1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Infected by heavy malware?

Discussion in 'Malware and Virus Removal Archive' started by Nicklas, 2009/12/11.

Page 1 of 2
  1. 2009/12/11
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    [Resolved] Infected by heavy malware?

    Hi!

    I believe that I got infected by a malware a couple of days ago. It started when i was serfing the web and a really nice and well done pop up came up and said "Infected by a virus, enable protecton ". It looked lika a warning from the windows firewall. I pressed the "enable protection button" and then all hell broke loose. Something that called it self "Anti malware" was installing and i couldnt stop it. I had to Disaple its process called "install.exe" from the Task Manager. The first hing i did was to upgrade my Ad-Aware and physically disabled my network. Now i have new processes running in the task manager and i dont know anythinh about them. This malware is blocking my anti-virus and continuasly connecting with 2 multiply connections to iexplore.exe. My computer freezes time to time by the cuase of to many processes runníng. Dont know what to do and have never heard of this before. Thats why i turn to you for help.

    Since my antivirus did not work i uninstalled it (dont ask me why). And since i dont have an internet connection i used my already installed "hijackthis" to get a log file over my system. Hope it helps. The HJT log did not show all of the running processes and i dont know why it does not, maybe it doesnt matter.

    Here is the HJT log:
    ______________

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:53:16, on 2009-12-11
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Safe mode

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\Internet Explorer\IEXPLORE.EXE
    C:\Program\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Executive Software\Diskeeper\DkIcon.exe "
    O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program\RAM Idle LE\RAM_XP.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: SpywareBlaster.lnk = C:\Program\SpywareBlaster\spywareblaster.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Nicklas\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 6996 bytes
    ______________

    I am on my knees and banging my head to the floor in frustration. Will be really glad if someone wants to give me a helping hand.
     
    Nicklas,
    #1
  2. 2009/12/11
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Welcome to WindowsBBS :)

    Please read this as indicated at the head of the forum and post the logs requested in this thread.

    HJT alone is not sufficient.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2009/12/11
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    At the moment i am on my fathers laptop. My infected computer is unplugged from our network. I need to download DDS to this comp and transfer it through a usb to my comp. It might take a few minutes, but i will be back! :)
     
    Nicklas,
    #3
  5. 2009/12/11
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    Here is the DDS log:


    DDS (Ver_09-12-01.01) - NTFSx86 MINIMAL
    Run by Nicklas at 21:11:45,82 on 2009-12-11
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.511.354 [GMT 1:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\WINDOWS\Explorer.EXE
    J:\Nicklas RÖR EJ\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.facebook.com/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant = hxxp://www.google.com/ie
    BHO: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No File
    BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
    BHO: Trixie.Bho: {b0744341-96e0-4341-9ed2-8bc36ce0ccd0} - mscoree.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
    TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
    uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [DiskeeperSystray] "c:\program\executive software\diskeeper\DkIcon.exe "
    mRun: [RAM Idle Professional] c:\program\ram idle le\RAM_XP.exe
    mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\docume~1\nicklas\start-~1\program\autost~1\spywar~1.lnk - c:\program\spywareblaster\spywareblaster.exe
    uPolicies-explorer: MaxRecentDocs = 11 (0xb)
    IE: Convert link target to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert to existing PDF - c:\program\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: E&xportera till Microsoft Excel - c:\program\micros~3\office11\EXCEL.EXE/3000
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\nicklas\start-meny\program\imvu\Run IMVU.lnk
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
    IE: {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - c:\windows\system32\mscoree.DLL
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~3\office11\REFIEBAR.DLL
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: LMIinit - LMIinit.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-2 64160]
    S0 FGXSCSI;FGXSCSI;c:\windows\system32\drivers\fgxscsi.sys --> c:\windows\system32\drivers\fgxscsi.sys [?]
    S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program\logmein\x86\rainfo.sys --> c:\program\logmein\x86\RaInfo.sys [?]
    S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-3-17 46112]
    S3 DLPORTIO;DLPORTIO;\??\c:\program\visoly\xtremelink\dlportio.sys --> c:\program\visoly\xtremelink\DLPORTIO.SYS [?]
    S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [2006-4-18 52384]
    S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [2006-4-18 6096]
    S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [2006-4-18 87456]
    S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [2006-4-18 79248]
    S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [2006-4-18 77072]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-3-9 1028432]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [2009-9-27 61536]
    S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [2009-9-27 9360]
    S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [2009-9-27 97088]
    S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [2009-9-27 88624]
    S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [2009-9-27 18704]
    S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [2009-9-27 86432]
    S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [2009-9-27 90800]
    S4 LMIRfsClientNP;LMIRfsClientNP; [x]

