EZ YouTube Video Downloader återkommer

[JoWa]

Hej,

 

Försöker att hjälpa en användare med Windows 7 HP SP1, 64-bit.

 

Problemet, eller symptomet, är som rubriken säger att EZ YouTube Video Downloader från XtensionPlus, som är ett tillägg för Internet Explorer, automatiskt återinstalleras någon dag efter att det har avinstallerats.

 

Detta händer: EZ YouTube Video Downloader avinstaleras på vanligt sätt, och jag konstaterar i Autoruns att den autostartande (BHO) yvd.dll är borta. Efter en avinstallation kan datorn startas ett par gånger utan att programmet installeras. Men sedan händer det. I samma stund som Windows startas hämtas installationsprogrammet Setup_EZ_YouTube_Video_Downloader_v[versionsummer].exe till den dolda och skyddade mappen C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5. Där finns nu tre exemplar av version 1.8 (jag rensade mappen för några dagar sedan). Filen finns även i den dolda mappen C:\ProgramData, där den hamnar en minut senare än i den förra mappen.

 

VT-länk: https://www.virustotal.com/sv/file/61edd1db69abe3aa0eb39bb15b15bbc3da76dac2d84a1ec33e26d0f4722a97ae/analysis/1399536547/

 

Dubbelklickar jag på installationsprogrammet dyker förstås UAC upp, men bevisligen installeras programmet automatiskt utan att UAC (som f.n. är inställt på högsta nivå) är inblandat.

 

Jag ser inga okända processer i Process Explorer, och inga konstiga saker i Autoruns. MBAM och MSE rapporterar inget misstänkt.

 

Tidigare har jag med AdwCleaner rensat bort Qone8 ur denna dator. Användaren lurades för några veckor sedan att köra ett program i tron att det var ett dokument, och det var nog upprinnelsen till både Qone8 och EZ YouTube Video Downloader.

 

Kan tillägga att IE automatiskt inaktiverar tillägget av kompatibilitetsskäl (utökat kernelläge är aktiverat), och att användaren inte använder IE.

 

Vad laddar ned installationsprogrammet, och hur kan det installeras utan att UAC ställer sig i vägen?

[Cecilia]

Hej!

Hittar AdwCleaner något nu?

Skulle kunna vara en tjänst som går med admin-rättigheter och därför inte utlöser UAC och använder systemets "temporary internet files".

Vi kan ju se om det går att se något med FRST.

Ladda ner Farbar Recovery Scan Tool (FRST) och spara på skrivbordet.

För 64-bitars Windows: http://download.bleepingcomputer.com/farbar/FRST64.exe

För 32-bitars Windows: http://download.bleepingcomputer.com/farbar/FRST.exe

Starta FRST.

Läs villkoren för programmet.

Klicka på Yes för att acceptera.

Klicka på Scan-knappen.

När det är klart kommer det att ha skapats två loggar FRST.txt och Addition.txt på skrivbordet.

Klistra in innehållet i FRST.txt i ditt svar (använd Spoiler-taggen) och bifoga Addition.txt, tack.

[JoWa]

Tack Cecilia.

 

Det enda AdwCleaner nu rapporterar är \AppData\Local\Google\Chrome\User Data\Default\preferences. Där fanns tidigare Qone8 som alternativ startsida.

 

Jag ser inga skumma tjänster i fliken Services i Autoruns. winupdsvc.exe är den enda som inte är signerad.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-05-2014 01
Ran by Rolf (administrator) on MIRAMIS on 08-05-2014 11:00:21
Running from C:\Users\Rolf\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\Security Updates Service\winupdsvc.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Sysinternals - www.sysinternals.com) C:\Users\Rolf\Desktop\Underhåll\autoruns.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKU\S-1-5-19\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-107118600-2098976365-1404987161-1001\...\Run: [GoogleChromeAutoLaunch_9D147A164E0872CEC80D6EF452C567FA] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032 2014-04-24] (Google Inc.)
HKU\S-1-5-21-107118600-2098976365-1404987161-1001\...\MountPoints2: G - G:\iStudio.exe
HKU\S-1-5-21-107118600-2098976365-1404987161-1001\...\MountPoints2: {15de1711-b43f-11e3-812a-00110906572f} - H:\iStudio.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.se/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
BHO-x32: EZ YouTube Video Downloader 1.0 - {FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} - C:\Program Files (x86)\EZ YouTube Video Downloader\yvd.dll (XtensionPlus)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]
FF HKLM-x32\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]

