nä, den vill inte, ingeting händer.

/S

MrO · Oktober 4, 2009

ok prova att starta datorn i felsäker läge istället då(Tryck F8 upprepade gånger vid uppstart) och kör ComboFix därifrån!

simmesimme · Oktober 4, 2009

ok, kör detta nu. Fräsig grafik minsann... i felsäkert läge.

nu händer det grejer också ser jag.

Slutfört skede.... och så

återkommer snart gissar jag.

/S

ok prova att starta datorn i felsäker läge istället då(Tryck F8 upprepade gånger vid uppstart) och kör ComboFix därifrån!

MrO · Oktober 4, 2009

Ahh låter bra du,härligt att det äntligen verkar fungera!!

simmesimme · Oktober 4, 2009

Nu blev det resultat, här är loggen från combofix

ComboFix 09-10-04.01 - Ägaren 10/04/2009 23:37.1.2 - NTFSx86 MINIMAL

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1023.812 [GMT 2:00]

Körs från: c:\documents and settings\Ägaren\Skrivbord\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Ägaren\Application Data\Microsoft\Clip Organizer\mstore10.mgc

c:\documents and settings\Ägaren\Application Data\Microsoft\Clip Organizer\Offic10.MGC

c:\program\WinPCap

c:\program\WinPCap\rpcapd.exe

c:\windows\Installer\WMEncoder.msi

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

D:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_npf

(((((((((((((((((((((((( Filer Skapade från 2009-09-04 till 2009-10-04 ))))))))))))))))))))))))))))))

.

2009-10-04 15:04 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-04 15:04 . 2009-10-04 15:04 -------- d-----w- c:\program\Malwarebytes' Anti-Malware

2009-10-04 15:04 . 2009-10-04 15:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-04 15:04 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-04 14:45 . 2009-10-04 14:45 -------- d-----w- c:\program\Trend Micro

2009-10-04 09:21 . 2009-10-04 09:21 -------- d-----w- C:\b1880a0530d8e7fa7048

2009-10-04 08:34 . 2009-10-04 08:34 5632 ----a-w- C:\efbcmkj.exe

2009-10-04 08:34 . 2009-10-04 08:34 195706 ----a-w- C:\hufa.exe

2009-10-04 08:34 . 2009-10-04 08:34 57344 ----a-w- C:\ehrrg.exe

2009-09-30 21:13 . 2009-09-30 21:13 -------- d-----w- c:\program\Delade filer\Windows Live

2009-09-13 23:19 . 2009-09-13 23:19 -------- d-----w- C:\d4a6bd61962c67e6ac86a4a0af

2009-09-13 20:33 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-04 22:05 . 2007-10-31 00:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-10-02 22:06 . 2006-04-04 12:45 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLea.DAT

2009-08-25 06:56 . 2009-08-25 06:56 -------- d-----w- c:\program\Enigma Software Group

2009-08-25 06:30 . 2009-07-19 17:00 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-08-25 06:30 . 2009-07-19 17:00 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-08-25 06:30 . 2009-07-19 17:00 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-08-21 13:35 . 2004-01-01 21:32 83620 ----a-w- c:\windows\system32\perfc01D.dat

2009-08-21 13:35 . 2004-01-01 21:32 444322 ----a-w- c:\windows\system32\perfh01D.dat

2009-08-21 13:30 . 2009-08-21 13:30 -------- d-----w- c:\program\MSBuild

2009-08-21 13:30 . 2009-08-21 13:30 -------- d-----w- c:\program\Reference Assemblies

2009-08-21 11:19 . 2008-10-02 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2009-08-21 06:46 . 2004-01-01 14:18 -------- d-----w- c:\program\Java

2009-08-18 19:05 . 2008-07-31 17:13 -------- d-----w- c:\program\Safari

2009-08-05 09:01 . 2002-12-12 06:14 205312 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-25 03:23 . 2008-12-31 07:37 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-07-24 05:28 . 2008-08-14 22:31 56536 ---ha-w- c:\windows\system32\mlfcache.dat

