AVG kunde inte ta bort detta

kemsi · December 17, 2012

Hej igen!

Nu var det ett tag sen jag var förbi här och det är väl ett gott tecken
Nu är det så att mitt vanliga anti virus program vanligen tar bort det mesta, men nu fick man 2 "infected files" som ej kunde tas bort av mitt AVG anit-virus;

"";"The file is signed with a broken digital signature, issued by: DT Soft Ltd., C:\Users\Simton\AppData\Local\Temp\is1598539481\2559086_Setup.DAT";"Infected"

"";"The file is signed with a broken digital signature, issued by: DT Soft Ltd., C:\Users\Simton\Downloads\DTLite4454-0315.exe";"Infected"

så jag tänkte att det är väl lika bra att posta en hijackthis log och kolla läget:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 01:02:13, on 2012-12-17
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Personal\bin\Personal.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Simton\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylo...000f46d0466e5af
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ADDICT-THING - {31952F05-C6BA-DF50-CCA8-0FBD4679991F} - C:\ProgramData\ADDICT-THING\bhoclass.dll
O2 - BHO: Web Assistant Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (file missing)
O2 - BHO: uTorrentControl2 - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll
O2 - BHO: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll
O3 - Toolbar: Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll
O3 - Toolbar: uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll
O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunesHelper.exe"
O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKCU\..\Run: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program Files (x86)\Personal\bin\Personal.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~3\browse~1\25911~1.18\{c16c1~1\mngr.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Tjänsten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Tjänsten Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9289 bytes

Mvh simon!

PCfreak · December 17, 2012

De verkar vara DEMON Tool Lite du laddat ner. http://all-shares.com/folder/25951655/dtlite-4454-0315

Cecilia · December 17, 2012

Jag håller med PCfreak angående vad AVG hittade, men där finns ett antal skadliga/olämpliga tillägg i Internet Explorer enligt loggen. Dessa bör tas bort. Det är stor sannolikhet att något av dem finns i Firefox också men eftersom HijackThis är så gammalt visar det inget som har med Firefox att göra. Bland annat därför använder vi inte HijackThis längre utan DDS.

Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

kemsi · December 17, 2012

Jaså

Attach.txt

tack för infon! avinstallerade demon tools samt hijackthis och lägger upp DDS loggen här:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_29

Run by Simton at 23:27:48 on 2012-12-17

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.46.1033.18.8173.6970 [GMT 1:00]

.

AV: AVG Anti-Virus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG Anti-Virus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG2013\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\iTunesHelper.exe

C:\Program Files (x86)\AVG\AVG2013\avgui.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.babylon.com/?affID=112059&tt=4912_6&babsrc=HP_ss&mntrId=6a2e753e000000000000f46d0466e5af

uURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll

mURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll

mWinlogon: Userinit = userinit.exe

BHO: ADDICT-THING Class: {31952F05-C6BA-DF50-CCA8-0FBD4679991F} - C:\ProgramData\ADDICT-THING\bhoclass.dll

BHO: Web Assistant: {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

BHO: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll

BHO: Incredibar.com Helper Object: {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

TB: uTorrentControl2 Toolbar: {687578B9-7132-4A7A-80E4-30EE31099E03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll

TB: Incredibar Toolbar: {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll

TB: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTo0.dll

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunesHelper.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

StartupFolder: C:\Users\Simton\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BANKID~1.LNK - C:\Program Files (x86)\Personal\bin\Personal.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 85.8.31.209 79.138.0.180

TCP: Interfaces\{7BE3653C-FFA6-4078-A512-1393FFD7B9FD} : DHCPNameServer = 85.8.31.209 79.138.0.180

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

AppInit_DLLs= c:\progra~3\browse~1\25911~1.18\{c16c1~1\mngr.dll

SSODL: WebCheck - <orphaned>

x64-BHO: Web Assistant: {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll

x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Simton\AppData\Roaming\Mozilla\Firefox\Profiles\wiiym6vl.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - uTorrentControl2 Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Plugins\npitunes.dll

FF - plugin: C:\Program Files (x86)\Personal\bin\np_prsnl.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll

FF - plugin: C:\Users\Simton\AppData\Roaming\Mozilla\Firefox\Profiles\wiiym6vl.default\extensions\battlefieldheroespatcher@ea.com\plugins\npBFHUpdater.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyCb1Unhd&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - 6a2e753e000000000000f46d0466e5af

FF - user.js: extensions.incredibar_i.instlDay - 15477

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.141:18:57

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6OyCb1Unhd

FF - user.js: extensions.incredibar_i.upn2n - 92261427968062711

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10650

FF - user.js: extensions.incredibar_i.ppd - 20%5F5

FF - user.js: extentions.y2layers.installId - de9f5410-7329-42b1-8c6f-5276ad4bc0c5

FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,

FF - user.js: extensions.autoDisableScopes - 14

FF - user.js: security.csp.enable - false

FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=6a2e753e000000000000f46d0466e5af&q=

FF - user.js: extensions.BabylonToolbar.id - 6a2e753e000000000000f46d0466e5af

FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}

FF - user.js: extensions.BabylonToolbar.instlDay - 15678

FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.4.9

FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.4.9

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.4.917:33:46

FF - user.js: extensions.BabylonToolbar.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar.tlbrId - base

FF - user.js: extensions.BabylonToolbar.instlRef - sst

FF - user.js: extensions.BabylonToolbar.dfltLng - en

FF - user.js: extensions.BabylonToolbar_i.excTlbr - false

FF - user.js: extensions.BabylonToolbar.excTlbr - false

FF - user.js: extensions.BabylonToolbar.admin - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112059&tt=4912_6

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar.autoRvrt - false

FF - user.js: extensions.BabylonToolbar.rvrt - false

FF - user.js: extensions.BabylonToolbar_i.newTab - false

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]

R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-10-5 111456]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]

R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]

R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-12-4 283200]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-9-28 239616]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-6 5814392]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-1 13592]

R2 Web Assistant Updater;Web Assistant Updater;C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [2012-5-18 185856]

R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-6-2 128488]

R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-6-2 401896]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-5-14 96896]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-11-1 539240]

R3 Tdsshbecr;Handelsbanken card reader;C:\Windows\System32\drivers\shbecr.sys [2011-11-15 50176]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]

.

=============== Created Last 30 ================

.

2012-12-16 14:25:39 -------- d-----w- C:\Users\Simton\AppData\Roaming\AVG2013

2012-12-16 14:23:42 -------- d-----w- C:\Users\Simton\AppData\Roaming\TuneUp Software

2012-12-16 14:21:49 -------- d-----w- C:\ProgramData\AVG2013

2012-12-16 14:19:59 -------- d-----w- C:\Users\Simton\AppData\Local\MFAData

2012-12-16 14:19:59 -------- d-----w- C:\Users\Simton\AppData\Local\Avg2013

2012-12-09 23:46:02 -------- d-----w- C:\Users\Simton\AppData\Local\My Games

2012-12-09 20:54:06 -------- d-----w- C:\ProgramData\Orbit

2012-12-09 20:46:11 -------- d-----w- C:\Users\Simton\AppData\Local\Ubisoft Game Launcher

2012-12-04 16:53:37 283200 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys

2012-12-04 16:53:33 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Pro

2012-12-04 16:33:31 -------- d-----w- C:\Users\Simton\AppData\Roaming\Babylon

2012-12-04 16:33:31 -------- d-----w- C:\ProgramData\Babylon

2012-11-24 15:26:57 -------- d-----w- C:\Users\Simton\AppData\Local\ESN

.

==================== Find3M ====================

.