Chrome:
=======
CHR HomePage: hxxp://www.comodo.com/
CHR StartupUrls: "startup_urls_migration_time": "13034950958620117"
CHR Extension: (Google Dokument) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-23]
CHR Extension: (Google Drive) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-23]
CHR Extension: (YouTube) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-23]
CHR Extension: (Sök på Google) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-23]
CHR Extension: (Google+) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlppkpafhbajpcmmoheippocdidnckmm [2014-01-23]
CHR Extension: (Google Kalender) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-01-23]
CHR Extension: (HTTPS Everywhere) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-01-23]
CHR Extension: (AdBlock) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-23]
CHR Extension: (Google Keep) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2014-04-28]
CHR Extension: (Gradient) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipehkhefmnpkdbcpgbononhiohcabocp [2014-01-28]
CHR Extension: (Google Maps) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-01-23]
CHR Extension: (Hangouts) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2014-01-23]
CHR Extension: (Google Wallet) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-23]
CHR Extension: (Picasa) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2014-01-23]
CHR Extension: (Gmail) - C:\Users\Rolf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-23]

==================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S4 Net iD Trace; C:\Program Files\Net iD\iid.exe [163072 2014-03-04] (SecMaker AB)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 Security Updates Service; C:\Program Files (x86)\Security Updates Service\winupdsvc.exe [2015232 2014-04-15] ()

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC64.SYS [3491616 2009-06-18] (Realtek Semiconductor Corp.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation )

