|
| |||||||
 |
 |
| | Thread Tools |
|
#1
18 juni 2009, 11:46
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Hej och tack för behandlingen. Jag har försökt att ta bort oönskade skadliga program från datorn till mer än en vecka nu, och ingenting verkar fungera. Jag har hittat flera processer inklusive iexplorer.exe, Winlogon.exe, Spoolsv.exe och andra okända processer såsom PavPrSrv.exe och McciCMService.exe. Jag var tvungen att ändra EXE namnet på de flesta program för att få dem att öppna. Jag brukar använda AVG Free, men jag avinstallerat det och försökt Panda för att se om det skulle hjälpa (inte). Sedan dess har jag bort Panda och installerat AVG. Tack på förhand för din hjälp! Här finns loggfiler som jag har hämtats. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/18/2009 vid 01:15 Application Version: 4.26.1004 Core Rules Database Version: 3945 Trace Rules Database Version: 1887 Scan type: Complete Scan Total Scan Time: 01:11:18 Memory ex skannade: 373 Memory hot upptäcks: 1 Registreringsenheten ex skannade: 4431 Registreringsenheten hot upptäcktes: 86 Arkiv ex skannade: 39059 Arkiv hot upptäcktes: 11 Rootkit.Agent / Gen-UACFake \? \ GLOBALROOT \ C: \ WINDOWS \ system32 \ UACKPXJQWVUGNSPO KQ.DLL \? \ GLOBALROOT \ C: \ WINDOWS \ system32 \ UACKPXJQWVUGNSPO KQ.DLL Unclassified.Unknown Ursprung HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Exp lorer \ Browser Helper Objects \ (2520BA45-3D97-4864-82FF-F47F951727BA) HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Exp lorer \ Browser Helper Objects \ (9B053E00-78D3-47AE-B763-60FF36FF2886) HKU \. DEFAULT \ Software \ Microsoft \ Windows \ CurrentVer sion \ Ext \ Stats \ (2520BA45-3D97-4864-82FF-F47F951727BA) HKU \. DEFAULT \ Software \ Microsoft \ Windows \ CurrentVer sion \ Ext \ Stats \ (9B053E00-78D3-47AE-B763-60FF36FF2886) HKU \ S-1-5-21-776561741-1580436667-854245398-1003 \ Software \ Microsoft \ Windows \ CurrentVersion \ Ext \ Stats \ (2520BA45-3D97-4864-82FF-F47F951727BA) HKU \ S-1-5-21-776561741-1580436667-854245398-1003 \ Software \ Microsoft \ Windows \ CurrentVersion \ Ext \ Stats \ (9B053E00-78D3-47AE-B763-60FF36FF2886) HKU \ S-1-5-18 \ Software \ Microsoft \ Windows \ CurrentVersion \ Ext \ S tats \ (2520BA45-3D97-4864-82FF-F47F951727BA) HKU \ S-1-5-18 \ Software \ Microsoft \ Windows \ CurrentVersion \ Ext \ S tats \ (9B053E00-78D3-47AE-B763-60FF36FF2886) Trojan.Agent / Gen-AmblBE HKU \. DEFAULT \ Software \ Microsoft \ Windows \ CurrentVer sion \ Ext \ Stats \ (06F20C1A-4811-4C73-A114-792ED70F2CAD) HKU \ S-1-5-18 \ Software \ Microsoft \ Windows \ CurrentVersion \ Ext \ S tats \ (06F20C1A-4811-4C73-A114-792ED70F2CAD) Adware.TrustInCash C: \ WINDOWS \ system32 \ tisa.cnf C: \ WINDOWS \ REMOVEADWARE.ICO C: \ WINDOWS \ VIDEOSLOTS.ICO Rogue.Component / Trace HKU \ S-1-5-21-776561741-1580436667-854245398-1003 \ Software \ Microsoft \ FIAS4057 Rootkit.Agent / Gen HKLM \ SOFTWARE \ UAC HKLM \ SOFTWARE \ UAC # cmddelay HKLM \ SOFTWARE \ UAC # LastBSOD HKLM \ SOFTWARE \ UAC # affid HKLM \ SOFTWARE \ UAC # typ HKLM \ SOFTWARE \ UAC # bygga HKLM \ SOFTWARE \ UAC # subid HKLM \ SOFTWARE \ UAC # ecaab67d-7d92-4ec1-ac32-3087345120a3 HKLM \ SOFTWARE \ UAC # val HKLM \ SOFTWARE \ UAC # SVAL HKLM \ SOFTWARE \ UAC # pval HKLM \ SOFTWARE \ UAC \ anslutningar HKLM \ SOFTWARE \ UAC \ anslutningar # 905b3008 HKLM \ SOFTWARE \ UAC \ anslutningar # 7d72e91c HKLM \ SOFTWARE \ UAC \ anslutningar # a2674c18 HKLM \ SOFTWARE \ UAC \ anslutningar # b43dcf0f HKLM \ SOFTWARE \ UAC \ anslutningar # f2065612 HKLM \ SOFTWARE \ UAC \ otillåtna HKLM \ SOFTWARE \ UAC \ otillåtna # trsetup.exe HKLM \ SOFTWARE \ UAC \ otillåtna # ViewpointService.exe HKLM \ SOFTWARE \ UAC \ otillåtna # ViewMgr.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SpySweeper.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SUPERAntiSpyware.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SpySub.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SpywareTerminatorShie ld.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SpyHunter3.exe HKLM \ SOFTWARE \ UAC \ otillåtna # XoftSpy.exe HKLM \ SOFTWARE \ UAC \ otillåtna # SpyEraser.exe HKLM \ SOFTWARE \ UAC \ otillåtna # combofix.exe HKLM \ SOFTWARE \ UAC \ otillåtna # otscanit.exe HKLM \ SOFTWARE \ UAC \ otillåtna # mbam.exe HKLM \ SOFTWARE \ UAC \ otillåtna # mbam-setup.exe HKLM \ SOFTWARE \ UAC \ otillåtna # flash_disinfector.exe HKLM \ SOFTWARE \ UAC \ otillåtna # otmoveit2.exe HKLM \ SOFTWARE \ UAC \ otillåtna # smitfraudfix.exe HKLM \ SOFTWARE \ UAC \ otillåtna # prevxcsifree.exe HKLM \ SOFTWARE \ UAC \ otillåtna # download_mbam-setup.exe HKLM \ SOFTWARE \ UAC \ otillåtna # cbo_setup.exe HKLM \ SOFTWARE \ UAC \ otillåtna # spywareblastersetup.e XE HKLM \ SOFTWARE \ UAC \ otillåtna # rminstall.exe HKLM \ SOFTWARE \ UAC \ otillåtna # sdsetup.exe HKLM \ SOFTWARE \ UAC \ otillåtna # vundofixsvc.exe HKLM \ SOFTWARE \ UAC \ otillåtna # daft.exe HKLM \ SOFTWARE \ UAC \ otillåtna # gmer.exe HKLM \ SOFTWARE \ UAC \ otillåtna # catchme.exe HKLM \ SOFTWARE \ UAC \ otillåtna # mcpr.exe HKLM \ SOFTWARE \ UAC \ otillåtna # sdfix.exe HKLM \ SOFTWARE \ UAC \ otillåtna # hjtinstall.exe HKLM \ SOFTWARE \ UAC \ otillåtna # fixpolicies.exe HKLM \ SOFTWARE \ UAC \ otillåtna # emergencyutil.exe HKLM \ SOFTWARE \ UAC \ otillåtna # techweb.exe HKLM \ SOFTWARE \ UAC \ otillåtna # GoogleUpdate.exe HKLM \ SOFTWARE \ UAC \ otillåtna # windowsdefender.exe HKLM \ SOFTWARE \ UAC \ otillåtna # spybotsd.exe HKLM \ SOFTWARE \ UAC \ otillåtna # winlognn.exe HKLM \ SOFTWARE \ UAC \ otillåtna # csrssc.exe HKLM \ SOFTWARE \ UAC \ otillåtna # klif.sys HKLM \ SOFTWARE \ UAC \ otillåtna # pctssvc.sys HKLM \ SOFTWARE \ UAC \ otillåtna # pctcore.sys HKLM \ SOFTWARE \ UAC \ otillåtna # mchinjdrv.sys HKLM \ SOFTWARE \ UAC \ otillåtna # szkg.sys HKLM \ SOFTWARE \ UAC \ otillåtna # sasdifsv.sys HKLM \ SOFTWARE \ UAC \ otillåtna # saskutil.sys HKLM \ SOFTWARE \ UAC \ otillåtna # sasenum.sys HKLM \ SOFTWARE \ UAC \ otillåtna # ccHPx86.sys HKLM \ SOFTWARE \ UAC \ injektor HKLM \ SOFTWARE \ UAC \ injektor # * HKLM \ SOFTWARE \ UAC \ mask HKLM \ SOFTWARE \ UAC \ mask # 6aed4b25 HKLM \ SOFTWARE \ UAC \ mask # e0ae8144 HKLM \ SOFTWARE \ UAC \ mask # 30910b28 HKLM \ SOFTWARE \ UAC \ mask # c6216721 HKLM \ SOFTWARE \ UAC \ mask # dd118673 HKLM \ SOFTWARE \ UAC \ versioner HKLM \ SOFTWARE \ UAC \ versioner # / banner / crcmds / init Adware.Tracking Cookie C: \ Documents and Settings \ Guest \ Cookies \ guest@ad.yieldmanager [1]. Txt C: \ Documents and Settings \ Guest \ Cookies \ gäst @ DoubleClick [1]. Txt C: \ Documents and Settings \ Guest \ Cookies \ gäst @ myroitracking [1]. Txt C: \ Documents and Settings \ Guest \ Cookies \ guest@serw.clicksor [1]. Txt C: \ WINDOWS \ system32 \ config \ systemprofile \ Cookies \ s YSTEM @ ix-hitta [1]. Txt Adware.180solutions/Seekmo/Zango C: \ Program Files \ FASOFT \ N-TRACK STUDIO 6 \ SETUP.EXE Webbläsarevänlig Hijacker.MS Webbsök C: \ WINDOWS \ LOCAL.HTML Malwarebytes' Anti-Malware 1.37 Database version: 2269 Windows 5.1.2600 Service Pack 2 6/18/2009 2:25:06 PM mbam-log-2009-06-18 (14-25-06). txt Scan type: Quick Scan Objekt skannade: 28750 Tid som förflutit: 18 minut (er), 54 sekund (er) Memory Processes Infekterade: 0 Minnesmoduler Infekterade: 0 Registernycklar Infekterade: 0 Registervärdena Infekterade: 0 Registry Data Items Infekterade: 0 Mappar Infekterade: 0 Filer Infekterade: 0 Memory Processes Infekterade: (Inga illasinnade poster upptäcks) Minnesmoduler Infekterade: (Inga illasinnade poster upptäcks) Registernycklar Infekterade: (Inga illasinnade poster upptäcks) Registervärdena Infekterade: (Inga illasinnade poster upptäcks) Registry Data Items Infekterade: (Inga illasinnade poster upptäcks) Mappar Infekterade: (Inga illasinnade poster upptäcks) Filer Infekterade: (Inga illasinnade poster upptäcks) Loggfil av Trend Micro HijackThis v2.0.2 Scan sparas på 2:28:36 PM om 6/18/2009 Plattform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Kör processer: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ WINDOWS \ Explorer.EXE C: \ WINDOWS \ system32 \ igfxtray.exe C: \ WINDOWS \ system32 \ hkcmd.exe C: \ Program \ Java \ jre6 \ bin \ jusched.exe C: \ progra ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe C: \ Program \ Java \ jre6 \ bin \ jqs.exe C: \ Program Files \ Common Files \ Motive \ McciCMService.