2012-12-16 15:59:28 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2012-12-16 15:59:28 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2012-12-15 13:10:36 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2012-12-09 20:41:43 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2012-10-22 12:02:44 154464 ----a-w- C:\Windows\System32\drivers\avgidsdrivera.sys

2012-10-15 02:48:50 63328 ----a-w- C:\Windows\System32\drivers\avgidsha.sys

2012-10-05 02:32:50 111456 ----a-w- C:\Windows\System32\drivers\avgmfx64.sys

2012-10-02 02:30:38 185696 ----a-w- C:\Windows\System32\drivers\avgldx64.sys

2012-09-28 14:37:02 221696 ----a-w- C:\Windows\System32\clinfo.exe

2012-09-28 14:36:44 75776 ----a-w- C:\Windows\System32\OpenVideo64.dll

2012-09-28 14:36:40 65536 ----a-w- C:\Windows\SysWow64\OpenVideo.dll

2012-09-28 14:36:36 63488 ----a-w- C:\Windows\System32\OVDecode64.dll

2012-09-28 14:36:34 56320 ----a-w- C:\Windows\SysWow64\OVDecode.dll

2012-09-28 14:36:24 32635904 ----a-w- C:\Windows\System32\amdocl64.dll

2012-09-28 14:32:16 27341824 ----a-w- C:\Windows\SysWow64\amdocl.dll

2012-09-28 02:23:00 5557928 ----a-w- C:\Windows\SysWow64\atiumdag.dll

2012-09-28 02:21:20 10697216 ----a-w- C:\Windows\System32\drivers\atikmdag.sys

2012-09-28 02:05:38 70144 ----a-w- C:\Windows\System32\coinst_9.002.dll

2012-09-28 02:03:52 163840 ----a-w- C:\Windows\System32\atiapfxx.exe

2012-09-28 02:02:30 51200 ----a-w- C:\Windows\System32\aticalrt64.dll

2012-09-28 02:02:28 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll

2012-09-28 02:02:22 44544 ----a-w- C:\Windows\System32\aticalcl64.dll

2012-09-28 02:02:20 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll

2012-09-28 02:02:08 16082432 ----a-w- C:\Windows\System32\aticaldd64.dll

2012-09-28 01:59:56 23825920 ----a-w- C:\Windows\System32\atio6axx.dll

2012-09-28 01:57:20 13703168 ----a-w- C:\Windows\SysWow64\aticaldd.dll

2012-09-28 01:43:28 935424 ----a-w- C:\Windows\SysWow64\aticfx32.dll

2012-09-28 01:41:40 1120768 ----a-w- C:\Windows\System32\aticfx64.dll

2012-09-28 01:41:14 19624960 ----a-w- C:\Windows\SysWow64\atioglxx.dll

2012-09-28 01:39:36 6536192 ----a-w- C:\Windows\SysWow64\atidxx32.dll

2012-09-28 01:39:14 442368 ----a-w- C:\Windows\System32\atidemgy.dll

2012-09-28 01:39:08 538112 ----a-w- C:\Windows\System32\atieclxx.exe

2012-09-28 01:38:16 239616 ----a-w- C:\Windows\System32\atiesrxx.exe

2012-09-28 01:36:50 120320 ----a-w- C:\Windows\System32\atitmm64.dll

2012-09-28 01:36:36 21504 ----a-w- C:\Windows\System32\atimuixx.dll

2012-09-28 01:36:30 59392 ----a-w- C:\Windows\System32\atiedu64.dll

2012-09-28 01:36:26 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll

2012-09-28 01:31:26 3127296 ----a-w- C:\Windows\System32\atiumd6a.dll

2012-09-28 01:25:24 6704640 ----a-w- C:\Windows\System32\atiumd64.dll

2012-09-28 01:22:42 7167488 ----a-w- C:\Windows\System32\atidxx64.dll

2012-09-28 01:22:30 2691584 ----a-w- C:\Windows\SysWow64\atiumdva.dll

2012-09-28 01:13:40 595456 ----a-w- C:\Windows\System32\atiadlxx.dll

2012-09-28 01:13:30 405504 ----a-w- C:\Windows\SysWow64\atiadlxy.dll

2012-09-28 01:13:16 17920 ----a-w- C:\Windows\System32\atig6pxx.dll