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 11:00 - 2014-05-08 11:00 - 00008618 _____ () C:\Users\Rolf\Desktop\FRST.txt
2014-05-08 11:00 - 2014-05-08 11:00 - 00000000 ____D () C:\FRST
2014-05-08 10:58 - 2014-04-15 12:57 - 02015232 _____ () C:\Users\Rolf\Desktop\winupdsvc.exe
2014-05-08 10:56 - 2014-05-08 10:56 - 02063872 _____ (Farbar) C:\Users\Rolf\Desktop\FRST64.exe
2014-05-08 10:03 - 2014-05-08 10:03 - 00002976 _____ () C:\Users\Rolf\Desktop\install.txt
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\Security Updates Service
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-05-08 09:24 - 2014-05-08 09:25 - 02500744 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe
2014-05-08 09:24 - 2014-05-08 09:24 - 00000056 _____ () C:\Windows\setupact.log
2014-05-08 09:24 - 2014-05-08 09:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-06 09:50 - 2014-05-06 09:51 - 00000000 ____D () C:\Users\Rolf\Downloads\download
2014-05-06 09:41 - 2014-05-06 09:49 - 330513961 _____ () C:\Users\Rolf\Downloads\download.zip
2014-05-02 06:58 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-02 06:58 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 06:58 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-02 06:58 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 08:41 - 2014-04-30 08:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-30 08:39 - 2014-04-30 08:39 - 00001474 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk
2014-04-30 08:39 - 2014-04-30 08:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-04-30 08:38 - 2014-04-30 08:39 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
2014-04-29 08:50 - 2014-04-29 08:50 - 00000000 ____D () C:\Users\Rolf\Desktop\Underhåll
2014-04-29 08:31 - 2014-04-29 08:32 - 00550371 _____ () C:\Users\Rolf\Downloads\Autoruns.zip
2014-04-28 09:50 - 2014-04-28 09:50 - 00001031 _____ () C:\Users\Public\Desktop\foobar2000.lnk
2014-04-28 07:28 - 2014-04-28 07:28 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-04-28 07:24 - 2014-04-28 07:24 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-28 07:23 - 2014-04-28 09:27 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Samsung
2014-04-28 07:23 - 2014-04-28 09:27 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Samsung
2014-04-28 07:23 - 2014-04-28 07:23 - 00000000 ____D () C:\Users\Rolf\Documents\samsung
2014-04-28 07:21 - 2014-01-23 18:23 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\SysWOW64\Redemption.dll
2014-04-28 07:21 - 2014-01-23 18:23 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2014-04-28 07:20 - 2014-04-28 09:27 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-04-28 07:19 - 2014-04-28 07:19 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Downloaded Installations
2014-04-28 07:16 - 2014-04-28 07:16 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-04-28 07:09 - 2014-04-28 07:09 - 00000000 ____D () C:\Program Files (x86)\wow search
2014-04-26 17:12 - 2014-05-08 09:38 - 00478188 _____ () C:\Windows\WindowsUpdate.log
2014-04-25 08:34 - 2014-04-25 08:34 - 00002536 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gmail (1).lnk
2014-04-25 08:34 - 2014-04-25 08:34 - 00002506 _____ () C:\Users\Rolf\Desktop\Gmail.lnk
2014-04-25 08:24 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-25 08:23 - 2014-05-06 10:04 - 00000000 ____D () C:\AdwCleaner
2014-04-25 07:58 - 2014-05-08 09:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-25 07:58 - 2014-04-25 07:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-25 07:57 - 2014-04-25 07:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-25 07:57 - 2014-04-25 07:57 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-25 07:57 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-25 07:57 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-25 07:57 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-25 07:30 - 2014-04-25 07:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-25 07:30 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-25 07:30 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-23 18:40 - 2014-04-23 18:41 - 00001774 _____ () C:\Users\Rolf\Desktop\Google Chrome.lnk
2014-04-23 17:24 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-23 17:24 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-23 17:23 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-23 17:23 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-23 17:23 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-23 17:23 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-23 17:23 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-23 17:23 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-23 17:23 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-23 17:23 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-23 17:23 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-23 17:23 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-23 17:23 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-23 17:23 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-23 17:23 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-23 17:23 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-23 17:23 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-23 17:23 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-23 17:23 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-23 17:23 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 17:23 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-23 17:23 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-23 17:23 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-23 17:23 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-23 17:23 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-23 17:23 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-23 17:23 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-23 17:23 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-23 17:23 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-23 17:23 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-23 17:23 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 17:23 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-23 17:23 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-23 17:23 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-23 17:23 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-23 17:23 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-23 17:23 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-23 17:23 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-23 17:23 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-23 17:23 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 17:23 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-23 17:23 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-23 17:23 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-23 17:23 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-20 19:50 - 2014-04-20 19:50 - 00030720 _____ () C:\Users\Rolf\Downloads\Каталог-BANDO.xls
2014-04-19 19:29 - 2014-04-19 19:29 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLibG64.sys
2014-04-19 18:25 - 2014-05-08 09:25 - 00001528 _____ () C:\prefs.js
2014-04-19 17:54 - 2014-04-19 17:54 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\APRILIA SCARABEO 200 IE user guide
2014-04-11 10:43 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-11 10:43 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-11 10:43 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-11 10:43 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-11 10:43 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-11 10:43 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-11 10:43 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-11 10:43 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-11 10:43 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-11 10:43 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-11 10:43 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-11 10:43 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-11 10:43 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-11 10:43 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-11 10:43 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-11 10:43 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 11:56 - 2014-04-09 11:56 - 00000000 __SHD () C:\Users\Rolf\AppData\Local\EmieUserList
2014-04-09 11:56 - 2014-04-09 11:56 - 00000000 __SHD () C:\Users\Rolf\AppData\Local\EmieSiteList
2014-04-09 06:56 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

==================== One Month Modified Files and Folders =======

2014-05-08 11:00 - 2014-05-08 11:00 - 00008618 _____ () C:\Users\Rolf\Desktop\FRST.txt
2014-05-08 11:00 - 2014-05-08 11:00 - 00000000 ____D () C:\FRST
2014-05-08 10:56 - 2014-05-08 10:56 - 02063872 _____ (Farbar) C:\Users\Rolf\Desktop\FRST64.exe
2014-05-08 10:44 - 2011-04-12 16:28 - 00591018 _____ () C:\Windows\system32\perfh01D.dat
2014-05-08 10:44 - 2011-04-12 16:28 - 00115908 _____ () C:\Windows\system32\perfc01D.dat
2014-05-08 10:44 - 2009-07-14 07:13 - 01378806 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-08 10:05 - 2014-01-23 13:41 - 00000990 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-08 10:03 - 2014-05-08 10:03 - 00002976 _____ () C:\Users\Rolf\Desktop\install.txt
2014-05-08 09:43 - 2014-04-25 07:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-08 09:38 - 2014-04-26 17:12 - 00478188 _____ () C:\Windows\WindowsUpdate.log
2014-05-08 09:31 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-08 09:31 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\Security Updates Service
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-05-08 09:25 - 2014-05-08 09:24 - 02500744 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe
2014-05-08 09:25 - 2014-04-19 18:25 - 00001528 _____ () C:\prefs.js
2014-05-08 09:24 - 2014-05-08 09:24 - 00000056 _____ () C:\Windows\setupact.log
2014-05-08 09:24 - 2014-05-08 09:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-08 09:24 - 2014-01-23 13:40 - 00000986 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-08 09:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 14:42 - 2014-01-23 14:13 - 00000000 ____D () C:\Users\Rolf\Documents\EBK
2014-05-06 19:57 - 2014-01-24 12:15 - 00139782 ____H () C:\Users\Rolf\sync.ffs_db
2014-05-06 19:57 - 2014-01-23 11:46 - 00000000 ____D () C:\Users\Rolf
2014-05-06 10:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Globalization
2014-05-06 10:04 - 2014-04-25 08:23 - 00000000 ____D () C:\AdwCleaner
2014-05-06 09:58 - 2014-01-24 10:23 - 00000934 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileSync.lnk
2014-05-06 09:58 - 2014-01-24 10:23 - 00000930 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealtimeSync.lnk
2014-05-06 09:58 - 2014-01-24 10:23 - 00000922 _____ () C:\Users\Public\Desktop\FreeFileSync.lnk
2014-05-06 09:51 - 2014-05-06 09:50 - 00000000 ____D () C:\Users\Rolf\Downloads\download
2014-05-06 09:49 - 2014-05-06 09:41 - 330513961 _____ () C:\Users\Rolf\Downloads\download.zip
2014-05-05 19:01 - 2014-01-23 14:15 - 00033739 _____ () C:\Users\Rolf\Documents\Faktura EBK 1.odt
2014-04-30 20:03 - 2014-01-23 13:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-30 08:42 - 2014-04-30 08:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-30 08:39 - 2014-04-30 08:39 - 00001474 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk
2014-04-30 08:39 - 2014-04-30 08:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-04-30 08:39 - 2014-04-30 08:38 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
2014-04-29 19:42 - 2014-01-23 14:15 - 00000000 ____D () C:\Users\Rolf\Documents\Vinklubben
2014-04-29 16:01 - 2014-05-02 06:58 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-02 06:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-02 06:58 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-02 06:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 08:50 - 2014-04-29 08:50 - 00000000 ____D () C:\Users\Rolf\Desktop\Underhåll
2014-04-29 08:32 - 2014-04-29 08:31 - 00550371 _____ () C:\Users\Rolf\Downloads\Autoruns.zip
2014-04-29 08:12 - 2014-01-23 13:38 - 00003534 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask
2014-04-28 09:50 - 2014-04-28 09:50 - 00001031 _____ () C:\Users\Public\Desktop\foobar2000.lnk
2014-04-28 09:50 - 2014-01-24 10:24 - 00001113 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
2014-04-28 09:50 - 2014-01-24 10:24 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\foobar2000
2014-04-28 09:50 - 2014-01-24 10:24 - 00000000 ____D () C:\Program Files (x86)\foobar2000
2014-04-28 09:27 - 2014-04-28 07:23 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Samsung
2014-04-28 09:27 - 2014-04-28 07:23 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Samsung
2014-04-28 09:27 - 2014-04-28 07:20 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-04-28 07:44 - 2014-01-23 13:43 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-appar
2014-04-28 07:28 - 2014-04-28 07:28 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-04-28 07:24 - 2014-04-28 07:24 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-28 07:23 - 2014-04-28 07:23 - 00000000 ____D () C:\Users\Rolf\Documents\samsung
2014-04-28 07:19 - 2014-04-28 07:19 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Downloaded Installations
2014-04-28 07:16 - 2014-04-28 07:16 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-04-28 07:09 - 2014-04-28 07:09 - 00000000 ____D () C:\Program Files (x86)\wow search
2014-04-25 20:41 - 2014-02-06 08:36 - 00000000 ____D () C:\Windows\Minidump
2014-04-25 08:44 - 2014-01-24 07:19 - 00000000 ____D () C:\Program Files\Defraggler
2014-04-25 08:34 - 2014-04-25 08:34 - 00002536 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gmail (1).lnk
2014-04-25 08:34 - 2014-04-25 08:34 - 00002506 _____ () C:\Users\Rolf\Desktop\Gmail.lnk
2014-04-25 08:28 - 2014-01-23 13:59 - 00001509 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gmail.lnk
2014-04-25 08:26 - 2014-01-23 13:58 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-25 08:26 - 2014-01-23 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-25 08:26 - 2014-01-23 11:46 - 00000989 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-04-25 08:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-04-25 07:58 - 2014-04-25 07:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-25 07:57 - 2014-04-25 07:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-25 07:57 - 2014-04-25 07:57 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-25 07:46 - 2014-01-23 13:48 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-04-25 07:46 - 2014-01-23 13:48 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-25 07:46 - 2014-01-23 13:48 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-25 07:46 - 2014-01-23 13:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-25 07:36 - 2014-01-24 07:18 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-25 07:30 - 2014-04-25 07:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-25 07:21 - 2009-07-14 04:34 - 00000505 _____ () C:\Windows\win.ini
2014-04-23 19:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-23 18:41 - 2014-04-23 18:40 - 00001774 _____ () C:\Users\Rolf\Desktop\Google Chrome.lnk
2014-04-23 17:30 - 2014-01-29 12:36 - 00000000 ____D () C:\Users\Rolf\Documents\Ö-14
2014-04-23 17:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-20 19:50 - 2014-04-20 19:50 - 00030720 _____ () C:\Users\Rolf\Downloads\Каталог-BANDO.xls
2014-04-19 19:29 - 2014-04-19 19:29 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLibG64.sys
2014-04-19 17:54 - 2014-04-19 17:54 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\APRILIA SCARABEO 200 IE user guide
2014-04-15 12:57 - 2014-05-08 10:58 - 02015232 _____ () C:\Users\Rolf\Desktop\winupdsvc.exe
2014-04-14 04:24 - 2014-04-25 07:30 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-04-25 07:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-12 09:11 - 2014-01-23 13:19 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-12 09:10 - 2014-01-23 13:19 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 11:56 - 2014-04-09 11:56 - 00000000 __SHD () C:\Users\Rolf\AppData\Local\EmieUserList
2014-04-09 11:56 - 2014-04-09 11:56 - 00000000 __SHD () C:\Users\Rolf\AppData\Local\EmieSiteList
2014-04-08 08:51 - 2014-01-24 09:27 - 00001789 _____ () C:\Users\Rolf\Desktop\XnView.lnk
2014-04-08 08:51 - 2014-01-24 09:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2014-04-08 08:51 - 2014-01-24 09:27 - 00000000 ____D () C:\Program Files (x86)\XnView
2014-04-08 08:48 - 2014-01-24 09:28 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\XnView

Files to move or delete:
====================
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe


Some content of TEMP:
====================
C:\Users\Rolf\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Rolf\AppData\Local\Temp\sqlite3.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 09:11

==================== End Of Log ============================

Addition.txt

[Cecilia]

R2 Security Updates Service; C:\Program Files (x86)\Security Updates Service\winupdsvc.exe [2015232 2014-04-15] ()

Den tjänsten hör ihop med EZ YouTube Video Downloader.

Vad finns i denna mapp?

C:\Program Files (x86)\wow search

 

Börja med att avinstallera EZ YouTube Video Downloader i Kontrollpanelen, Internet Explorers och Firefox tillägg.

Starta Anteckningar.

Kopiera alla rader i rutan:

SearchScopes: HKLM - DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL =
BHO-x32: EZ YouTube Video Downloader 1.0 - {FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} - C:\Program Files (x86)\EZ YouTube Video Downloader\yvd.dll (XtensionPlus)
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]
FF HKLM-x32\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]
R2 Security Updates Service; C:\Program Files (x86)\Security Updates Service\winupdsvc.exe [2015232 2014-04-15] ()
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\Security Updates Service
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-05-08 09:24 - 2014-05-08 09:25 - 02500744 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.

Spara filen på skrivbordet med namnet fixlist.txt.

Starta FRST som finns på skrivbordet.

Klicka på knappen Fix.

Vänta tills programmet är klart.

Programmet skapar en logg Fixlog.txt på skrivbordet.

Klistra in innehållet i den i ditt svar.

[JoWa]

I C:\Program Files (x86)\wow search finns mappen icons med två ikonfiler: install.ico (EZ YouTube Video Downloader-ikonen) och wow_ico.ico.

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-05-2014 01
Ran by Rolf at 2014-05-08 12:04:00 Run:1
Running from C:\Users\Rolf\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL =
BHO-x32: EZ YouTube Video Downloader 1.0 - {FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} - C:\Program Files (x86)\EZ YouTube Video Downloader\yvd.dll (XtensionPlus)
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]
FF HKLM-x32\...\Firefox\Extensions: [{8167E8F2-A770-4EFB-BA53-8A511051CD9B}] - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B}
FF Extension: EZ YouTube Video Downloader - C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} [2014-05-08]
R2 Security Updates Service; C:\Program Files (x86)\Security Updates Service\winupdsvc.exe [2015232 2014-04-15] ()
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\Security Updates Service
2014-05-08 09:25 - 2014-05-08 09:25 - 00000000 ____D () C:\Program Files (x86)\EZ YouTube Video Downloader
2014-05-08 09:24 - 2014-05-08 09:25 - 02500744 _____ () C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} => Key not found.
HKCR\Wow6432Node\CLSID\{FDBFEA30-EC51-4B8D-B4F0-8CA4F7253C0A} => Key not found.
C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} not found.
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} => Value not found.
C:\Program Files (x86)\EZ YouTube Video Downloader\{8167E8F2-A770-4EFB-BA53-8A511051CD9B} not found.
Security Updates Service => Service stopped successfully.
Security Updates Service => Service deleted successfully.
C:\Program Files (x86)\Security Updates Service => Moved successfully.
"C:\Program Files (x86)\EZ YouTube Video Downloader" => File/Directory not found.
C:\ProgramData\Setup_EZ_YouTube_Video_Downloader_v1.1.8.exe => Moved successfully.

==== End of Fixlog ====

Redigerad Maj 8, 2014 av JoWa

[Cecilia]

Ta bort mappen "C:\Program Files (x86)\wow search" då.

Då är det bara att vänta några dagar för att se om det kommer tillbaka.

Skanna datorn online på http://www.eset.com/onlinescan/

För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Avbocka alternativet Remove found threats

Bocka för Scan Archives

Klicka på Advanced Settings

Bocka för:

Scan for potentially unwanted applications

Scan for potentially unsafe applications

Enable Anti-Stealth Technology

Klicka på Start

När skanningen är klar klicka på List of found threats, följt av Export to a text file. Spara till en fil på skrivbordet, öppna filen, kopiera resultatet och klistra sedan in det i ditt svar.

[JoWa]

Eset skannar. 0 % efter 15 minuter…

 

C:\Program Files (x86)\wow search är raderad, och det är även installationsprogrammen i C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5.

[JoWa]

Efter 45 minuter och fortfarande 0 %, startade jag om skanningen. Då blev det fart. Resultat: inga infekterade filer.

 

Du skall ha stort tack, Cecilia. Ytterligare ett väl utfört uppdrag.

 

Det känns litet dumt att jag stirrade på ”skurken” (winupdsvc.exe) och konstaterade att den ensam var osignerad, utan att reagera mer än jag gjorde. Filen är dock ren enligt VT. Uppenbarligen har EZ YouTube Video Downloader ett uselt avinstallationsprogram som lämnar uppdateraren kvar. Om det är avsiktligt eller inte är en annan fråga.

 

Med tanke på det som tidigare hände (inkl. Qone8) känns det dock bra att ha fått denna genomgång utförd.

[Cecilia]

Utmärkt!

Det var så lite så

winupdsvc är ju så anonymt namn att man inte riktigt tänker på den, men datumet fick mig att tänka en extra gång och söka information om den.

Om man konfigurerar Avast för att upptäcka PUP kan det stoppa en hel del annonsprogram, går kanske med en del andra gratis antivirusprogrammen också, men inte med MSE.

[JoWa]

Förhoppningsvis har användaren nu fått större respekt för UAC, och att det är helt fel om den poppar upp när ett ”dokument” öppnas.

För övrigt installerar han inget, utan jag står för underhållet (installationer och uppdateringar).

[Cecilia]

Vi får hoppas det

Skulle han kunna ha standardkonto i ställer för admin-konto?

[JoWa]

Jo, den tanken slog mig då jag skrev förra inlägget.