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Program Files \ synvinkel \ Common \ ViewpointService.exe C: \ progra ~ 1 \ AVG \ AVG8 \ avgrsx.exe C: \ progra ~ 1 \ AVG \ AVG8 \ avgemc.exe C: \ Program \ Mozilla Firefox \ firefox.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://us.rd.yahoo.com/customize/yco...search/ie.html R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.att.net/ R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, Proxyserver = http = localhost: 7171 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyOverride = *. lokala, <local> O1 - Hosts::: 1 localhost O1 - Hosts: 209.44.111.57 security.microsoft.com O1 - Hosts: 209.44.111.57 inetavirus.com O1 - Hosts: 209.44.111.57 www.inetavirus.com O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C: \ Program Files \ AVG \ AVG8 \ avgssie.dll O2 - BHO: Java (tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C: \ Program \ Java \ jre6 \ bin \ jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C: \ Program \ Java \ jre6 \ lib \ distribuera \ jqs \ dvs \ jqs_plugin.dll O4 - HKLM \ .. \ Run: [KernelFaultCheck]% systemroot% \ system32 \ dumprep 0-k O4 - HKLM \ .. \ Run: [IgfxTray] C: \ WINDOWS \ system32 \ igfxtray.exe O4 - HKLM \ .. \ Run: [HotKeysCmds] C: \ WINDOWS \ system32 \ hkcmd.exe O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program \ Java \ jre6 \ bin \ jusched.exe" O4 - HKUS \ S-1-5-19 \ .. \ Run: [pivafuniya] rundll32.exe "C: \ WINDOWS \ system32 \ luruwono.dll", S (User 'LOCAL SERVICE') O4 - HKUS \ S-1-5-20 \ .. \ Run: [pivafuniya] rundll32.exe "C: \ WINDOWS \ system32 \ luruwono.dll", S (User 'NETWORK SERVICE') O4 - HKUS \ S-1-5-18 \ .. \ Run: [MySpaceIM] C: \ Program Files \ MySpace \ IM \ MySpaceIM.exe (User "SYSTEM") O4 - HKUS \. DEFAULT \ .. \ Run: [MySpaceIM] C: \ Program Files \ MySpace \ IM \ MySpaceIM.exe (User 'Default user') Ø9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe Ø9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C: \ Program Files \ AVG \ AVG8 \ avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll C: \ WINDOWS \ system32 \ zuhagiye.dll c: \ windows \ system32 \ nulakili.dll O20 - Winlogon Notify:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, sro - C: \ progra ~ 1 \ AVG \ AVG8 \ avgemc.exe O23 - Service: AVG8 Watchdog (avg8wd) - AVG Technologies CZ, sro - C: \ progra ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe O23 - Service: Google Update Service (gupdate1c9c119864b630) (gupdate1c9c119864b630) - Google Inc. - C: \ Program \ Google \ Update \ GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C: \ Program \ Java \ jre6 \ bin \ jqs.exe O23 - Service: McciCMService - Motive Communications, Inc. - C: \ Program Files \ Common Files \ Motive \ McciCMService.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, SL - C: \ Program Files \ Common Files \ Panda Security \ PavShld \ pavprsrv.exe O23 - Service: synvinkel Manager Service - synvinkel Corporation - C: \ Program Files \ synvinkel \ Common \ ViewpointService.exe -- End of file - 4735 bytes |
|
#2
18 juni 2009, 15:35
| ||||||||||||
| ||||||||||||
| Please help! Min dator är Running Flera virus / malware. Hallå där Mybabbits Hämta Combofix från någon av länkarna nedan. Du måste döp om den innan du sparar den. Spara den på skrivbordet som combo-fix.exe. Länk 1 Länk 2 Länk 3   Inaktivera antivirusprogrammet och AntiSpyware ansökningar, oftast via ett högerklicka på ikonen i aktivitetsfältet. De kan annars störa våra verktyg Öppna Aktivitetshanteraren genom att trycka Ctrl-Alt och Del-knapparna samtidigt. I menyn högst upp i dialogrutan, klicka på Arkiv> Ny aktivitet (Kör. ..) Kopiera / klistra in (eller typ) följande i rutan Kör och klicka på OK: (förutsatt ComboFix.exe är på skrivbordet som fick i uppdrag) "% userprofile% \ desktop \ combo-fix.exe" / killall Följ instruktionerna på skärmen insatructions och låt combofix avsluta sitt sikt Se till att du installerar Återställningskonsolen på begäran. Post tillbaka med resultaten i nästa post. Hämta GMER rootkit Skanner från här eller här.
** Varning ** Rootkit söker ofta falska positiva. Inte vidtar någon åtgärd om någon "<--- ROOKIT "poster Kopiera och klistra in båda loggarna i ditt nästa svar
__________________
__________________
Stolt medlem i ASAP & UNITE Mitt System: Steves Rigg
|
|
#3
18 juni 2009, 18:36
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Jag laddade ner ComboFix till skrivbordet och bytt namn enligt anvisningarna. När jag försöker köra "% userprofile% \ desktop \ combo-fix.exe" / killall Jag får ett popup-fönster som första varnar mig att programmet från en oidentifierad källa, så jag valde sikt. Efter detta verkar det som om combofix körs korrekt då får jag en popup-fönster som säger något i stil med "Det går inte att hitta" grpconv ". Kontrollera att du angav rätt namn ..." och så vidare-skärmen inte uppe länge nog för mig att hinna med resten av det. Jag klickade på OK, och sen fick jag en annan skärm från combofix som säger det har upptäckts AVG antivirus fortfarande. Jag hade problem att inaktivera det, så jag gick vidare och avinstallerade det helt. Jag är inte säker på varför det fortfarande anser att det är igång. Ska jag gå vidare och klicka på OK men dessa skärmar också och se om det kommer fortfarande att fungera? Tack! |
|
#4
18 juni 2009, 23:48
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Hallå där Klicka ok genom skärmar och se om du kan få combofix scan för att slutföra
__________________ Stolt medlem i ASAP & UNITE |
|
#5
19 juni 2009, 06:58
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Jag hade fortfarande vissa problem med combofix. Någon gång under processen skrivbordet gick tom och combofix skärmen försvunnit. Är det tänkt att göra detta? Jag väntade ca 10 minuter för att se om något skulle hända och sedan jag omstart av datorn. Efter att combofix skärmen kom tillbaka och sa att det var att skapa loggfilen ... Här är vad jag fick: ComboFix 09-06-18.02 - Ägare 06/19/2009 9:02.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.286 [GMT -4:00] Running from: C: \ Documents and Settings \ Ägare \ Desktop \ combo-fix.exe Kommando växlar används: / killall AV: AVG Anti-Virus Free * På tillgång scanning aktiverat * (Uppdaterad) (17DDD097-36FF-435F-9E1B-52D74245D6BF) FW: F-Secure Anti-Virus 2006 6,10 * funktionshindrade * (D4747503-0346-49EB-9262-997542F79BF4) VARNING-Den här maskinen har inte Återställningskonsolen INSTALLERADE! . ((((((((((((((((((((((((((((((((((((((( Andra Strykningar ))))))))) )))))))))))))))))))))))))))))))))))))))) . c: \ Documents and Settings \ LocalService \ Application Data \ twain_32 c: \ Documents and Settings \ NetworkService \ Application Data \ twain_32 c: \ windows \ system32 \ components c: \ windows \ system32 \ drivers \ UACymttprqpphespir.sys c: \ windows \ system32 \ UACakmovnkvlbejvsw.dll c: \ windows \ system32 \ UACjqblgassmsyrtsd.log c: \ windows \ system32 \ UACkpxjqwvugnspokq.dll c: \ windows \ system32 \ UACllkyxudengakpfn.dll c: \ windows \ system32 \ UACmxexwkuwcfyxylo.dll c: \ windows \ system32 \ UACtdqoweywvrmpfuc.dat c: \ windows \ system32 \ UACwixxvmnqlxbujns.log c: \ windows \ system32 \ UACwqwjasvfplrvpdn.log c: \ windows \ system32 \ UACxcvrjkwrnbmiqml.dll C: \ bt.log c: \ Documents and Settings \ LocalService \ Application Data \ twain_32 \ user.ds c: \ Documents and Settings \ NetworkService \ Application Data \ twain_32 \ user.ds c: \ windows \ system32 \ arosetud.ini c: \ windows \ system32 \ barohozi.dll.tmp c: \ windows \ system32 \ bavuvofi.dll.tmp c: \ windows \ system32 \ components \ flx0.dll c: \ windows \ system32 \ diwovadu.dll.tmp c: \ windows \ system32 \ drivers \ str.sys c: \ windows \ system32 \ drivers \ UACymttprqpphespir.sys c: \ windows \ system32 \ edurozoj.ini c: \ windows \ system32 \ foyefolu.dll.tmp c: \ windows \ system32 \ huboweri.dll.tmp c: \ windows \ system32 \ ipepiyik.ini c: \ windows \ system32 \ irawesak.ini c: \ windows \ system32 \ jiyiduse.dll.tmp c: \ windows \ system32 \ lcch.dat c: \ windows \ system32 \ lut.dat c: \ windows \ system32 \ nfr.assembly c: \ windows \ system32 \ nfr.gpref c: \ windows \ system32 \ obinunud.ini c: \ windows \ system32 \ ofalonoy.ini c: \ windows \ system32 \ ozejalir.ini c: \ windows \ system32 \ srsut.bak1 c: \ windows \ system32 \ tconini.dat c: \ windows \ system32 \ UACakmovnkvlbejvsw.dll c: \ windows \ system32 \ uacinit.dll c: \ windows \ system32 \ UACjqblgassmsyrtsd.log c: \ windows \ system32 \ UACkpxjqwvugnspokq.dll c: \ windows \ system32 \ UACllkyxudengakpfn.dll c: \ windows \ system32 \ UACmxexwkuwcfyxylo.dll c: \ windows \ system32 \ UACtdqoweywvrmpfuc.dat c: \ windows \ system32 \ UACwixxvmnqlxbujns.log c: \ windows \ system32 \ UACwqwjasvfplrvpdn.log c: \ windows \ system32 \ UACxcvrjkwrnbmiqml.dll c: \ windows \ system32 \ ugujasof.ini c: \ windows \ system32 \ utodobah.ini c: \ windows \ system32 \ grpconv.exe saknas Återställas kopiera från - c: \ windows \ ServicePackFiles \ i386 \ grpconv.exe c: \ windows \ system32 \ proquota.exe saknas Återställas kopiera från - c: \ windows \ ServicePackFiles \ i386 \ proquota.exe . ((((((((((((((((((((((((((((((((((((((( Drivers / Services )))))))) ))))))))))))))))))))))))))))))))))))))))) . ------- \ Service_UACd.sys ------- \ Legacy_PODMENA ------- \ Legacy_PODMENADRV ((((((((((((((((((((((((( Files Created från 2009-05-19 till 2009-06-19 ))))))))))) )))))))))))))))))))) . 2009-06-19 13:09. 2004-08-04 07:56 50176-c - aw-c: \ windows \ system32 \ dllcache \ proquota.exe 2009-06-19 13:09. 2004-08-04 07:56 50,176 ---- aw-c: \ windows \ system32 \ proquota.exe 2009-06-18 18:04. 2009-06-18 18:04 3561743 ---- aw C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes \ Malwarebytes' Anti-Malware \ mbam-setup.exe 2009-06-18 15:58. 2009-06-18 18:01 117760 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ SUPERAntiSpyware.com \ SUPERAntiSpyware \ SDDLLS \ UIREPAIR.DLL 2009-06-18 15:57. 2009-06-18 15:57 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ SUPERAntiSpyware.com 2009-06-18 15:54. 2009-06-18 15:57 -------- d ----- w-C: \ Program Files \ SUPERAntiSpyware 2009-06-18 15:54. 2009-06-18 15:54 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ SUPERAntiSpyware.com 2009-06-18 15:53. 2009-06-18 15:53 -------- d ----- w-C: \ Program Files \ Common Files \ Wise Installation Wizard 2009-06-18 15:42. 2009-06-18 15:42 -------- d ----- w-C: \ Program Files \ CCleaner 2009-06-18 05:27. 2009-06-18 05:27 152576 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ söndag \ Java \ jre1.6.0_14 \ lzma.dll 2009-06-18 04:28. 2009-06-18 04:28 -------- d ----- w-C: \ Program Files \ Trend Micro 2009-06-13 07:06. 2002-06-19 23:03 151,552 ---- aw-c: \ windows \ system32 \ igfxres.dll 2009-06-13 06:38. 2002-06-21 15:02 266240 ---- aw-c: \ windows \ system32 \ shpshftr.dll 2009-06-13 06:00. 2009-06-13 06:00 444 ---- aw-c: \ windows \ system32 \ d3d8caps.dat 2009-06-13 05:01. 2009-06-13 05:01 -------- d ----- w C: \ Documents and Settings \ Administratör \ Lokala inställningar \ Application Data \ Mozilla 2009-06-13 04:44. 2009-06-18 04:53 -------- d ----- w-C: \ Program Files \ Startup Optimizer 2009-06-12 23:31. 2009-06-12 23:31 -------- d ----- w C: \ Documents and Settings \ Administratör \ Application Data \ Malwarebytes 2009-06-12 22:21. 2009-05-26 17:20 40160 ---- aw-c: \ windows \ system32 \ drivers \ mbamswissarmy.sys 2009-06-12 22:21. 2009-06-12 22:23 -------- d ----- w-C: \ Program Files \ Malwarebytes' Anti-Malware 2009-06-12 22:21. 2009-05-26 17:19 19096 ---- aw-c: \ windows \ system32 \ drivers \ mbam.sys 2009-06-12 19:18. 2009-06-12 23:26 45 ---- aw-c: \ windows \ system32 \ ca.dat 2009-06-12 18:56. 2008-03-04 19:59 41144 ---- aw-c: \ windows \ system32 \ drivers \ ShlDrv51.sys 2009-06-12 18:56. 2008-02-07 16:03 179640 ---- aw-c: \ windows \ system32 \ drivers \ PavProc.sys 2009-06-12 18:21. 2009-06-12 18:56 -------- d ----- w-C: \ Program Files \ Common Files \ Panda Security 2009-06-03 05:12. 2004-08-04 07:56 221,184 ---- aw-c: \ windows \ system32 \ wmpns.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2009-06-19 01:27. 2008-05-23 05:13 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ avg8 2009-06-18 05:31. 2009-01-05 00:21 410984 ---- aw-c: \ windows \ system32 \ deploytk.dll 2009-06-18 05:31. 2009-01-12 01:18 -------- d ----- w-C: \ Program Files \ Java 2009-06-13 04:50. 2009-01-05 04:50 -------- d ----- w-C: \ Program Files \ Web Publish 2009-06-13 04:49. 2008-08-20 22:26 -------- d ----- w-C: \ Program Files \ Mozilla Thunderbird 2009-06-12 22:57. 2009-04-16 15:22 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ U3 2009-06-12 18:22. 2006-05-02 03:43 -------- d - h - w-C: \ Program Files \ InstallShield Installation Information 2009-06-12 16:10. 2009-04-19 18:00 -------- d ----- w-C: \ Program Files \ Google 2009-06-02 16:49. 2009-03-29 21:27 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ n-Track Studio6 2009-05-15 13:30. 2006-07-15 14:36 -------- d ----- w-C: \ Program Files \ QuickTime 2009-05-15 13:30. 2006-07-15 15:39 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Apple Computer 2009-05-15 13:29. 2009-05-15 13:29 -------- d ----- w-C: \ Program Files \ Apple Software Update 2009-05-15 13:29. 2009-05-15 13:29 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Apple 2009-05-12 19:53. 2009-05-12 19:53 16141 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Help \ lego.exe 2009-05-12 19:53. 2009-05-12 19:53 11410 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Identities \ msgdi.dll 2009-05-12 19:53. 2009-05-12 19:53 10121 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Lavasoft \ kern.dll 2009-05-12 19:53. 2009-05-12 19:53 422 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Apple Computer \ socks1.exe 2009-05-12 19:53. 2009-05-12 19:53 145131 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ DivX \ nomad.exe 2009-05-12 19:53. 2009-05-12 19:53 13221 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Adobe \ rengo.dll 2009-05-12 19:53. 2009-05-12 19:53 11232 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ acccore \ shalom.exe 2009-05-11 14:21. 2009-05-11 14:21 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ Malwarebytes 2009-05-11 14:20. 2009-05-11 14:20 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes 2009-05-01 02:42. 2009-05-01 02:42 130443 ---- aw-c: \ windows \ system32 \ rn.tmp 2009-04-22 16:14. 2006-05-03 02:44 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ n-Track Studio 2009-04-21 07:27. 2006-05-03 02:44 12,024 ---- aw C: \ Documents and Settings \ Ägare \ Lokala inställningar \ Application Data \ GDIPFONTCACHEV1.DAT 2009-04-15 20:25. 2009-04-19 18:01 43528 ------ w-c: \ windows \ system32 \ drivers \ PxHelp20.sys 2009-04-15 20:25. 2009-04-19 18:01 9464 ------ w-c: \ windows \ system32 \ drivers \ cdralw2k.sys 2009-04-15 20:25. 2009-04-19 18:01 9336 ------ w-c: \ windows \ system32 \ drivers \ cdr4_xp.sys 2009-04-15 20:25. 2009-04-19 18:01 120056 ------ w-c: \ windows \ system32 \ pxcpyi64.exe 2009-04-15 20:25. 2009-04-19 18:01 118520 ------ w-c: \ windows \ system32 \ pxinsi64.exe 2009-04-15 20:25. 2009-04-19 18:01 129784 ------ w-c: \ windows \ system32 \ pxafs.dll 2009-04-15 20:24. 2009-04-15 20:24 90112 ---- aw-c: \ windows \ system32 \ dpl100.dll 2009-04-15 20:24. 2009-04-15 20:24 823296 ---- aw-c: \ windows \ system32 \ divx_xx0c.dll 2009-04-15 20:24. 2009-04-15 20:24 823296 ---- aw-c: \ windows \ system32 \ divx_xx07.dll 2009-04-15 20:24. 