2012-09-28 01:13:12 14848 ----a-w- C:\Windows\SysWow64\atiglpxx.dll

2012-09-28 01:13:12 14848 ----a-w- C:\Windows\System32\atiglpxx.dll

2012-09-28 01:13:08 41984 ----a-w- C:\Windows\System32\atig6txx.dll

2012-09-28 01:13:00 33280 ----a-w- C:\Windows\SysWow64\atigktxx.dll

2012-09-28 01:12:58 56320 ----a-w- C:\Windows\System32\atimpc64.dll

2012-09-28 01:12:58 56320 ----a-w- C:\Windows\System32\amdpcom64.dll

2012-09-28 01:12:52 460288 ----a-w- C:\Windows\System32\drivers\atikmpag.sys

2012-09-28 01:12:48 56832 ----a-w- C:\Windows\SysWow64\atimpc32.dll

2012-09-28 01:12:48 56832 ----a-w- C:\Windows\SysWow64\amdpcom32.dll

2012-09-28 01:11:22 129536 ----a-w- C:\Windows\System32\atiuxp64.dll

2012-09-28 01:11:16 109568 ----a-w- C:\Windows\SysWow64\atiuxpag.dll

2012-09-28 01:11:08 103424 ----a-w- C:\Windows\System32\atiu9p64.dll

2012-09-28 01:10:58 82944 ----a-w- C:\Windows\SysWow64\atiu9pag.dll

2012-09-28 01:09:48 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll

2012-09-21 02:46:04 200032 ----a-w- C:\Windows\System32\drivers\avgtdia.sys

2012-09-21 02:46:00 225120 ----a-w- C:\Windows\System32\drivers\avgloga.sys

2012-09-09 21:30:38 293776 ----a-w- C:\Program Files (x86)\iTunesOutlookAddIn.dll

2012-09-09 21:30:34 421776 ----a-w- C:\Program Files (x86)\iTunesHelper.exe

2012-09-09 21:30:34 403344 ----a-w- C:\Program Files (x86)\iTunesAdmin.dll

2012-09-09 21:30:34 156560 ----a-w- C:\Program Files (x86)\iTunesHelper.dll

2012-09-09 21:30:28 9777040 ----a-w- C:\Program Files (x86)\iTunes.exe

2012-09-09 21:30:24 21131152 ----a-w- C:\Program Files (x86)\iTunes.dll

2012-09-09 21:30:22 776216 ----a-w- C:\Program Files (x86)\gnsdk_sdkmanager.dll

2012-09-09 21:30:22 3008536 ----a-w- C:\Program Files (x86)\gnsdk_dsp.dll

2012-09-09 21:30:22 262680 ----a-w- C:\Program Files (x86)\gnsdk_submit.dll

2012-09-09 21:30:22 219672 ----a-w- C:\Program Files (x86)\gnsdk_musicid.dll

2012-08-08 17:15:32 112528 ----a-w- C:\Program Files (x86)\ITDetector.ocx

.

============= FINISH: 23:28:02,03 ===============

p.s vet inte om jag lyckades bifoga attach loggen rätt

Tack på förhand

Cecilia · December 17, 2012

Du har bifogat en Attach.txt men den hör till en XP-dator och inte till denna dator med Windows 7.

Avinstallera:

Web Assistant se http://www.systemlookup.com/CLSID/75477-Extension32_dll_Extension64_dll.html

Yontoo http://www.systemlookup.com/CLSID/56875-YontooIEClient_dll_YontooIEClient_2_dll.html

uTorrentControl2 Toolbar http://www.systemlookup.com/CLSID/74052-tbuTor_dll_tbuTo0_dll_tbuTo1_dll_tbuTo2_dll_prxtbuTor_dll_prxtbuTo0_dll_prxtbuTo1_dll_prxtbuTo2_dll.html

Incredibar Toolbar http://www.systemlookup.com/CLSID/74602-incredibarTlbr_dll.html

ADDICT-THING se http://www.mywot.com/en/scorecard/addictthing.com?utm_source=addon&utm_content=popup

Java 6 Update 29, för det är en gammal version med kända säkerhetshål som gör det lätt att infektera datorn från en webbsida.

Starta om datorn.

Kör DDS och klistra in båda loggarna så får vi se vad som återstår.

kemsi · December 18, 2012

Det var underligt! jag tror jag fick bort alla angivna program, startade om och detta som resultat: