What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] unremovable trojan(s) problem

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
last Saturday, I recognised that my laptop was sufficiently slower than before. On top I received constant error messages of google installer. On Sunday, I started up and suddenly had AV Care running (never heard of that before), I tried to uninstall it, running an AVG 8.5 scan afterwards. It found Win32/Cryptor, as well as Trojan Horse Generic 14.AETA, Trojan Horse Downloader.Zlob.ANZY.

I tried running Spybot, but it wouldn't startup, same with Spyware Blaster.

I read online, that renaming the . exe could help so that's what I did. Ran Spybot, also downloaded and ran (both in normal and later in safe mode) Malwarebytes Anti-Malware and SUPERAntiSpywarePro, which helped me to remove the threats … so I thought. Though Sunday night the SUPER scan result came out clean, it still popped up Monday morning as I was running some more scans. Monday night I thought I had solved it with SUPER and Malwarebytes Anti-Malware showing clean results. This morning however, SUPER came up with following threat:

Trojan.Agent/Gen-Dropper[Temp]

I have spent a lot of time trying to fix this thing, yet to no avail!

I hope you can help me!

Here's my RootRepeal log


ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/02 08:55
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB6B2E000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBAE14000 Size: 8192 File Visible: No Signed: -
Status: -

Name: PCI_PNP8692
Image Path: \Driver\PCI_PNP8692
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB589B000 Size: 49152 File Visible: No Signed: -
Status: -

Name: sppp.sys
Image Path: sppp.sys
Address: 0xBA6A6000 Size: 1052672 File Visible: No Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

SSDT
——————-
#: 017 Function Name: NtAllocateVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb9257b30

#: 041 Function Name: NtCreateKey
Status: Hooked by "sppp.sys" at address 0xba6a70e0

#: 053 Function Name: NtCreateThread
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb92576f0

#: 071 Function Name: NtEnumerateKey
Status: Hooked by "sppp.sys" at address 0xba6c5ca4

#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "sppp.sys" at address 0xba6c6032

#: 108 Function Name: NtMapViewOfSection
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb9257470

#: 119 Function Name: NtOpenKey
Status: Hooked by "sppp.sys" at address 0xba6a70c0

#: 137 Function Name: NtProtectVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb9257c50

#: 160 Function Name: NtQueryKey
Status: Hooked by "sppp.sys" at address 0xba6c610a

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "sppp.sys" at address 0xba6c5f8a

#: 247 Function Name: NtSetValueKey
Status: Hooked by "sppp.sys" at address 0xba6c619c

#: 249 Function Name: NtShutdownSystem
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb9257990

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\Programme\SUPERAntiSpyware\SASKUTIL.sys" at address 0xb6d750b0

#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xb9257d60

==EOF==



Here's the DDS report:



DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 8:52:49,70 on 02.09.2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1413 [GMT 2:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Programme\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programme\Bonjour\mDNSResponder.exe
svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programme\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Benjamin Baar\Desktop\virus\Benjamin\dds.scr
C:\Dokumente und Einstellungen\Benjamin Baar\Desktop\virus\Benjamin\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://altavista.co.uk/
uSearch Bar = hxxp://google.icq.com/search/search_frame.php
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 219.93.178.162:3128
uInternet Settings,ProxyOverride = *.local
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\programme\superantispyware\BUPERAntiSpyware.exe
uRun: [SpybotSD TeaTimer] c:\programme\spybot - search & destroy\TeaTimer.exe
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [iTunesHelper] "c:\programme\itunes\iTunesHelper.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186694380734
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\programme\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL
Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\BTXPPanel.dll
Notify: !SASWinLogon - c:\programme\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\programme\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\dokume~1\benjam~1\anwend~1\mozilla\firefox\profiles\9uva9vku.default\
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL -
FF - prefs.js: keyword.enabled - false
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\dokumente und einstellungen\benjamin baar\anwendungsdaten\mozilla\firefox\profiles\9uva9vku.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll
FF - plugin: c:\programme\google\google earth plugin\npgeplugin.dll
FF - plugin: c:\programme\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\programme\mozilla firefox\plugins\NPinfotl.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-1 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-1 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-1 108552]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2005-2-25 3026]
R1 SASDIFSV;SASDIFSV;c:\programme\superantispyware\sasdifsv.sys [2009-8-5 9968]
R1 SASKUTIL;SASKUTIL;c:\programme\superantispyware\SASKUTIL.SYS [2009-8-5 74480]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-6-16 141312]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-1 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-1 297752]
R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [2005-3-1 1013248]
R3 SASENUM;SASENUM;c:\programme\superantispyware\SASENUM.SYS [2009-8-5 7408]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\sldrv\slazldrv.sys [2005-2-8 226768]
S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\google\update\GoogleUpdate.exe [2009-6-5 133104]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2009-2-6 4352]
S3 DRHARD;DRHARD;\??\c:\windows\system32\drivers\drhard.sys –> c:\windows\system32\drivers\DRHARD.SYS [?]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [2009-2-6 265088]
S3 jgameenp;jgameenp;\??\c:\dokume~1\benjam~1\lokale~1\temp\jgameenp.sys –> c:\dokume~1\benjam~1\lokale~1\temp\jgameenp.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-8-31 38160]
S3 mbr;mbr;\??\c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys –> c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys –> c:\windows\system32\drivers\rootrepeal.sys [?]
S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2009-09-01 09:15 –d—– c:\programme\Sophos
2009-08-31 20:51 –d—– c:\dokume~1\alluse~1\anwend~1\SUPERAntiSpyware.com
2009-08-31 20:51 7,168 a–sh— c:\windows\Thumbs.db
2009-08-31 12:27 –d—– c:\dokume~1\benjam~1\anwend~1\Malwarebytes
2009-08-31 12:10 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 12:10 –d—– c:\dokume~1\alluse~1\anwend~1\Malwarebytes
2009-08-31 12:10 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-08-31 12:10 –d—– c:\programme\Malwarebytes' Anti-Malware
2009-08-31 11:29 –d—– c:\dokumente und einstellungen\benjamin baar\DoctorWeb
2009-08-31 10:56 –d—– c:\programme\SUPERAntiSpyware
2009-08-31 10:56 –d—– c:\dokume~1\benjam~1\anwend~1\SUPERAntiSpyware.com
2009-08-29 21:54 –d—– c:\dokumente und einstellungen\benjamin baar\dwhelper
2009-08-29 17:16 –d—– c:\dokume~1\benjam~1\anwend~1\Logs
2009-08-29 17:09 –d—– C:\spoolerlogs
2009-08-28 20:39 –d—– c:\dokume~1\alluse~1\anwend~1\TVU Networks
2009-08-28 20:39 –d—– c:\dokumente und einstellungen\benjamin baar\LocalLow
2009-08-28 20:39 –d—– c:\programme\TVUPlayer
2009-08-21 19:40 315,392 a——- c:\windows\system32\nvwrshu.dll
2009-08-21 19:39 2,441,216 a——- c:\windows\system32\nvwssr.dll
2009-08-21 19:28 –d—– C:\NVIDIA
2009-08-21 15:09 –d—– c:\programme\OpenAL
2009-08-20 15:45 –d—– c:\windows\system32\CatRoot_bak
2009-08-19 15:25 –d—– c:\programme\Marvell
2009-08-19 15:21 266,088 a——- c:\windows\system32\xactengine2_8.dll
2009-08-19 15:16 –d—– c:\windows\Logs
2009-08-19 15:00 485,920 a——- c:\windows\system32\NVUNINST.EXE
2009-08-19 14:09 –d—– c:\programme\uTorrent
2009-08-19 14:06 –d—– c:\dokume~1\benjam~1\anwend~1\uTorrent
2009-08-18 21:52 –d—– c:\dokume~1\benjam~1\anwend~1\Blitware
2009-08-18 20:45 –d—– c:\dokume~1\alluse~1\anwend~1\Innovative Solutions
2009-08-18 18:07 –d—– c:\programme\PC Drivers HeadQuarters
2009-08-18 13:02 –d—– c:\programme\gemeinsame dateien\DivX Shared
2009-08-18 12:26 –d—– c:\programme\Secunia
2009-08-18 12:25 –d—– c:\dokume~1\benjam~1\anwend~1\ScummVM
2009-08-18 12:25 –d—– c:\programme\ScummVM
2009-08-18 11:58 –d—– c:\programme\iPod
2009-08-16 21:12 56 a—h— c:\windows\system32\ezsidmv.dat
2009-08-16 12:03 372,736 a—-r– c:\windows\system32\LVUI2RC.dll
2009-08-16 12:03 106,496 a—-r– c:\windows\system32\lvcoinst.dll
2009-08-16 12:03 22,016 a—-r– c:\windows\system32\drivers\LVUSBSta.sys
2009-08-16 12:03 204,800 a—-r– c:\windows\system32\LVUI2.dll
2009-08-16 12:03 204,800 a—-r– c:\windows\system32\lvcodec2.dll
2009-08-16 12:03 2,180,096 a—-r– c:\windows\system32\drivers\LVSVF2.sys
2009-08-16 11:56 913,280 a—-r– c:\windows\system32\drivers\LV302AV.SYS
2009-08-15 21:44 –d—– c:\windows\system32\XPSViewer
2009-08-15 21:42 –d—– c:\windows\SxsCaPendDel
2009-08-15 14:18 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx
2009-08-15 14:18 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll
2009-08-06 10:10 282,624 a——- c:\windows\system32\yk51x86.dll