2009-04-15 20:24 815104 ---- aw-c: \ windows \ system32 \ divx_xx0a.dll 2009-04-15 20:24. 2009-04-15 20:24 802816 ---- aw-c: \ windows \ system32 \ divx_xx11.dll 2009-04-15 20:24. 2009-04-15 20:24 684032 ---- aw-c: \ windows \ system32 \ DivX.dll 2009-04-01 16:35. 2009-04-01 16:34 7040776 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ MySpace \ IM \ Install \ MSIMClientSetup.1.0.789.0-static-A.exe 2009-04-01 16:33. 2009-04-01 16:33 300800 ---- aw C: \ MySpaceIM_Setup.exe 2009-03-31 23:24. 2009-03-31 23:23 16494272 ---- aw C: \ nTrackSetup.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _16496df1.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _69525f90.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _294823.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _18be6784.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _4ae13d6c.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _2cd672ae.exe 2009-02-26 16:20. 2009-02-26 16:20 6309376 ---- aw-C: \ Program Files \ ntrack.exe 2009-02-26 16:05. 2009-02-26 16:05 126976 ---- aw-C: \ Program Files \ AMGateway.ax 2009-02-26 16:05. 2009-02-26 16:05 63168 ---- aw-C: \ Program Files \ RegisterComponents.exe 2009-02-26 16:05. 2009-02-26 16:05 163520 ---- aw-C: \ Program Files \ ReportDump.exe 2009-02-26 16:04. 2009-02-26 16:04 86016 ---- aw-C: \ Program Files \ vstscan.exe 2009-02-26 16:04. 2009-02-26 16:04 45056 ---- aw-C: \ Program Files \ ball.ax 2009-02-26 16:01. 2009-02-26 16:01 78848 ---- aw-C: \ Program Files \ EmptyProjectAction.dll 2009-02-26 16:01. 2009-02-26 16:01 147456 ---- aw-C: \ Program Files \ nTrackDotControls.dll 2009-02-26 16:00. 2009-02-26 16:00 637440 ---- aw-C: \ Program Files \ NativeControls6.dll 2009-02-26 15:59. 2009-02-26 15:59 99328 ---- aw-C: \ Program Files \ SurroundVSTGui.dll 2009-02-26 15:59. 2009-02-26 15:59 45056 ---- aw-C: \ Program Files \ yeti.mmedia.dll 2009-02-26 15:59. 2009-02-26 15:59 40960 ---- aw-C: \ Program Files \ cdcopier.dll 2009-02-26 15:59. 2009-02-26 15:59 28672 ---- aw-C: \ Program Files \ Ripper.dll 2009-02-26 15:59. 2009-02-26 15:59 8704 ---- aw-C: \ Program Files \ ntrack3rdparty.dll 2009-02-26 15:59. 2009-02-26 15:59 5120 ---- aw-C: \ Program Files \ WindowsFormsBase.dll 2009-02-26 15:59. 2009-02-26 15:59 36864 ---- aw-C: \ Program Files \ nttest.dll 2009-02-26 15:59. 2009-02-26 15:59 32768 ---- aw-C: \ Program Files \ nTrackDotNet.dll 2009-02-26 15:59. 2009-02-26 15:59 24576 ---- aw-C: \ Program Files \ AVFader.dll 2009-02-26 15:59. 2009-02-26 15:59 6656 ---- aw-C: \ Program Files \ nativecontrolsinterop.dll 2009-02-07 22:10. 2009-02-07 22:10 528726 ---- aw-C: \ Program Files \ n-Track.htm 2009-02-06 00:15. 2009-02-06 00:15 225792 ---- aw-C: \ Program Files \ AutoVol.dll 2009-02-06 00:14. 2009-02-06 00:14 228352 ---- aw-C: \ Program Files \ Chorus.dll 2009-02-06 00:14. 2009-02-06 00:14 228864 ---- aw-C: \ Program Files \ Echo.dll 2009-02-06 00:12. 2009-02-06 00:12 369152 ---- aw-C: \ Program Files \ ntrck_PitchShift.dll 2009-02-06 00:11. 2009-02-06 00:11 176128 ---- aw-C: \ Program Files \ Riverbero.dll 2009-02-06 00:09. 2009-02-06 00:09 434688 ---- aw-C: \ Program Files \ facomp10.dll 2009-02-06 00:08. 2009-02-06 00:08 379904 ---- aw-C: \ Program Files \ dxirewire.dll 2009-02-06 00:06. 2009-02-06 00:06 951808 ---- aw-C: \ Program Files \ fa4bdeq.dll 2009-01-13 14:16. 2009-01-13 14:16 3455 ---- aw-C: \ Program Files \ order.html 2008-11-28 00:23. 2008-11-28 00:23 642840 ---- aw-C: \ Program Files \ n-track.cfg 2008-10-25 23:46. 2008-10-25 23:46 4920 ---- aw-C: \ Program Files \ order_upgrade.html 2008-09-02 23:06. 2008-09-02 23:06 231936 ---- aw-C: \ Program Files \ ShellCtl.dll 2008-08-31 13:20. 2008-08-31 13:20 105,056 ---- aw-C: \ Program Files \ Setup.bmp 2008-06-20 18:37. 2008-06-20 18:37 24576 ---- aw-C: \ Program Files \ ScrollerAbout.dll 2008-06-20 18:18. 2008-06-20 18:18 831058 ---- aw-C: \ Program Files \ banks_default.txt 2008-06-20 18:18. 2008-06-20 18:18 709 ---- aw-C: \ Program Files \ ntrack.exe.config 2008-06-20 18:18. 2008-06-20 18:18 22124 ---- aw-C: \ Program Files \ us428_faders.dat 2008-06-20 18:18. 2008-06-20 18:18 22124 ---- aw-C: \ Program Files \ us224_faders.dat 2008-06-20 18:17. 2008-06-20 18:17 4035 ---- aw-C: \ Program Files \ n-track_help.cnt 2008-06-20 18:17. 2008-06-20 18:17 169585 ---- aw-C: \ Program Files \ Drum Example.sng 2008-06-20 18:17. 2008-06-20 18:17 15457 ---- aw-C: \ Program Files \ FACOMP10.HLP 2008-06-20 18:17. 2008-06-20 18:17 25698 ---- aw-C: \ Program Files \ FA4BDEQ.HLP 2008-06-20 18:16. 2008-06-20 18:16 19339 ---- aw C: \ Program \ N-TRACK_EFX.HLP 2004-06-11 20:19. 2004-06-11 20:19 25,214 ---- aw-C: \ Program Files \ help_icon.ico 2004-06-07 13:23. 2004-06-07 13:23 25214 ---- aw-C: \ Program Files \ link_icon.ico 2000-11-12 03:30. 2000-11-12 03:30 86 ---- aw-C: \ Program Files \ BUYIT!. URL 2000-11-12 03:28. 2000-11-12 03:28 73 ---- aw-C: \ Program Files \ n-Track.url 2009-04-15 20:24. 2009-04-15 20:24 1044480 ---- aw-C: \ Program Files \ Mozilla Firefox \ plugins \ libdivx.dll 2009-04-15 20:24. 2009-04-15 20:24 200704 ---- aw-C: \ Program Files \ Mozilla Firefox \ plugins \ ssldivx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Not * tomma poster & legit default poster visas inte REGEDIT4 [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "IgfxTray" = "c: \ windows \ system32 \ igfxtray.exe" [2002-06-19 155648] "HotKeysCmds" = "c: \ windows \ system32 \ hkcmd.exe" [2002-06-19 114688] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre6 \ bin \ jusched.exe" [2009-06-18 148888] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "MySpaceIM" = "C: \ Program Files \ MySpace \ IM \ MySpaceIM.exe" [2008-12-12 9555968] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(5AE067D3-9AFB-48E0-853A-EBB7F4A000DA)" = "C: \ Program Files \ SUPERAntiSpyware \ SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ anmäla \! SASWinLogon] 2008-12-22 16:05 356352 ---- aw-C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows] "AppInit_DLLs" = c: \ windows \ system32 \ avgrsstx.dl l [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile] "EnableFirewall" = 0 (0x0) [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgupd.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgemc.exe" = "c: \ \ Program Files \ \ ATT-HSI \ \ McciBrowser.exe" = "c: \ \ Program Files \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "c: \ \ Program Files \ \ AIM6 \ \ aim6.exe" = "c: \ \ WINDOWS \ \ system32 \ \ igfxtray.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgrsx.exe" = "% windir% \ \ system32 \ \ drivers \ \ Svchost.exe" = "c: \ \ Program Files \ MySpace \ IM \ \ MySpaceIM.exe" = [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "53: TCP" = 53: TCP: websrvx R1 AvgLdx86; AVG AVI Loader Driver x86, c: \ windows \ system32 \ drivers \ avgldx86.sys [5/23/2008 1:13 AM 96520] R1 SASDIFSV; SASDIFSV, C: \ Program Files \ SUPERAntiSpyware \ sasdifsv.sys [5/26/2009 10:05 AM 9968] R1 SASKUTIL; SASKUTIL, C: \ Program Files \ SUPERAntiSpyware \ SASKUTIL.SYS [5/26/2009 10:05 AM 72944] R1 ShldDrv; Panda File Shield Driver c: \ windows \ system32 \ drivers \ ShlDrv51.sys [6/12/2009 2:56 PM 41144] R2 avg8emc; AVG8 E-mail Scanner, c: \ progra ~ 1 \ AVG \ AVG8 \ avgemc.exe [5/23/2008 1:13 AM 902424] R2 avg8wd; AVG8 Watchdog, c: \ progra ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe [5/23/2008 1:13 AM 282904] R2 AvgTdiX; AVG8 Network Redirector; c: \ windows \ system32 \ drivers \ avgtdix.sys [5/23/2008 1:13 AM 75272] R2 PavProc; Panda Process Protection Driver c: \ windows \ system32 \ drivers \ PavProc.sys [6/12/2009 2:56 PM 179640] R2 synvinkel Manager Service; synvinkel Manager Service, c: \ program \ synvinkel \ Common \ ViewpointService.exe [2/5/2009 6:56 PM 24652] R3 (A7E39B01-B403-11D4-BD18-00D0B7A1821E); AIM 3.0 Del 01 Codec Driver VCH-A, c: \ windows \ system32 \ drivers \ Vch.sys [5/1/2006 11:58 PM 20023] S2 gupdate1c9c119864b630 Google Update Service (gupdate1c9c119864b630), C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [4/19/2009 2:02 PM 133104] S2 sgejhlqxcrvoui; sgejhlqxcrvoui; \? \ C: \ windows \ syste m32 \ drivers \ ngaysfvqh.sys -> c: \ windows \ system32 \ drivers \ ngaysfvqh.sys [?] S2 vnoakhdmmnhfkc; vnoakhdmmnhfkc; \? \ C: \ windows \ syste m32 \ drivers \ ncjdccfwkwt.sys -> c: \ windows \ system32 \ drivers \ ncjdccfwkwt.sys [?] S3 SASENUM; SASENUM, C: \ Program Files \ SUPERAntiSpyware \ SASENUM.SYS [5/26/2009 10:05 AM 7408] . Innehållet i "Schemalagda aktiviteter" mapp 2009-06-19 C: \ Windows \ Tasks \ GoogleUpdateTaskMachine.job - C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2009-04-19 18:00] . . ------- Supplementary Scan ------- . uStart Page = hxxp: / / www.att.net/ uInternet Connection Wizard, ShellNext = iexplore uInternet Inställningar Proxyserver = http = localhost: 7171 uInternet Settings, ProxyOverride = *. lokala, <local> uSearchURL, (Default) = hxxp: / / us.rd.yahoo.com / anpassa / ycomp / defaults / su / *http://www.yahoo.com IE: & Sök FF - ProfilePath - c: \ Documents and Settings \ Ägare \ Application Data \ Mozilla \ Firefox \ Profiles \ a8c9lkqd.default \ FF - prefs.js: browser.search.defaulturl - hxxp: / / search.yahoo.com / search? Fr = ffsp1 & p = FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - google.com FF - prefs.js: keyword.URL - hxxp: / / search.yahoo.com / search? Fr = ffds1 & p = FF - prefs.js: network.proxy.http - localhost FF - prefs.js: network.proxy.http_port - 7171 FF - prefs.js: network.proxy.type - 4 FF - plugin: C: \ Program Files \ Mozilla Firefox \ plugins \ npViewpoint.dll FF - plugin: C: \ Program Files \ synvinkel \ synvinkel Media Player \ npViewpoint.dll . ************************************************** ************************ CatchMe 0.3.1398 W2K/XP/Vista - rootkit / stealth malware detector av Gmer, http://www.gmer.net Rootkit scan 2009-06-19 09:15 Windows 5.1.2600 Service Pack 2 NTFS scanning dolda processer ... scanning dold autostart poster ... scanning dolda filer ... scan completed successfully dolda filer: 0 ************************************************** ************************ . --------------------- DLL-filer Loaded Under Running Processes --------------------- - - - - - - -> "Winlogon.exe" (612) C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll . ------------------------ Andra pågående processer ----------------------- -- . C: \ Program Files \ Java \ jre6 \ bin \ jqs.exe C: \ Program Files \ Common Files \ Motive \ McciCMService.exe C: \ Program Files \ Common Files \ Panda Security \ PavShld \ PavPrSrv.exe c: \ windows \ system32 \ wscntfy.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe . ************************************************** ************************ . Slutförande temne: 2009-06-19 9:20 - maskinen startas ComboFix-karantän-files.txt 2009-06-19 13:20 Pre-Run: 6120624128 bytes gratis Post-Run: 6057713664 bytes gratis 300 GMER 1.0.15.14972 -- http://www.gmer.net Rootkit scan 2009-06-19 09:55:00 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.15 ---- Kod \? \ C: \ DOCUME ~ 1 \ Ägare \ LOCALS ~ 1 \ Temp \ catchme.sys pIofCallDriver ---- Devices - GMER 1.0.15 ---- Device \ Filesystem \ ntfs \ ntfs ShlDrv51.sys (PandaShield föraren / Panda Security, SL) Device \ Filesystem \ Fastfat \ FatCdrom ShlDrv51.sys (PandaShield föraren / Panda Security, SL) Device \ Driver \ Tcpip \ Device \ Ip avgtdix.sys (AVG Nätverksanslutning BEVAKARE / AVG Technologies CZ, sro) Device \ Driver \ Tcpip \ Device \ tcp avgtdix.sys (AVG Nätverksanslutning BEVAKARE / AVG Technologies CZ, sro) Device \ Driver \ Tcpip \ Device \ UDP avgtdix.sys (AVG Nätverksanslutning BEVAKARE / AVG Technologies CZ, sro) Device \ Driver \ Tcpip \ Device \ RawIp avgtdix.sys (AVG Nätverksanslutning BEVAKARE / AVG Technologies CZ, sro) Device \ Driver \ Tcpip \ Device \ IPMULTICAST avgtdix.sys (AVG Nätverksanslutning BEVAKARE / AVG Technologies CZ, sro) Device \ Filesystem \ Fastfat \ Fat ShlDrv51.sys (PandaShield föraren / Panda Security, SL) AttachedDevice \ Filesystem \ Fastfat \ Fat fltmgr.sys (Microsoft Filesystem Filter Manager / Microsoft Corporation) ---- EOF - GMER 1.0.15 ---- |
|
#6
19 juni 2009, 15:36
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Tjena det Bra jobbat att få combofix att komplettera, combofix verkligen tog lite skräp i ditt system! Återstår en del arbete kvar att göra men ändå .... 1. Stäng alla öppna webbläsare. 2.Se till att du har stängt av alla anti-virus och anti malware program så att de inte stör driften av ComboFix. 3. Öppna Anteckningar och kopiera / klistra in texten i quotebox nedan till: Kod: File:: C: \ WINDOWS \ system32 \ luruwono.dll c: \ windows \ system32 \ rn.tmp c: \ windows \ system32 \ drivers \ ngaysfvqh.sys c: \ windows \ system32 \ drivers \ ncjdccfwkwt.sys Driver:: sgejhlqxcrvoui vnoakhdmmnhfkc DDS: uInternet Inställningar Proxyserver = http = localhost: 7171 uInternet Settings, ProxyOverride = *. lokala, <local> FF - prefs.js: network.proxy.http - localhost FF - prefs.js: network.proxy. http_port - 7171 FF - prefs.js: network.proxy.type - 4  Med hänvisning till bilden ovan, dra CFScript till ComboFix.exe När du är klar, skall producera en logga åt dig på C: \ ComboFix.txt som jag kommer att kräva i din nästa replik. Hämta ATF Cleaner av Atribune. Detta program är för XP och Windows 2000 Dubbelklicka ATF-Cleaner.exe att köra programmet. Under Huvudsaklig välja: Välj Alla Klicka på Empty Selected knappen. Om du använder Firefox webbläsare Klicka Firefox högst upp och välj: Välj Alla Klicka på Empty Selected knappen. OBS! Om du vill hålla dina sparade lösenord, klicka Nej vid prompten. Om du använder Opera webbläsaren Klicka Opera högst upp och välj: Välj Alla Klicka på Empty Selected knappen. OBS! Om du vill hålla dina sparade lösenord, klicka Nej vid prompten. Klicka Avsluta på huvudmenyn för att stänga programmet. För Teknisk supportDubbelklicka på den e-postadress finns längst ner i varje meny. Upprätta en Internet-anslutning och utföra en online scan med Internet Explorer vid Kaspersky Online Scanner. ** Vista användare - högerklicka IE / Firefox-ikonen och kör som administratör Klicka Acceptera, När du ombeds att ladda ned och installera programmet filer och databas av sabotageprogram definitioner.
Denna animation guidar dig genom processen:  ** Obs ** För att optimera genomlysningsutrustning temne och skapa en mer vettig rapport för granskning: Stäng alla öppna program Stäng av den verkliga Temne scanner av befintliga antivirusprogram när de utför online scan. Du kan koppla ner från Internet när du börjar skanna. Anmärkning för Internet Explorer 7-användare: Om du har problem med att visa godkänn-knappen för licensen klickar du på Zooma verktyg som finns längst ned till höger i IE fönstret och ställ in zoom till 75%. När licens godtas, återställs till 100%. Post tillbaka med resultaten från combofix och från kaspersky scan. Uppdatera mig om hur saker kör nu
__________________ Stolt medlem i ASAP & UNITE |
|
#7
21 juni 2009, 09:08
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. http://www.yahoo.com IE: & Search FF - ProfilePath -. ************************************************** ************************ CatchMe 0.3.1398 W2K/XP/Vista - rootkit / stealth malware detector av Gmer, http://www.gmer.net |
|
#8
21 juni 2009, 14:54
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Hallå där Loggen du postat är oläslig, Kan du repost den med notepad som redaktör och se till att Radbryt är avstängd. Kan prova en annan scanner ... Gör en online scan med Panda ActiveScan
* Stäng av verkliga Temne scanner av befintliga antivirusprogram när de utför online scan. Avast användare Obs! Du ska fortsätta med online scan på Panda om du får en varning. Det är ett falskt positivt från Avast eftersom Panda Antivirus inte kryptera sina virus databas.