    =============== Created Last 30 ================

    2009-12-11 18:19:26 0 d-----w- c:\program\Trend Micro
    2009-12-08 17:23:06 0 d-----w- c:\docume~1\nicklas\applic~1\IObit
    2009-12-08 17:23:04 0 d-----w- c:\program\IObit
    2009-12-08 11:10:25 194 ----a-w- c:\windows\system32\srcr.dat
    2009-11-30 19:09:12 0 ----a-r- C:\logwmemory.bin
    2009-11-30 19:07:10 0 d-----w- c:\docume~1\nicklas\applic~1\Soldat
    2009-11-29 15:42:14 3393 ----a-w- c:\windows\system32\wbem\Outlook_01ca710a85f9f7e6.mof

    ==================== Find3M ====================

    2009-12-08 11:32:45 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-11-29 15:42:14 86158 ----a-w- c:\windows\system32\perfc01D.dat
    2009-11-29 15:42:14 450088 ----a-w- c:\windows\system32\perfh01D.dat
    2008-09-15 05:57:47 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091520080916\index.dat
    2007-10-16 14:01:08 3926304 -csha-w- c:\windows\system32\drivers\fidbox.dat
    2007-10-16 14:01:08 136480 -csha-w- c:\windows\system32\drivers\fidbox2.dat

    ============= FINISH: 21:13:05,82 ===============
     
    Nicklas,
    #4
  6. 2009/12/11
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    Here is the atach log:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-12-01.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 2006-02-10 17:30:56
    System Uptime: 2009-12-11 21:09:01 (0 hours ago)

    Motherboard: ASUSTek Computer INC. | | A8NE-FM
    Processor: AMD Athlon(tm) 64 Processor 3500+ | Socket 939 | 2211/201mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 149 GiB total, 41,627 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable
    J: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Hamachi Network Interface
    Device ID: ROOT\NET\0000
    Manufacturer: LogMeIn, Inc.
    Name: Hamachi Network Interface
    PNP Device ID: ROOT\NET\0000
    Service: hamachi