2009-07-19 17:00 . 2009-07-19 17:00 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-07-17 19:04 . 2004-01-01 16:06 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-13 21:43 . 2004-01-01 14:15 286208 ----a-w- c:\windows\system32\wmpdxm.dll

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-06-26 08:36 1008896 ----a-w- c:\program\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-26 1008896]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Acme.PCHButton"="c:\program\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe" [2004-01-01 155648]

"BackupNotify"="c:\program\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 32768]

"MsnMsgr"="c:\program\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"swg"="c:\program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-01 68856]

"updateMgr"="c:\program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"RegistryMechanic"="c:\program\Registry Mechanic\RegMech.exe" [2009-06-30 2836376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"HPHUPD05"="c:\program\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 49152]

"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-08-21 483328]

"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]

"UpdateManager"="c:\program\Delade filer\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2003-11-03 221184]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-12-05 3022848]

"Sunkist2k"="c:\program\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168]

"HP Software Update"="c:\program\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]

"HP Component Manager"="c:\program\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]

"WireLessKeyboard"="c:\program\Multimedia Keyboard &Mouse Driver\StartAutorun.exe" [2005-11-30 94208]

"WireLessMouse"="c:\program\Multimedia Keyboard &Mouse Driver\StartAutorun.exe" [2005-11-30 94208]

"AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472]

"UVS10 Preload"="c:\program\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 36864]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]

"AVG8_TRAY"="c:\program\AVG\AVG8\avgtray.exe" [2009-08-25 2007832]

"QuickTime Task"="c:\program\QuickTime\qttask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"SpyHunter Security Suite"="c:\program\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2009-04-02 868352]

"Malwarebytes Anti-Malware (reboot)"="c:\program\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-12-05 753664]

"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2003-04-03 50176]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-01-23 101136]

c:\documents and settings\All Users\Start-meny\Program\Autostart\

Adobe Reader Speed Launch.lnk - c:\program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

HP Digital Imaging Monitor.lnk - c:\program\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]

Logitech Desktop Messenger.lnk - c:\program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-2-27 67128]

Logitech SetPoint.lnk - c:\program\Logitech\SetPoint\SetPoint.exe [2009-2-27 688128]

Microsoft Office.lnk - c:\program\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

MioSync.lnk - c:\program\Mio Technology\MioSync\mioSync.exe [2008-2-13 647168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-25 06:30 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program\\Real\\RealPlayer\\realplay.exe"=

"c:\\WINDOWS\\system32\\mshta.exe"=

"c:\\Program\\HP\\HP Software Update\\HPWUCli.exe"=

"c:\\Program\\Messenger\\msmsgs.exe"=

"c:\\Program\\uTorrent\\utorrent.exe"=

"c:\\Program\\Java\\jre1.5.0_11\\bin\\rmiregistry.exe"=

"c:\\Program\\Java\\jre1.5.0_11\\bin\\orbd.exe"=

"c:\\Program\\Spotify\\spotify.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program\\MSN Messenger\\livecall.exe"=

"c:\\Program\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"c:\\Program\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\Program\\iTunes\\iTunes.exe"=

"c:\\Program\\Skype\\Phone\\Skype.exe"=

R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [08/24/2004 7:23 PM 140800]

R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [08/24/2004 7:23 PM 5504]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [07/19/2009 7:00 PM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [07/19/2009 7:00 PM 108552]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\program\AVG\AVG8\avgemc.exe [07/19/2009 7:00 PM 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\program\AVG\AVG8\avgwdsvc.exe [07/19/2009 7:00 PM 297752]

--- Övriga tjänster/drivrutiner i minnet ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Innehållet i mappen 'Schemalagda aktiviteter':

2009-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = localhost;*.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm978

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game04.zylom.com/activex/zylomgamesplayer.cab

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

HKCU-Run-RecordNow! - (no file)

HKLM-Run-PS2 - c:\windows\system32\ps2.exe

HKLM-Run-Microsoft Works Update Detection - c:\program\Delade filer\Microsoft Shared\Works Shared\WkUFind.exe