__________________ Stolt medlem i ASAP & UNITE |
|
#9
22 juni 2009, 04:28
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Wow. Du har helt rätt om det sista efter Beklagar. Jag har ingen aning om vad som hände (det såg rätt när jag klistras det ändå), men jag ska försöka igen. Active Scan arbetat, men jag tror inte att det faktiskt desinfekterats någonting, jag klickade på knappen och det visade grå, men ingenting hände. Här är loggarna från båda: ComboFix 09-06-20.04 - Ägare 06/21/2009 11:33.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.123 [GMT -4:00] Running from: C: \ Documents and Settings \ Ägare \ Desktop \ Combo-Fix.exe Kommando växlar används:: C: \ Documents and Settings \ Ägare \ Desktop \ CFScript.txt AV: AVG Anti-Virus Free * På tillgång scanning aktiverat * (Uppdaterad) (17DDD097-36FF-435F-9E1B-52D74245D6BF) FW: F-Secure Anti-Virus 2006 6,10 * funktionshindrade * (D4747503-0346-49EB-9262-997542F79BF4) FILE: "c: \ windows \ system32 \ drivers \ ncjdccfwkwt.sys" "c: \ windows \ system32 \ drivers \ ngaysfvqh.sys" "c: \ windows \ system32 \ luruwono.dll" "c: \ windows \ system32 \ rn.tmp" . ((((((((((((((((((((((((((((((((((((((( Andra Strykningar ))))))))) )))))))))))))))))))))))))))))))))))))))) . c: \ windows \ system32 \ rn.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers / Services )))))))) ))))))))))))))))))))))))))))))))))))))))) . ------- \ Legacy_SGEJHLQXCRVOUI ------- \ Legacy_VNOAKHDMMNHFKC ------- \ Service_sgejhlqxcrvoui ------- \ Service_vnoakhdmmnhfkc ((((((((((((((((((((((((( Files Created från 2009-05-21 till 2009-06-21 ))))))))))) )))))))))))))))))))) . 2009-06-19 13:09. 2004-08-04 07:56 50176-c - aw-c: \ windows \ system32 \ dllcache \ proquota.exe 2009-06-19 13:09. 2004-08-04 07:56 50,176 ---- aw-c: \ windows \ system32 \ proquota.exe 2009-06-19 13:09. 2004-08-04 07:56 39424-c - aw-c: \ windows \ system32 \ dllcache \ grpconv.exe 2009-06-19 13:09. 2004-08-04 07:56 39,424 ---- aw-c: \ windows \ system32 \ grpconv.exe 2009-06-18 18:04. 2009-06-18 18:04 3561743 ---- aw C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes \ Malwarebytes' Anti-Malware \ mbam-setup.exe 2009-06-18 15:58. 2009-06-18 18:01 117760 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ SUPERAntiSpyware.com \ SUPERAntiSpyware \ SDDLLS \ UIREPAIR.DLL 2009-06-18 15:57. 2009-06-18 15:57 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ SUPERAntiSpyware.com 2009-06-18 15:54. 2009-06-18 15:57 -------- d ----- w-C: \ Program Files \ SUPERAntiSpyware 2009-06-18 15:54. 2009-06-18 15:54 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ SUPERAntiSpyware.com 2009-06-18 15:53. 2009-06-18 15:53 -------- d ----- w-C: \ Program Files \ Common Files \ Wise Installation Wizard 2009-06-18 15:42. 2009-06-18 15:42 -------- d ----- w-C: \ Program Files \ CCleaner 2009-06-18 05:27. 2009-06-18 05:27 152576 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ söndag \ Java \ jre1.6.0_14 \ lzma.dll 2009-06-18 04:28. 2009-06-18 04:28 -------- d ----- w-C: \ Program Files \ Trend Micro 2009-06-13 07:06. 2002-06-19 23:03 151,552 ---- aw-c: \ windows \ system32 \ igfxres.dll 2009-06-13 06:38. 2002-06-21 15:02 266240 ---- aw-c: \ windows \ system32 \ shpshftr.dll 2009-06-13 06:00. 2009-06-13 06:00 444 ---- aw-c: \ windows \ system32 \ d3d8caps.dat 2009-06-13 05:01. 2009-06-13 05:01 -------- d ----- w C: \ Documents and Settings \ Administratör \ Lokala inställningar \ Application Data \ Mozilla 2009-06-13 04:44. 2009-06-18 04:53 -------- d ----- w-C: \ Program Files \ Startup Optimizer 2009-06-12 23:31. 2009-06-12 23:31 -------- d ----- w C: \ Documents and Settings \ Administratör \ Application Data \ Malwarebytes 2009-06-12 22:21. 2009-05-26 17:20 40160 ---- aw-c: \ windows \ system32 \ drivers \ mbamswissarmy.sys 2009-06-12 22:21. 2009-06-12 22:23 -------- d ----- w-C: \ Program Files \ Malwarebytes' Anti-Malware 2009-06-12 22:21. 2009-05-26 17:19 19096 ---- aw-c: \ windows \ system32 \ drivers \ mbam.sys 2009-06-12 19:18. 2009-06-12 23:26 45 ---- aw-c: \ windows \ system32 \ ca.dat 2009-06-12 18:56. 2008-03-04 19:59 41144 ---- aw-c: \ windows \ system32 \ drivers \ ShlDrv51.sys 2009-06-12 18:56. 2008-02-07 16:03 179640 ---- aw-c: \ windows \ system32 \ drivers \ PavProc.sys 2009-06-12 18:21. 2009-06-12 18:56 -------- d ----- w-C: \ Program Files \ Common Files \ Panda Security 2009-06-03 05:12. 2004-08-04 07:56 221,184 ---- aw-c: \ windows \ system32 \ wmpns.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2009-06-19 01:27. 2008-05-23 05:13 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ avg8 2009-06-18 05:31. 2009-01-05 00:21 410984 ---- aw-c: \ windows \ system32 \ deploytk.dll 2009-06-18 05:31. 2009-01-12 01:18 -------- d ----- w-C: \ Program Files \ Java 2009-06-13 04:50. 2009-01-05 04:50 -------- d ----- w-C: \ Program Files \ Web Publish 2009-06-13 04:49. 2008-08-20 22:26 -------- d ----- w-C: \ Program Files \ Mozilla Thunderbird 2009-06-12 22:57. 2009-04-16 15:22 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ U3 2009-06-12 18:22. 2006-05-02 03:43 -------- d - h - w-C: \ Program Files \ InstallShield Installation Information 2009-06-12 16:10. 2009-04-19 18:00 -------- d ----- w-C: \ Program Files \ Google 2009-06-02 16:49. 2009-03-29 21:27 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ n-Track Studio6 2009-05-15 13:30. 2006-07-15 14:36 -------- d ----- w-C: \ Program Files \ QuickTime 2009-05-15 13:30. 2006-07-15 15:39 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Apple Computer 2009-05-15 13:29. 2009-05-15 13:29 -------- d ----- w-C: \ Program Files \ Apple Software Update 2009-05-15 13:29. 2009-05-15 13:29 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Apple 2009-05-12 19:53. 2009-05-12 19:53 16141 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Help \ lego.exe 2009-05-12 19:53. 2009-05-12 19:53 11410 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Identities \ msgdi.dll 2009-05-12 19:53. 2009-05-12 19:53 10121 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Lavasoft \ kern.dll 2009-05-12 19:53. 2009-05-12 19:53 422 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Apple Computer \ socks1.exe 2009-05-12 19:53. 2009-05-12 19:53 145131 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ DivX \ nomad.exe 2009-05-12 19:53. 2009-05-12 19:53 13221 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ Adobe \ rengo.dll 2009-05-12 19:53. 2009-05-12 19:53 11232 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ acccore \ shalom.exe 2009-05-11 14:21. 2009-05-11 14:21 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ Malwarebytes 2009-05-11 14:20. 2009-05-11 14:20 -------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes 2009-04-22 16:14. 2006-05-03 02:44 -------- d ----- w C: \ Documents and Settings \ Ägare \ Application Data \ n-Track Studio 2009-04-21 07:27. 2006-05-03 02:44 12,024 ---- aw C: \ Documents and Settings \ Ägare \ Lokala inställningar \ Application Data \ GDIPFONTCACHEV1.DAT 2009-04-15 20:25. 2009-04-19 18:01 43528 ------ w-c: \ windows \ system32 \ drivers \ PxHelp20.sys 2009-04-15 20:25. 2009-04-19 18:01 9464 ------ w-c: \ windows \ system32 \ drivers \ cdralw2k.sys 2009-04-15 20:25. 2009-04-19 18:01 9336 ------ w-c: \ windows \ system32 \ drivers \ cdr4_xp.sys 2009-04-15 20:25. 2009-04-19 18:01 120056 ------ w-c: \ windows \ system32 \ pxcpyi64.exe 2009-04-15 20:25. 2009-04-19 18:01 118520 ------ w-c: \ windows \ system32 \ pxinsi64.exe 2009-04-15 20:25. 2009-04-19 18:01 129784 ------ w-c: \ windows \ system32 \ pxafs.dll 2009-04-15 20:24. 2009-04-15 20:24 90112 ---- aw-c: \ windows \ system32 \ dpl100.dll 2009-04-15 20:24. 2009-04-15 20:24 823296 ---- aw-c: \ windows \ system32 \ divx_xx0c.dll 2009-04-15 20:24. 2009-04-15 20:24 823296 ---- aw-c: \ windows \ system32 \ divx_xx07.dll 2009-04-15 20:24. 2009-04-15 20:24 815104 ---- aw-c: \ windows \ system32 \ divx_xx0a.dll 2009-04-15 20:24. 2009-04-15 20:24 802816 ---- aw-c: \ windows \ system32 \ divx_xx11.dll 2009-04-15 20:24. 2009-04-15 20:24 684032 ---- aw-c: \ windows \ system32 \ DivX.dll 2009-04-01 16:35. 2009-04-01 16:34 7040776 ---- aw C: \ Documents and Settings \ Ägare \ Application Data \ MySpace \ IM \ Install \ MSIMClientSetup.1.0.789.0-static-A.exe 2009-04-01 16:33. 2009-04-01 16:33 300800 ---- aw C: \ MySpaceIM_Setup.exe 2009-03-31 23:24. 2009-03-31 23:23 16494272 ---- aw C: \ nTrackSetup.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _16496df1.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _69525f90.