    ==== System Restore Points ===================

    RP1234: 2009-10-22 21:27:01 - Systemkontrollpunkt
    RP1235: 2009-10-22 23:35:26 - Software Distribution Service 3.0
    RP1236: 2009-10-24 00:31:18 - Systemkontrollpunkt
    RP1237: 2009-10-25 15:20:32 - Systemkontrollpunkt
    RP1238: 2009-10-27 15:27:25 - Systemkontrollpunkt
    RP1239: 2009-10-28 17:03:26 - Systemkontrollpunkt
    RP1240: 2009-10-29 16:11:21 - Installed Shaiya(US)
    RP1241: 2009-10-29 16:34:21 - Software Distribution Service 3.0
    RP1242: 2009-10-30 09:39:43 - Bonjour togs bort
    RP1243: 2009-10-30 09:43:42 - Configured Far Cry
    RP1244: 2009-10-31 16:08:58 - Systemkontrollpunkt
    RP1245: 2009-11-02 09:17:31 - Systemkontrollpunkt
    RP1246: 2009-11-03 11:36:25 - Systemkontrollpunkt
    RP1247: 2009-11-04 23:54:20 - Software Distribution Service 3.0
    RP1248: 2009-11-06 17:26:03 - Systemkontrollpunkt
    RP1249: 2009-11-07 18:05:56 - Systemkontrollpunkt
    RP1250: 2009-11-07 18:43:33 - DirectX har installerats
    RP1251: 2009-11-08 21:06:14 - MobileMe Control Panel togs bort
    RP1252: 2009-11-08 21:09:49 - Removed Trixie
    RP1253: 2009-11-09 22:39:11 - Systemkontrollpunkt
    RP1254: 2009-11-11 15:47:31 - Systemkontrollpunkt
    RP1255: 2009-11-12 21:12:33 - Systemkontrollpunkt
    RP1256: 2009-11-12 23:10:03 - Software Distribution Service 3.0
    RP1257: 2009-11-13 21:26:22 - Installed Trixie
    RP1258: 2009-11-13 22:11:03 - Removed Trixie
    RP1259: 2009-11-15 13:24:48 - Systemkontrollpunkt
    RP1260: 2009-11-16 23:50:05 - Systemkontrollpunkt
    RP1261: 2009-11-18 15:34:13 - Installed Trixie
    RP1262: 2009-11-19 17:46:41 - Systemkontrollpunkt
    RP1263: 2009-11-20 19:03:58 - Systemkontrollpunkt
    RP1264: 2009-11-21 19:27:33 - Systemkontrollpunkt
    RP1265: 2009-11-22 23:16:43 - Systemkontrollpunkt
    RP1266: 2009-11-24 15:21:46 - Systemkontrollpunkt
    RP1267: 2009-11-25 19:00:25 - Software Distribution Service 3.0
    RP1268: 2009-11-26 20:50:03 - Systemkontrollpunkt
    RP1269: 2009-11-27 22:52:00 - Systemkontrollpunkt
    RP1270: 2009-11-29 13:53:47 - Systemkontrollpunkt
    RP1271: 2009-11-30 15:11:07 - Systemkontrollpunkt
    RP1272: 2009-12-01 17:01:06 - Systemkontrollpunkt
    RP1273: 2009-12-02 18:56:36 - Systemkontrollpunkt
    RP1274: 2009-12-03 19:21:26 - Systemkontrollpunkt
    RP1275: 2009-12-05 16:48:50 - Systemkontrollpunkt
    RP1276: 2009-12-06 17:12:57 - Systemkontrollpunkt
    RP1277: 2009-12-07 17:42:38 - Systemkontrollpunkt