HKLM-Run-VTTimer - VTTimer.exe

AddRemove-HijackThis - c:\program\Trend Micro\HijackThis\HijackThis.exe

AddRemove-Tasker_is1 - c:\program\Tasker\unins000.exe

AddRemove-Tele2 Signup - c:\windows\Tele2Uninstall.exe

AddRemove-VentriloMIX - c:\program files\VentriloMIX\Uninstal.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-05 00:05

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

- - - - - - - > 'explorer.exe'(3036)

c:\windows\system32\nView.dll

c:\program\Logitech\SetPoint\lgscroll.dll

c:\windows\system32\eappcfg.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andra processer som körs ------------------------

.

c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program\Bonjour\mDNSResponder.exe

c:\program\Java\jre6\bin\jqs.exe

c:\program\Delade filer\Nero\Nero BackItUp 4\NBService.exe

c:\windows\system32\nvsvc32.exe

c:\program\AVG\AVG8\avgrsx.exe

c:\program\AVG\AVG8\avgnsx.exe

c:\windows\system32\StkASv2K.exe

c:\program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe

c:\program\AVG\AVG8\avgcsrvx.exe

c:\windows\system32\rundll32.exe

c:\program\Multimedia Keyboard &Mouse Driver\PS2USBKbdDrv.exe

c:\program\Multimedia Keyboard &Mouse Driver\MouseDrv.exe

c:\program\Nikon\PictureProject\NkbMonitor.exe

c:\program\Delade filer\Logitech\khalshared\KHALMNPR.exe

c:\program\iPod\bin\iPodService.exe

.

**************************************************************************

.

Sluttid: 2009-10-04 0:12 - datorn startades om.

ComboFix-quarantined-files.txt 2009-10-04 22:12

Före genomsökningen: 59,093,204,992 byte ledigt

Efter genomsökningen: 62,471,274,496 byte ledigt

244 --- E O F --- 2009-09-30 13:35

Ahh låter bra du,härligt att det äntligen verkar fungera!!

simmesimme · Oktober 4, 2009

Ahh låter bra du,härligt att det äntligen verkar fungera!!

hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:15:27 AM, on 10/05/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\StkASv2K.exe

C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program\AVG\AVG8\avgemc.exe

C:\Program\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\System32\svchost.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\Program\Multimedia Card Reader\shwicon2k.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program\HP\HP Software Update\HPWuSchd2.exe

C:\Program\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program\iTunes\iTunesHelper.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\Program\Multimedia Keyboard &Mouse Driver\PS2USBKbdDrv.exe

C:\Program\Multimedia Keyboard &Mouse Driver\MouseDrv.exe

C:\Program\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe

C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program\Logitech\SetPoint\SetPoint.exe

C:\Program\Nikon\PictureProject\NkbMonitor.exe

C:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE

C:\Program\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Trend Micro\HijackThis\simmesimme.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: HP-vy - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program\HP\Digital Imaging\bin\hpdtlk02.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HPHUPD05] c:\Program\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [updateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [sunkist2k] C:\Program\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program\Multimedia Keyboard &Mouse Driver\StartAutorun.exe PS2USBKbdDrv.exe

O4 - HKLM\..\Run: [WireLessMouse] C:\Program\Multimedia Keyboard &Mouse Driver\StartAutorun.exe MouseDrv.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [uVS10 Preload] C:\Program\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [spyHunter Security Suite] C:\Program\Enigma Software Group\SpyHunter\SpyHunter3.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [Acme.PCHButton] C:\Program\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe

O4 - HKCU\..\Run: [backupNotify] c:\Program\HP\Digital Imaging\bin\backupnotify.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [RegistryMechanic] C:\Program\Registry Mechanic\RegMech.exe /H

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [RecordNow!] (User 'Gäst')

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [LDM] C:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (User 'Gäst')

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background (User 'Gäst')

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime (User 'Gäst')

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [swg] C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Gäst')

O4 - HKUS\S-1-5-21-3921386975-2091070572-569705731-501\..\Run: [backupNotify] c:\Program\HP\Digital Imaging\bin\backupnotify.exe (User 'Gäst')

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: MioSync.lnk = C:\Program\Mio Technology\MioSync\mioSync.exe