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _294823.exe 2009-03-30 22:38. 2009-03-30 22:38 2998 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _18be6784.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _4ae13d6c.exe 2009-03-30 22:38. 2009-03-30 22:38 25214 ---- ar C: \ Documents and Settings \ Ägare \ Application Data \ Microsoft \ Installer \ (47312E0A-043C-409D-B6D0-1482457F2CDA) \ _2cd672ae.exe 2009-02-26 16:20. 2009-02-26 16:20 6309376 ---- aw-C: \ Program Files \ ntrack.exe 2009-02-26 16:05. 2009-02-26 16:05 126976 ---- aw-C: \ Program Files \ AMGateway.ax 2009-02-26 16:05. 2009-02-26 16:05 63168 ---- aw-C: \ Program Files \ RegisterComponents.exe 2009-02-26 16:05. 2009-02-26 16:05 163520 ---- aw-C: \ Program Files \ ReportDump.exe 2009-02-26 16:04. 2009-02-26 16:04 86016 ---- aw-C: \ Program Files \ vstscan.exe 2009-02-26 16:04. 2009-02-26 16:04 45056 ---- aw-C: \ Program Files \ ball.ax 2009-02-26 16:01. 2009-02-26 16:01 78848 ---- aw-C: \ Program Files \ EmptyProjectAction.dll 2009-02-26 16:01. 2009-02-26 16:01 147456 ---- aw-C: \ Program Files \ nTrackDotControls.dll 2009-02-26 16:00. 2009-02-26 16:00 637440 ---- aw-C: \ Program Files \ NativeControls6.dll 2009-02-26 15:59. 2009-02-26 15:59 99328 ---- aw-C: \ Program Files \ SurroundVSTGui.dll 2009-02-26 15:59. 2009-02-26 15:59 45056 ---- aw-C: \ Program Files \ yeti.mmedia.dll 2009-02-26 15:59. 2009-02-26 15:59 40960 ---- aw-C: \ Program Files \ cdcopier.dll 2009-02-26 15:59. 2009-02-26 15:59 28672 ---- aw-C: \ Program Files \ Ripper.dll 2009-02-26 15:59. 2009-02-26 15:59 8704 ---- aw-C: \ Program Files \ ntrack3rdparty.dll 2009-02-26 15:59. 2009-02-26 15:59 5120 ---- aw-C: \ Program Files \ WindowsFormsBase.dll 2009-02-26 15:59. 2009-02-26 15:59 36864 ---- aw-C: \ Program Files \ nttest.dll 2009-02-26 15:59. 2009-02-26 15:59 32768 ---- aw-C: \ Program Files \ nTrackDotNet.dll 2009-02-26 15:59. 2009-02-26 15:59 24576 ---- aw-C: \ Program Files \ AVFader.dll 2009-02-26 15:59. 2009-02-26 15:59 6656 ---- aw-C: \ Program Files \ nativecontrolsinterop.dll 2009-02-07 22:10. 2009-02-07 22:10 528726 ---- aw-C: \ Program Files \ n-Track.htm 2009-02-06 00:15. 2009-02-06 00:15 225792 ---- aw-C: \ Program Files \ AutoVol.dll 2009-02-06 00:14. 2009-02-06 00:14 228352 ---- aw-C: \ Program Files \ Chorus.dll 2009-02-06 00:14. 2009-02-06 00:14 228864 ---- aw-C: \ Program Files \ Echo.dll 2009-02-06 00:12. 2009-02-06 00:12 369152 ---- aw-C: \ Program Files \ ntrck_PitchShift.dll 2009-02-06 00:11. 2009-02-06 00:11 176128 ---- aw-C: \ Program Files \ Riverbero.dll 2009-02-06 00:09. 2009-02-06 00:09 434688 ---- aw-C: \ Program Files \ facomp10.dll 2009-02-06 00:08. 2009-02-06 00:08 379904 ---- aw-C: \ Program Files \ dxirewire.dll 2009-02-06 00:06. 2009-02-06 00:06 951808 ---- aw-C: \ Program Files \ fa4bdeq.dll 2009-01-13 14:16. 2009-01-13 14:16 3455 ---- aw-C: \ Program Files \ order.html 2008-11-28 00:23. 2008-11-28 00:23 642840 ---- aw-C: \ Program Files \ n-track.cfg 2008-10-25 23:46. 2008-10-25 23:46 4920 ---- aw-C: \ Program Files \ order_upgrade.html 2008-09-02 23:06. 2008-09-02 23:06 231936 ---- aw-C: \ Program Files \ ShellCtl.dll 2008-08-31 13:20. 2008-08-31 13:20 105,056 ---- aw-C: \ Program Files \ Setup.bmp 2008-06-20 18:37. 2008-06-20 18:37 24576 ---- aw-C: \ Program Files \ ScrollerAbout.dll 2008-06-20 18:18. 2008-06-20 18:18 831058 ---- aw-C: \ Program Files \ banks_default.txt 2008-06-20 18:18. 2008-06-20 18:18 709 ---- aw-C: \ Program Files \ ntrack.exe.config 2008-06-20 18:18. 2008-06-20 18:18 22124 ---- aw-C: \ Program Files \ us428_faders.dat 2008-06-20 18:18. 2008-06-20 18:18 22124 ---- aw-C: \ Program Files \ us224_faders.dat 2008-06-20 18:17. 2008-06-20 18:17 4035 ---- aw-C: \ Program Files \ n-track_help.cnt 2008-06-20 18:17. 2008-06-20 18:17 169585 ---- aw-C: \ Program Files \ Drum Example.sng 2008-06-20 18:17. 2008-06-20 18:17 15457 ---- aw-C: \ Program Files \ FACOMP10.HLP 2008-06-20 18:17. 2008-06-20 18:17 25698 ---- aw-C: \ Program Files \ FA4BDEQ.HLP 2008-06-20 18:16. 2008-06-20 18:16 19339 ---- aw C: \ Program \ N-TRACK_EFX.HLP 2004-06-11 20:19. 2004-06-11 20:19 25,214 ---- aw-C: \ Program Files \ help_icon.ico 2004-06-07 13:23. 2004-06-07 13:23 25214 ---- aw-C: \ Program Files \ link_icon.ico 2000-11-12 03:30. 2000-11-12 03:30 86 ---- aw-C: \ Program Files \ BUYIT!. URL 2000-11-12 03:28. 2000-11-12 03:28 73 ---- aw-C: \ Program Files \ n-Track.url 2009-04-15 20:24. 2009-04-15 20:24 1044480 ---- aw-C: \ Program Files \ Mozilla Firefox \ plugins \ libdivx.dll 2009-04-15 20:24. 2009-04-15 20:24 200704 ---- aw-C: \ Program Files \ Mozilla Firefox \ plugins \ ssldivx.dll . ((((((((((((((((((((((((((((( SnapShot@2009-06-19_13.16.48 )))))))))))) ))))))))))))))))))))))))))))) . + 2009-06-21 15:41. 2009-06-21 15:41 16384 c: \ windows \ temp \ Perflib_Perfdata_5b4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Not * tomma poster & legit default poster visas inte REGEDIT4 [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "IgfxTray" = "c: \ windows \ system32 \ igfxtray.exe" [2002-06-19 155648] "HotKeysCmds" = "c: \ windows \ system32 \ hkcmd.exe" [2002-06-19 114688] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre6 \ bin \ jusched.exe" [2009-06-18 148888] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "MySpaceIM" = "C: \ Program Files \ MySpace \ IM \ MySpaceIM.exe" [2008-12-12 9555968] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(5AE067D3-9AFB-48E0-853A-EBB7F4A000DA)" = "C: \ Program Files \ SUPERAntiSpyware \ SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ anmäla \! SASWinLogon] 2008-12-22 16:05 356352 ---- aw-C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows] "AppInit_DLLs" = c: \ windows \ system32 \ avgrsstx.dl l [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile] "EnableFirewall" = 0 (0x0) [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgupd.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgemc.exe" = "c: \ \ Program Files \ \ ATT-HSI \ \ McciBrowser.exe" = "c: \ \ Program Files \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "c: \ \ Program Files \ \ AIM6 \ \ aim6.exe" = "c: \ \ WINDOWS \ \ system32 \ \ igfxtray.exe" = "c: \ \ Program Files \ \ AVG \ AVG8 \ \ avgrsx.exe" = "% windir% \ \ system32 \ \ drivers \ \ Svchost.exe" = "c: \ \ Program Files \ MySpace \ IM \ \ MySpaceIM.exe" = [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "53: TCP" = 53: TCP: websrvx R1 AvgLdx86; AVG AVI Loader Driver x86, c: \ windows \ system32 \ drivers \ avgldx86.sys [5/23/2008 1:13 AM 96520] R1 SASDIFSV; SASDIFSV, C: \ Program Files \ SUPERAntiSpyware \ sasdifsv.sys [5/26/2009 10:05 AM 9968] R1 SASKUTIL; SASKUTIL, C: \ Program Files \ SUPERAntiSpyware \ SASKUTIL.SYS [5/26/2009 10:05 AM 72944] R1 ShldDrv; Panda File Shield Driver c: \ windows \ system32 \ drivers \ ShlDrv51.sys [6/12/2009 2:56 PM 41144] R2 avg8emc; AVG8 E-mail Scanner, c: \ progra ~ 1 \ AVG \ AVG8 \ avgemc.exe [5/23/2008 1:13 AM 902424] R2 avg8wd; AVG8 Watchdog, c: \ progra ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe [5/23/2008 1:13 AM 282904] R2 AvgTdiX; AVG8 Network Redirector; c: \ windows \ system32 \ drivers \ avgtdix.sys [5/23/2008 1:13 AM 75272] R2 PavProc; Panda Process Protection Driver c: \ windows \ system32 \ drivers \ PavProc.sys [6/12/2009 2:56 PM 179640] R2 synvinkel Manager Service; synvinkel Manager Service, c: \ program \ synvinkel \ Common \ ViewpointService.exe [2/5/2009 6:56 PM 24652] R3 (A7E39B01-B403-11D4-BD18-00D0B7A1821E); AIM 3.0 Del 01 Codec Driver VCH-A, c: \ windows \ system32 \ drivers \ Vch.sys [5/1/2006 11:58 PM 20023] S2 gupdate1c9c119864b630 Google Update Service (gupdate1c9c119864b630), C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [4/19/2009 2:02 PM 133104] S3 SASENUM; SASENUM, C: \ Program Files \ SUPERAntiSpyware \ SASENUM.SYS [5/26/2009 10:05 AM 7408] . Innehållet i "Schemalagda aktiviteter" mapp 2009-06-21 C: \ Windows \ Tasks \ GoogleUpdateTaskMachine.job - C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2009-04-19 18:00] . . ------- Supplementary Scan ------- . uStart Page = hxxp: / / www.att.net/ uInternet Connection Wizard, ShellNext = iexplore uSearchURL, (Default) = hxxp: / / us.rd.yahoo.com / anpassa / ycomp / defaults / su / *http://www.yahoo.com IE: & Sök FF - ProfilePath -- . ************************************************** ************************ CatchMe 0.3.1398 W2K/XP/Vista - rootkit / stealth malware detector av Gmer, http://www.gmer.net Rootkit scan 2009-06-21 11:42 Windows 