    ==== Installed Programs ======================

    AAC Decoder
    Ad-Aware
    Adobe Acrobat 7.0 Professional
    Adobe Acrobat 7.1.0 Professional
    Adobe Creative Suite
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe PageMaker Plug-in Pack
    Adobe Photoshop Album 2.0 Starter Edition
    Adobe Shockwave Player 11
    Adobe SVG Viewer 3.0
    Any Video Converter 2.7.6
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft PhotoImpression
    ATI - Software Uninstall Utility
    ATI Catalyst Control Center
    ATI Display Driver
    ATI Kontrollpanel
    Audacity 1.2.6
    AutoUpdate
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    ccc-core-preinstall
    ccc-core-static
    ccc-utility
    CCC Help English
    CCleaner (remove only)
    Compatibility Pack för Office 2007-systemet
    Corel Uninstaller
    Disc2Phone
    Diskeeper Professional Edition
    DivX Codec
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Web Player
    DivX Version Checker
    DScaler 5 Mpeg Decoders
    DVBPortal HDTVPump Filter and Plugin
    Empire Earth II
    EPSON Copy Utility
    EPSON Photo Print
    EPSON Smart Panel
    EPSON TWAIN 5
    H.264 Decoder
    Hamachi 1.0.3.0
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB954550-v5)
    InterVideo WinDVD
    iTunes
    jetAudio Basic VX
    Junk Mail filter update
    KSignAccessToolkit v1.0
    Lexmark Z600 Series
    Macromedia Dreamweaver 8
    Macromedia Extension Manager
    Macromedia Flash 8
    Macromedia Flash 8 Video Encoder
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Standard Edition 2003
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works
    MKV Splitter
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    MSXML 6.0 Parser (KB933579)
    MSXML4 Parser
    NVIDIA Drivers
    OGA Notifier 1.7.0105.35.0
    Pando Media Booster
    QuickTime
    RAM Idle LE
    ScanToWeb
    Segoe UI
    Skins
    Snabbkorrigering för Windows Internet Explorer 7 (KB947864)
    SoftV92 Data Fax Modem with SmartCP
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB938127)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB942615)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB944533)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB950759)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB953838)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB956390)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB958215)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB960714)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB961260)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB963027)
    Säkerhetsuppdatering för Windows Internet Explorer 7 (KB969897)
    Säkerhetsuppdatering för Windows Internet Explorer 8 (KB969897)
    Säkerhetsuppdatering för Windows Internet Explorer 8 (KB971961)
    Säkerhetsuppdatering för Windows Internet Explorer 8 (KB972260)
    Säkerhetsuppdatering för Windows Internet Explorer 8 (KB974455)
    Säkerhetsuppdatering för Windows Media Player (KB911564)
    Säkerhetsuppdatering för Windows Media Player 6.4 (KB925398)
    Säkerhetsuppdatering för Windows XP (KB923689)
    Soldat 1.5.0
    Sony Ericsson PC Suite
    Spotify
    SpywareBlaster 4.2
    The Sims™ 2 för nybörjare
    Trixie
    TweakNow PowerPack 2006 Professional
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Uppdatering för Windows Internet Explorer 8 (KB971930)
    Uppdatering för Windows Internet Explorer 8 (KB976749)
    VC80CRTRedist - 8.0.50727.762
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live inloggningsassistenten
    Windows Live Mail
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WinRAR
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 0.9.6
    XML Paper Specification Shared Components Pack 1.0

    ==== End Of File ===========================
     
    Nicklas,
    #5
  7. 2009/12/11
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Thanks :)

    One of our trained malware analysts will take a look at your logs ASAP, but it may be a day or so before you get a response as they are always very busy. All logs are dealt with in the order received.

    Thank you for your patience.
     
    PeteC,
    #6
  8. 2009/12/11
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    Thank you ver much! I am glad that there are persons out there that accually cares about amatures like me. :D
     
    Nicklas,
    #7
  9. 2009/12/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Please, never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE. If Combofix asks you to install Recovery Console, please allow it.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

    Make sure to run HJT in normal, not safe mode.
     
    broni,
    #8
  10. 2009/12/12
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    I downloaded Combofix, but the malware dont let it start. I believe it blocks it. I have downloaded a couple of other antimalware programs with the same result. I can start the antimalware programs after i disabled a process called "imapi.exe ". What should I do?
     
    Nicklas,
    #9
  11. 2009/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    PM sent.
     
    broni,
    #10
  12. 2009/12/13
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    Advice in PM taken and acted upon. Sending results in the forum post as soon as possible.

    Thanks
     
    Nicklas,
    #11
  13. 2009/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok...
     
    broni,
    #12
  14. 2009/12/13
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    I had forgot that i got spyware blaster installed on my computer. So i uninstalled it and then CFix worked. So i think the PM mirror is unnesserary now that CFix work. I followed the steps posted on this thread.