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program\Nikon\PictureProject\NkbMonitor.exe

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm978

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://start.tele2.se

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 12662 bytes

simmesimme · Oktober 4, 2009

Ahh låter bra du,härligt att det äntligen verkar fungera!!

malware

Malwarebytes' Anti-Malware 1.41

Databasversion: 2904

Windows 5.1.2600 Service Pack 3

10/05/2009 12:24:22 AM

mbam-log-2009-10-05 (00-24-22).txt

Skanningstyp: Snabb skanning

Antal skannade objekt: 111601

Förfluten tid: 7 minute(s), 28 second(s)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 0

Infekterade registervärden: 0

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 0

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

Infekterade registernycklar:

(Inga illasinnade poster hittades)

Infekterade registervärden:

(Inga illasinnade poster hittades)

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

(Inga illasinnade poster hittades)

MrO · Oktober 4, 2009

Ok där fick vi fram lite mer skit som skulle bort,mycket bra!

Det finns dock några filer som jag vill kolla upp så vi fortsätter!

Surfa till http://www.virustotal.com (fungerar bäst med Internet Explorer) klistra in ett av följande filnamn i rutan,

C:\efbcmkj.exe

C:\hufa.exe

C:\ehrrg.exe

tryck på Skicka Fil och vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in resultatet från de olika antivirusprogrammen (inte Övrig information) här. Upprepa med nästa filnamn.

Sen verkar du ha nån portabel enhet som typ usb minne inkopplad eller dyl så kör flashdisinfector på den

Ladda ner Flash Disinfector by sUBs till Skrivbordet:

http://download.bleepingcomputer.com/sUBs/...Disinfector.exe

Dubbelklicka på den nedladdade filen för att starta programmet.

Följ de anvisningar som kommer upp.

När det står att du ska sätta in flash-diskar så stoppar du in de USB-minnen etc som kan tänkas vara infekterade.

När allt är klart så avsluta programmet och starta om datorn.

Vi nöjer oss med detta så länge

Mvh MrO

simmesimme · Oktober 4, 2009

Ok där fick vi fram lite mer skit som skulle bort,mycket bra!

Det finns dock några filer som jag vill kolla upp så vi fortsätter!

Surfa till http://www.virustotal.com (fungerar bäst med Internet Explorer) klistra in ett av följande filnamn i rutan,

Menar du så här?

C:\efbcmkj.exe

File 13BAE29E006982B216D20000AF12050031244544.exe received on 2009.10.03 00:06:18 (UTC)

Current status: finished

Result: 8/41 (19.51%)