5.1.2600 Service Pack 2 NTFS scanning dolda processer ... scanning dold autostart poster ... scanning dolda filer ... scan completed successfully dolda filer: 0 ************************************************** ************************ . --------------------- DLL-filer Loaded Under Running Processes --------------------- - - - - - - -> "Winlogon.exe" (612) C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll . ------------------------ Andra pågående processer ----------------------- -- . C: \ Program Files \ Java \ jre6 \ bin \ jqs.exe C: \ Program Files \ Common Files \ Motive \ McciCMService.exe C: \ Program Files \ Common Files \ Panda Security \ PavShld \ PavPrSrv.exe C: \ Program Files \ AVG \ AVG8 \ avgrsx.exe c: \ windows \ system32 \ wscntfy.exe . ************************************************** ************************ . Tid: 2009-06-21 11:47 - maskinen startas ComboFix-karantän-files.txt 2009-06-21 15:47 ComboFix2.txt 2009-06-19 13:20 Pre-Run: 4974522368 bytes gratis Post-Run: 5621665792 bytes gratis WindowsXP-KB310994-SP2-Hem-BootDisk-SVE.exe [boot loader] timeout = 2 default = multi (0) disk (0) rdisk (0) partition (1) \ WINDOW S [operating systems] c: \ cmdcons \ BOOTSECT.DAT = "Microsoft Windows Recovery Console" / cmdcons multi (0) disk (0) rdisk (0) partition (1) \ WINDOWS = "Micro soft Windows XP Home Edition" / fastdetect / noexecute = OptIn 248 ;************************************************* ************************************************** ************************************************** ****************************** ANALYS: 2009-06-22 07:16:51 Skydd: 1 Malware: 10 Misstänkta: 0 ;************************************************* ************************************************** ************************************************** ****************************** Skydd Beskrivning Version Active Uppdaterad ;================================================= ================================================== ================================================== ================= AVG Anti-Virus Free 8,0 Ja Ja ;================================================= ================================================== ================================================== ================= Malware Id Beskrivning Typ Active Severity Disinfectable desinfekterats Läge ;================================================= ================================================== ================================================== ================= 00139061 Cookie / Doubleclick TrackingCookie nr 0 Yes No C: \ Documents and Settings \ Ägare \ Cookies \ ägaren @ DoubleClick [1]. Txt 00262020 Cookie / Atwola TrackingCookie nr 0 Yes No C: \ Documents and Settings \ Ägare \ Cookies \ ägaren @ atwola [2]. Txt 00590315 rootkit / Agent.LNB HackTools nr 0 Yes No C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP500 \ A0228202.sys 00590315 rootkit / Agent.LNB HackTools nr 0 Yes No C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP501 \ A0229224.sys 00590315 rootkit / Agent.LNB HackTools nr 0 Yes No C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP491 \ A0222017.sys 00590315 rootkit / Agent.LNB HackTools nr 0 Yes No C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP493 \ A0223098.sys 00674736 W32/Autorun.AFX Virus / Worm nr 1 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP491 \ A0221911.dll 00674736 W32/Autorun.AFX Virus / Worm nr 1 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP490 \ A0221821.dll 00950476 Bck / Tdss.AZ Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0233263.dll 00950476 Bck / Tdss.AZ Virus / Trojan nr 0 Ja Ja C: \ Qoobox \ Quarantine \ C \ WINDOWS \ system32 \ UACakmovnk vlbejvsw.dll.vir 00950477 Bck / Tdss.AZ Virus / Trojan nr 0 Ja Ja C: \ Qoobox \ Quarantine \ C \ WINDOWS \ system32 \ UACllkyxud engakpfn.dll.vir 00950477 Bck / Tdss.AZ Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0233264.dll 00966996 Bck / Tdss.BC Virus / Trojan nr 0 Ja Ja C: \ Qoobox \ Quarantine \ C \ WINDOWS \ system32 \ UACkpxjqwv ugnspokq.dll.vir 00966996 Bck / Tdss.BC Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0233265.dll 01099605 Trj / Alureon.AL Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0233262.dll 01099605 Trj / Alureon.AL Virus / Trojan nr 0 Ja Ja C: \ Qoobox \ Quarantine \ C \ WINDOWS \ system32 \ UACxcvrjkw rnbmiqml.dll.vir 01318562 Trj / Downloader.WAV Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP492 \ A0223044.dll 01318562 Trj / Downloader.WAV Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP492 \ A0223065.dll 01318562 Trj / Downloader.WAV Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP492 \ A0223056.dll 01318562 Trj / Downloader.WAV Virus / Trojan nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP492 \ A0223073.dll 02885963 rootkit / Booto.C Virus / Worm nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0234260.sys 02885963 rootkit / Booto.C Virus / Worm nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP505 \ A0235260.sys 02885963 rootkit / Booto.C Virus / Worm nr 0 Ja Ja C: \ System Volume Information \ _restore (0BC9C26D-029D-4DC1-B3DC-4990696A2ECD) \ RP503 \ A0233266.sys ;================================================= ================================================== ================================================== ================= Misstänkta Skickat Läge f ;================================================= ================================================== ================================================== ================= ;================================================= ================================================== ================================================== ================= SÅRBARHET Id Severity Beskrivning f ;================================================= ================================================== ================================================== ================= 208380 HIGH MS09-015 f 208379 HIGH MS09-014 f 208378 HIGH MS09-013 f 208377 HIGH MS09-012 f 206981 HIGH MS09-007 f 206980 HIGH MS09-006 f 204670 HIGH MS09-001 f 203806 HIGH MS08-078 f 203508 HIGH MS08-073 f 203505 HIGH MS08-071 f 202465 HIGH MS08-068 f 201683 HIGH MS08-067 f 201258 HIGH MS08-066 f 201256 HIGH MS08-064 f 201255 HIGH MS08-063 f 201253 HIGH MS08-061 f 201250 HIGH MS08-058 f 209275 HIGH MS08-049 f 209273 HIGH MS08-045 f 196455 MEDIUM MS08-037 f 194861 HIGH MS08-031 f 194860 HIGH MS08-030 f 191618 HIGH MS08-025 f 191617 HIGH MS08-024 f 191614 HIGH MS08-021 f 191613 HIGH MS08-020 f 187735 HIGH MS08-010 f 187733 HIGH MS08-008 f 184380 MEDIUM MS08-002 f 184379 MEDIUM MS08-001 f 182048 HIGH MS07-069 f 182046 HIGH MS07-067 f 179553 HIGH MS07-061 f 176383 HIGH MS07-058 f 176382 HIGH MS07-057 f 170911 HIGH MS07-050 f 170907 HIGH MS07-046 f 170906 HIGH MS07-045 f 170904 HIGH MS07-043 f 114666 HIGH MS06-015 f 93454 MEDIUM MS05-049 f ;================================================= ================================================== ================================================== ================= |
|
#10
22 juni 2009, 09:30
| |||
| |||
| Please help! Min dator är Running Flera virus / malware. Tjena det Observera - Under denna korrigering vi kommer att träda i felsäkert läge. Vänligen skriva ut dessa instruktioner som din Internet-anslutning kommer inte att vara tillgängliga för dig under denna period. Du kan även kopiera och klistra in den rätta i en textfil och spara den i en lätt åtkomlig plats som referens. Citat:
En sak som jag gjorde menar att nämna tidigare var att du verkar ha två antiviruses installeras med ett funktionshinder. Får jag bara fråga är F-Secure en gammal AV där abonnemanget är slut? Trots att Panda skanna plockade upp ett par ex - skanningsinställningarna resultat faktiskt ser bra ut. Det mesta av vad som finns är antingen i karantän av combofix eller fastnar i ditt system återställa som vi kan spola ut i slutet av filen för att förhindra ny smitta. Jag märker att du redan har SUPERAntiSpyware installeras ... Jag vill att du ska köra en scan för mig i felsäkert läge. Först kan uppdatera SAS och ställa in alternativ innan scanning
Starta om datorn i "Felsäkert läge"Med F8 metod. För att göra detta, starta om datorn efter att ha hört din dator piper en gång under starten (men innan Windows ikon) trycka på F8 upprepade gånger. En meny kommer att visas flera valmöjligheter. Använd piltangenterna för att navigera och välja alternativet att köra Windows i "Felsäkert läge". Skanna med SUPERAntiSpyware enligt följande:
__________________ Stolt medlem i ASAP & UNITE |