    The log that CF produced:

    ComboFix 09-12-11.04 - Nicklas 2009-12-13 18:45:04.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.511.216 [GMT 1:00]
    Körs från: c:\documents and settings\Nicklas\Skrivbord\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Nicklas\ .wav
    c:\documents and settings\Nicklas\ .wma
    c:\recycler\S-1-5-21-2504650004-4226526553-2050770396-1003
    c:\windows\system32\h8srtcfg.dat
    c:\windows\system32\srcr.dat

    .
    (((((((((((((((((((((((( Filer Skapade från 2009-11-13 till 2009-12-13 ))))))))))))))))))))))))))))))
    .

    2009-12-13 17:44 . 2009-12-13 17:44 -------- d-----w- C:\32788R22FWJFW
    2009-12-11 18:47 . 2009-12-11 18:48 -------- d-----w- c:\documents and settings\Administratör
    2009-12-11 18:19 . 2009-12-11 18:19 -------- d-----w- c:\program\Trend Micro
    2009-12-08 17:23 . 2009-12-08 17:23 -------- d-----w- c:\documents and settings\Nicklas\Application Data\IObit
    2009-12-08 17:23 . 2009-12-08 17:23 -------- d-----w- c:\program\IObit
    2009-11-30 19:09 . 2009-12-03 15:29 114688 ----a-w- c:\documents and settings\Nicklas\Application Data\Soldat\Battleye\BEClient.dll
    2009-11-30 19:09 . 2009-03-28 18:52 94208 ----a-w- c:\documents and settings\Nicklas\Application Data\Soldat\Battleye\BEServer.dll
    2009-11-30 19:09 . 2009-11-30 19:09 0 ----a-r- C:\logwmemory.bin
    2009-11-30 19:07 . 2009-11-30 19:07 -------- d-----w- c:\documents and settings\Nicklas\Application Data\Soldat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-13 17:33 . 2007-12-16 13:34 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-12-13 17:15 . 2008-03-13 19:58 -------- d-----w- c:\program\Lavasoft
    2009-12-13 17:15 . 2008-01-30 15:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-12-09 18:40 . 2005-10-21 23:23 -------- d--h--w- c:\program\InstallShield Installation Information
    2009-12-09 18:16 . 2006-09-25 15:47 -------- d-----w- c:\program\Java
    2009-12-08 20:39 . 2005-10-21 23:24 -------- d-----w- c:\program\Microsoft Works
    2009-12-08 20:39 . 2008-11-30 20:23 -------- d-----w- c:\documents and settings\Nicklas\Application Data\Any DVD Converter Professional
    2009-12-08 20:39 . 2008-11-19 18:33 -------- d-----w- c:\documents and settings\Nicklas\Application Data\PowerChallenge
    2009-12-08 20:39 . 2008-04-09 19:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
    2009-12-08 20:39 . 2008-03-19 21:23 -------- d-----w- c:\documents and settings\Nicklas\Application Data\Ventrilo
    2009-12-08 20:39 . 2008-01-27 12:29 -------- d-----w- c:\documents and settings\Nicklas\Application Data\Any Video Converter
    2009-12-08 20:39 . 2007-10-05 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\fssg
    2009-12-08 20:39 . 2006-11-09 17:46 -------- d-----w- c:\documents and settings\Nicklas\Application Data\ICAClient
    2009-12-08 20:39 . 2008-10-03 14:59 -------- d-----w- c:\program\DivX
    2009-12-08 20:39 . 2008-02-20 14:54 -------- d-----w- c:\program\Windows Media Connect 2
    2009-12-08 20:39 . 2006-04-06 09:47 -------- d-----w- c:\program\FirstClass
    2009-12-08 20:39 . 2009-06-15 19:30 -------- d-----w- c:\documents and settings\Nicklas\Application Data\uTorrent
    2009-12-07 20:40 . 2009-10-15 14:58 -------- d-----w- c:\documents and settings\Nicklas\Application Data\Spotify
    2009-11-29 15:42 . 2005-10-21 09:21 86158 ----a-w- c:\windows\system32\perfc01D.dat
    2009-11-29 15:42 . 2005-10-21 09:21 450088 ----a-w- c:\windows\system32\perfh01D.dat
    2009-11-17 19:33 . 2008-03-19 21:20 -------- d-----w- c:\program\Windows Live Safety Center
    2009-11-07 18:05 . 2009-12-08 20:54 8530 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1053.dat
    2009-10-30 08:40 . 2008-08-31 19:25 -------- d-----w- c:\program\uTorrent
    2009-10-28 15:21 . 2008-04-09 19:55 -------- d-----w- c:\program\Windows Live
    2009-10-28 15:20 . 2009-10-28 15:20 -------- d-----w- c:\program\Microsoft
    2009-10-15 14:58 . 2009-10-15 14:58 -------- d-----w- c:\program\Spotify
    2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program\mozilla firefox\plugins\libdivx.dll
    2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program\mozilla firefox\plugins\ssldivx.dll
    2007-10-16 14:01 . 2007-10-10 16:36 3926304 -csha-w- c:\windows\system32\drivers\fidbox.dat
    2007-10-16 14:01 . 2007-10-10 16:36 136480 -csha-w- c:\windows\system32\drivers\fidbox2.dat
    .