Compact Print results Antivirus Version Last Update Result

a-squared 4.5.0.24 2009.10.02 -

AhnLab-V3 5.0.0.2 2009.10.02 -

AntiVir 7.9.1.27 2009.10.02 -

Antiy-AVL 2.0.3.7 2009.10.02 -

Authentium 5.1.2.4 2009.10.02 -

Avast 4.8.1351.0 2009.10.02 -

AVG 8.5.0.420 2009.10.02 -

BitDefender 7.2 2009.10.03 -

CAT-QuickHeal 10.00 2009.10.01 (Suspicious) - DNAScan

ClamAV 0.94.1 2009.10.02 -

Comodo 2495 2009.10.03 -

DrWeb 5.0.0.12182 2009.10.03 -

eSafe 7.0.17.0 2009.10.01 Suspicious File

eTrust-Vet 31.6.6774 2009.10.02 Win32/Krypnek!packed

F-Prot 4.5.1.85 2009.10.02 -

F-Secure 8.0.14470.0 2009.10.02 -

Fortinet 3.120.0.0 2009.10.02 -

GData 19 2009.10.03 -

Ikarus T3.1.1.72.0 2009.10.02 -

Jiangmin 11.0.800 2009.09.27 -

K7AntiVirus 7.10.858 2009.10.01 -

Kaspersky 7.0.0.125 2009.10.03 -

McAfee 5759 2009.10.02 -

McAfee+Artemis 5759 2009.10.02 Suspect-29!4DAB00BB9D07

McAfee-GW-Edition 6.8.5 2009.10.02 -

Microsoft 1.5101 2009.10.02 Trojan:Win32/Harnig.gen!D

NOD32 4477 2009.10.02 a variant of Win32/Kryptik.APO

Norman 6.01.09 2009.10.02 -

nProtect 2009.1.8.0 2009.10.02 -

Panda 10.0.2.2 2009.10.02 Suspicious file

PCTools 4.4.2.0 2009.10.02 -

Prevx 3.0 2009.10.03 -

Rising 21.49.22.00 2009.09.30 -

Sophos 4.45.0 2009.10.02 -

Sunbelt 3.2.1858.2 2009.10.02 -

Symantec 1.4.4.12 2009.10.03 -

TheHacker 6.5.0.2.027 2009.10.02 -

TrendMicro 8.950.0.1094 2009.10.02 -

VBA32 3.12.10.11 2009.10.03 BScope.Win32.AntiAV

ViRobot 2009.10.2.1968 2009.10.02 -

VirusBuster 4.6.5.0 2009.10.02 -

C:\hufa.exe

File bxim.exe received on 2009.10.04 11:41:11 (UTC)

Current status: finished

Result: 16/41 (39.02%)

Compact Print results Antivirus Version Last Update Result

a-squared 4.5.0.24 2009.10.04 -

AhnLab-V3 5.0.0.2 2009.10.03 -

AntiVir 7.9.1.27 2009.10.02 TR/Dropper.Gen

Antiy-AVL 2.0.3.7 2009.10.04 -

Authentium 5.1.2.4 2009.10.03 W32/NewRest.A2.gen!Eldorado

Avast 4.8.1351.0 2009.10.03 Win32:Neredr

AVG 8.5.0.420 2009.10.04 -

BitDefender 7.2 2009.10.04 Gen:Trojan.Heur.Rustock.1

CAT-QuickHeal 10.00 2009.10.03 -

ClamAV 0.94.1 2009.10.03 -

Comodo 2510 2009.10.04 -

DrWeb 5.0.0.12182 2009.10.04 -

eSafe 7.0.17.0 2009.10.01 -

eTrust-Vet 31.6.6774 2009.10.02 -

F-Prot 4.5.1.85 2009.10.03 W32/NewRest.A2.gen!Eldorado

F-Secure 8.0.14470.0 2009.10.03 Backdoor.Win32.NewRest.bc

Fortinet 3.120.0.0 2009.10.04 -

GData 19 2009.10.04 Gen:Trojan.Heur.Rustock.1

Ikarus T3.1.1.72.0 2009.10.04 Trojan-Dropper.Win32.Rustock

Jiangmin 11.0.800 2009.10.04 -

K7AntiVirus 7.10.861 2009.10.03 -

Kaspersky 7.0.0.125 2009.10.04 Backdoor.Win32.NewRest.bc

McAfee 5760 2009.10.03 -

McAfee+Artemis 5760 2009.10.03 Suspect-29!945A56465C32

McAfee-GW-Edition 6.8.5 2009.10.04 Heuristic.BehavesLike.Win32.Dropper.H

Microsoft 1.5101 2009.10.04 TrojanDropper:Win32/Rustock.J

NOD32 4478 2009.10.03 a variant of Win32/Rustock.NKU

Norman 6.01.09 2009.10.04 -

nProtect 2009.1.8.0 2009.10.04 -

Panda 10.0.2.2 2009.10.04 -

PCTools 4.4.2.0 2009.10.04 -

Prevx 3.0 2009.10.04 Medium Risk Malware

Rising 21.49.22.00 2009.09.30 -

Sophos 4.45.0 2009.10.04 Mal/RusDrp-A

Sunbelt 3.2.1858.2 2009.10.03 Trojan.Win32.Generic!BT

Symantec 1.4.4.12 2009.10.04 -

TheHacker 6.5.0.2.028 2009.10.03 -

TrendMicro 8.950.0.1094 2009.10.04 -

VBA32 3.12.10.11 2009.10.03 -

ViRobot 2009.10.2.1968 2009.10.02 -

VirusBuster 4.6.5.0 2009.10.03 -

C:\ehrrg.exe

File 447b04effdb70cdf7ba626c0f62ad920 received on 2009.10.04 11:57:40 (UTC)

Current status: finished

Result: 2/41 (4.88%)

Compact Print results Antivirus Version Last Update Result

a-squared 4.5.0.24 2009.10.04 -

AhnLab-V3 5.0.0.2 2009.10.03 -

AntiVir 7.9.1.27 2009.10.02 -

Antiy-AVL 2.0.3.7 2009.10.04 -

Authentium 5.1.2.4 2009.10.03 -

Avast 4.8.1351.0 2009.10.03 -

AVG 8.5.0.420 2009.10.04 -

BitDefender 7.2 2009.10.04 -

CAT-QuickHeal 10.00 2009.10.03 -

ClamAV 0.94.1 2009.10.03 -

Comodo 2510 2009.10.04 -

DrWeb 5.0.0.12182 2009.10.04 -

eSafe 7.0.17.0 2009.10.01 -

eTrust-Vet 31.6.6774 2009.10.02 -

F-Prot 4.5.1.85 2009.10.03 -

F-Secure 8.0.14470.0 2009.10.03 -

Fortinet 3.120.0.0 2009.10.04 -

GData 19 2009.10.04 -

Ikarus T3.1.1.72.0 2009.10.04 -

Jiangmin 11.0.800 2009.10.04 -

K7AntiVirus 7.10.861 2009.10.03 -

Kaspersky 7.0.0.125 2009.10.04 -

McAfee 5760 2009.10.03 -

McAfee+Artemis 5760 2009.10.03 -

McAfee-GW-Edition 6.8.5 2009.10.04 Trojan.Dropper.Gen

Microsoft 1.5101 2009.10.04 -

NOD32 4478 2009.10.03 -

Norman 6.01.09 2009.10.04 -

nProtect 2009.1.8.0 2009.10.04 -

Panda 10.0.2.2 2009.10.04 -

PCTools 4.4.2.0 2009.10.04 -

Prevx 3.0 2009.10.04 High Risk Cloaked Malware

Rising 21.49.22.00 2009.09.30 -

Sophos 4.45.0 2009.10.04 -

Sunbelt 3.2.1858.2 2009.10.03 -

Symantec 1.4.4.12 2009.10.04 -

TheHacker 6.5.0.2.028 2009.10.03 -

TrendMicro 8.950.0.1094 2009.10.04 -

VBA32 3.12.10.11 2009.10.03 -

ViRobot 2009.10.2.1968 2009.10.02 -

VirusBuster 4.6.5.0 2009.10.03 -

simmesimme · Oktober 4, 2009

Cool, har gjort flashdisinfector också.

/S

MrO · Oktober 4, 2009

Ok bra! Dessa filer var elakingar så starta om datorn i felsäkert läge o ta bort dessa om det går,annars får vi ta dom med combo

C:\efbcmkj.exe

C:\hufa.exe

C:\ehrrg.exe

Sen tar jag natt så vi får fortsätta im,använd datorn minmalt tills vi är färdiga!

Mvh MrO

Redigerad Oktober 4, 2009 av MrO

simmesimme · Oktober 4, 2009

Ok bra! Dessa filer var elakingar så starta om datorn i felsäkert läge o ta bort dessa om det går,annars får vi ta dom med combo
C:\efbcmkj.exe

C:\hufa.exe

C:\ehrrg.exe

Sen tar jag natt så vi får fortsätta im,använd datorn minmalt tills vi är färdiga!

Mvh MrO

Låter hur bra som helst.

Jag hittade dessa

C:\efbcmkj.exe

C:\hufa.exe

C:\ehrrg.exe

i "den här datorn" och de gick att slänga i papperskorgen och tömde. Räcker det för att de ska vara borta?

Hur som helst, stort tack för idag!! Otroligt vad man kan få hjälp här.

Sov gott!

/S

simmesimme · Oktober 4, 2009

Körde en till hijack efter att jag tagit bort dessa

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:13:12 AM, on 10/05/2009