    (((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Not* Tomma poster & legitima standardposter visas inte.
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan "= "SOUNDMAN.EXE" [2005-08-17 90112]
    "DiskeeperSystray "= "c:\program\Executive Software\Diskeeper\DkIcon.exe" [2005-07-26 184408]
    "RAM Idle Professional "= "c:\program\RAM Idle LE\RAM_XP.exe" [2006-01-17 135168]
    "QuickTime Task "= "c:\program\QuickTime\qttask.exe" [2009-09-04 417792]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "MaxRecentDocs "= 11 (0xb)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
    2007-11-15 17:46 87352 ----a-w- c:\windows\system32\LMIinit.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-09-08 19:09 305440 ----a-w- c:\program\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-09-04 23:54 417792 ----a-w- c:\program\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
    2007-03-27 23:07 593920 ----a-r- c:\program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
    2006-11-10 11:35 90112 -c--a-w- c:\program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001
    "FirewallOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program\\Messenger\\msmsgs.exe "=
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\WINDOWS\\system32\\dplaysvr.exe "=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program\\Spotify\\spotify.exe "=
    "c:\\Program\\Pando Networks\\Media Booster\\PMB.exe "=
    "c:\\Program\\iTunes\\iTunes.exe "=
    "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Soldat\\Soldat.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56769:TCP "= 56769:TCP:pando Media Booster
    "56769:UDP "= 56769:UDP:pando Media Booster

    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-03-17 46112]
    S0 FGXSCSI;FGXSCSI;c:\windows\system32\DRIVERS\fgxscsi.sys --> c:\windows\system32\DRIVERS\fgxscsi.sys [?]
    S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2007-11-30 721904]
    S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program\LogMeIn\x86\RaInfo.sys --> c:\program\LogMeIn\x86\RaInfo.sys [?]
    S3 DLPORTIO;DLPORTIO;\??\c:\program\Visoly\XtremeLink\DLPORTIO.SYS --> c:\program\Visoly\XtremeLink\DLPORTIO.SYS [?]
    S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [2006-04-18 52384]
    S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [2006-04-18 6096]
    S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [2006-04-18 87456]
    S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [2006-04-18 79248]
    S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [2006-04-18 77072]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [2009-09-27 61536]
    S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [2009-09-27 9360]
    S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [2009-09-27 97088]
    S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [2009-09-27 88624]
    S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [2009-09-27 18704]
    S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [2009-09-27 86432]
    S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [2009-09-27 90800]
    S4 LMIRfsClientNP;LMIRfsClientNP; [x]
    .
    ------- Extra genomsökning -------
    .
    uStart Page = hxxp://www.facebook.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Convert link target to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert to existing PDF - c:\program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: E&xportera till Microsoft Excel - c:\program\MICROS~3\OFFICE11\EXCEL.EXE/3000
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Nicklas\Start-meny\Program\IMVU\Run IMVU.lnk
    IE: {{20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - c:\windows\system32\mscoree.DLL
    .
    - - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

    MSConfigStartUp-AlcoholAutomount - c:\program\Alcohol Soft\Alcohol 120\axcmd.exe
    MSConfigStartUp-AppleSyncNotifier - c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    MSConfigStartUp-swg - c:\program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    AddRemove-{F850707C-B6A0-4B56-8709-F89CF8F9AC6D} - c:\documents and settings\Nicklas\Lokala inställningar\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}\EraserSetup32.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-13 18:53
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\npggsvc]
    "ImagePath "= "c:\windows\system32\GameMon.des -service "
    .
    --------------------- LÃ…STA REGISTERNYCKLAR ---------------------

    [HKEY_USERS\S-1-5-21-2589737640-2206272842-2103391042-1009\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_USERS\S-1-5-21-2589737640-2206272842-2103391042-1009\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "?? "=hex:77,ea,82,28,c1,ad,f0,58,49,d8,82,f9,a3,3c,b3,d8,fc,21,a0,af,05,d6,53,
    cb,17,b8,40,76,61,f4,df,d8,8b,e6,90,29,6b,bb,9f,d1,49,3e,a5,ab,08,59,c5,d4,\
    "?? "=hex:dd,34,f7,c8,b4,c7,39,51,70,cb,c6,1f,e4,18,25,72

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1A68D668-6DF3-702D-2A0852A803C1488D}\{D6F2E9CD-48BA-CDDC-BEA31B576464FCAF}\{421B9E29-5D23-2966-C9D7C1E976BC0884}*]
    "1D1OWFM6WKF6TLM3S2BGKKUUDG1 "=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44,
    fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
    "D140211900063D11C8EF10054038389C "= "C?\\WINDOWS\\system32\\FM20ENU.DLL "
    .
    --------------------- DLLer som "laddats" under processer som körs ---------------------

    - - - - - - - > 'winlogon.exe'(608)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\system32\LMIinit.dll
    .
    Sluttid: 2009-12-13 18:56:35
    ComboFix-quarantined-files.txt 2009-12-13 17:56

    Före genomsökningen: 44*892*221*440 byte ledigt
    Efter genomsökningen: 45*359*534*080 byte ledigt

    Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
    - - End Of File - - 1B9999DB1F9943FBCB1E159943A88309
     
    Nicklas,
    #13
  15. 2009/12/13
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    the new hijack this log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:32:25, on 2009-12-13
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Executive Software\Diskeeper\DkService.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\explorer.exe
    C:\Program\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Executive Software\Diskeeper\DkIcon.exe "
    O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program\RAM Idle LE\RAM_XP.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: SpywareBlaster.lnk = C:\Program\SpywareBlaster\spywareblaster.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Nicklas\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 7066 bytes
     
    Nicklas,
    #14
  16. 2009/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Restart computer.

    ===============================================================

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #15
  17. 2009/12/16
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    SUPERAntiSpyware skannings Logg
    http://www.superantispyware.com

    Skapad 12/14/2009 at 10:37 PM

    Applikation Version : 4.31.1000

    Grundregler för Databas Version : 4353
    Spårregler för Databas Version: 1978

    Skannings typ : Komplett Skanning
    Total Skann Tid : 01:04:56

    Minnes objekt skannade : 220
    Minnes hot funna : 0
    Register objekt skannade : 5688
    Register hot funna : 0
    File objekt skannade : 108030
    File hot funna : 0



    Log Malwarebytes' Anti-Malware 1.42
    Databasversion: 3289
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    2009-12-16 19:20:08
    mbam-log-2009-12-16 (19-20-08).txt

    Skanningstyp: Fullständig skanning (C:\|)
    Antal skannade objekt: 238810
    Förfluten tid: 36 minute(s), 22 second(s)

    Infekterade minnesprocesser: 0
    Infekterade minnesmoduler: 0
    Infekterade registernycklar: 0
    Infekterade registervärden: 0
    Infekterade registerdataposter: 0
    Infekterade mappar: 0
    Infekterade filer: 2

    Infekterade minnesprocesser:
    (Inga illasinnade poster hittades)

    Infekterade minnesmoduler:
    (Inga illasinnade poster hittades)

    Infekterade registernycklar:
    (Inga illasinnade poster hittades)

    Infekterade registervärden:
    (Inga illasinnade poster hittades)

    Infekterade registerdataposter:
    (Inga illasinnade poster hittades)

    Infekterade mappar:
    (Inga illasinnade poster hittades)

    Infekterade filer:
    C:\Documents and Settings\Nicklas\Mina dokument\Downloads\Empire Earth 2 + Art of Supremacy\Empire.Earth.II-RELOADED\Crack\rld-ee2kg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{DBBAE9A1-2689-4601-B267-C364167848C5}\RP1277\A0329968.sys (Malware.Packer) -> Quarantined and deleted successfully.
     
    Nicklas,
    #16
  18. 2009/12/16
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    Hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:03:40, on 2009-12-16
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Executive Software\Diskeeper\DkService.exe
    C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program\RAM Idle LE\RAM_XP.exe
    C:\Program\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Executive Software\Diskeeper\DkIcon.exe "
    O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program\RAM Idle LE\RAM_XP.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF20139.cfxxe" /c "C:\ComboFix\C.bat "
    O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: SpywareBlaster.lnk = C:\Program\SpywareBlaster\spywareblaster.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Nicklas\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 7266 bytes
     
    Nicklas,
    #17
  19. 2009/12/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    How is the computer doing?

    You're not running any AV program.
    Download and install one of these:

    - Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

    - free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
    NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.

    If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use Comodo firewall..
    If you decide to install Comodo Internet Security, or just Comodo firewall, make sure, Windows firewall is turned off.

    IMPORTANT! Make sure, you use only ONE antivirus, and ONE firewall.

    After installation, update the program and run full scan.

    Post fresh HJT log.
     
    broni,
    #18
  20. 2009/12/17
    Nicklas

    Nicklas Inactive Thread Starter

    Joined:
    2009/12/11
    Messages:
    15
    Likes Received:
    0
    I installed Avira again, and runned a full scan. It found 2 infected files, which is quarantined and deleted. My computer is running well and i do not have any problems at all. Thank you for all the help! I do really appreciate it.

    Here is the new HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:18:07, on 2009-12-17
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program\Avira\AntiVir Desktop\sched.exe
    C:\Program\Avira\AntiVir Desktop\avguard.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Executive Software\Diskeeper\DkService.exe
    C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program\RAM Idle LE\RAM_XP.exe
    C:\Program\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
    O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Executive Software\Diskeeper\DkIcon.exe "
    O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program\RAM Idle LE\RAM_XP.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: SpywareBlaster.lnk = C:\Program\SpywareBlaster\spywareblaster.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
    O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Nicklas\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 7587 bytes

    Thanks again!
     
    Nicklas,
    #19
  21. 2009/12/17
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very good :)

    Please download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Open JavaRa.exe again and select Search For Updates.
    • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    =============================================================

    Print this post out, since you won't have an access to it, at some point.

    1. Open HijackThis.

    2. Close all windows, except for HijackThis.

    3. Put checkmarks next to the following HijackThis entries:

    - O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    - O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
    - O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
    - O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    - O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    - O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


    4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

    - O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Executive Software\Diskeeper\DkIcon.exe "
    - O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - "http://ibobba.info/game "


    5. Click on Fix checked button.

    6. Restart computer.

    7. Post new HijackThis log.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...