==================== Find3M ====================

2009-08-25 23:27 70,028 a——- c:\dokume~1\benjam~1\anwend~1\wklnhst.dat
2009-08-21 18:55 413,696 a——- c:\windows\system32\wrap_oal.dll
2009-08-21 18:55 110,592 a——- c:\windows\system32\OpenAL32.dll
2009-08-21 13:52 449,044 a——- c:\windows\system32\perfh007.dat
2009-08-21 13:52 80,306 a——- c:\windows\system32\perfc007.dat
2009-08-19 12:28 335,240 a——- c:\windows\system32\drivers\avgldx86.sys
2009-08-19 12:28 11,952 a——- c:\windows\system32\avgrsstx.dll
2009-08-05 10:59 206,336 a——- c:\windows\system32\mswebdvd.dll
2009-07-29 06:34 119,808 a——- c:\windows\system32\t2embed.dll
2009-07-29 06:34 81,920 a——- c:\windows\system32\fontsub.dll
2009-07-17 21:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-06-29 17:55 827,392 a——- c:\windows\system32\wininet.dll
2009-06-29 17:55 78,336 a——- c:\windows\system32\ieencode.dll
2009-06-29 17:55 17,408 a——- c:\windows\system32\corpol.dll
2009-06-25 10:25 737,792 a——- c:\windows\system32\lsasrv.dll
2009-06-25 10:25 301,568 a——- c:\windows\system32\kerberos.dll
2009-06-25 10:25 147,456 a——- c:\windows\system32\schannel.dll
2009-06-25 10:25 136,192 a——- c:\windows\system32\msv1_0.dll
2009-06-25 10:25 56,832 a——- c:\windows\system32\secur32.dll
2009-06-25 10:25 54,272 a——- c:\windows\system32\wdigest.dll
2009-06-15 12:43 78,848 a——- c:\windows\system32\telnet.exe
2009-06-10 16:13 85,504 a——- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-06-10 08:14 132,096 a——- c:\windows\system32\wkssvc.dll
2009-03-06 12:33 87,608 a——- c:\dokume~1\benjam~1\anwend~1\inst.exe
2009-03-06 12:33 47,360 a——- c:\dokume~1\benjam~1\anwend~1\pcouffin.sys
2009-03-06 12:31 94,208 a——- c:\dokume~1\benjam~1\anwend~1\ezplay.sys
2009-02-01 21:15 74,304 a——- c:\dokume~1\benjam~1\anwend~1\GDIPFONTCACHEV1.DAT
2008-02-08 14:29 32 a——- c:\dokume~1\alluse~1\anwend~1\ezsid.dat
2007-08-08 20:26 8 —shr– c:\windows\system32\B641F5EEF4.sys
2007-08-08 20:29 4,184 a–sh— c:\windows\system32\KGyGaAvL.sys

============= FINISH: 8:53:34,17 ===============


Hope you lot can help me!

Cheers!

Attachments:

Post #2
Hi biba82,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
Hi Tomk,

glad that you're helping me!

I have a problem downloading combofix. The links you attached in your reply sooner or later all lead to following hp:

http://www.fortiguard.com/encyclopedia/vir…iblethreat.html

It looks legit, but I have absolutely no clue how to downloa the file from there….

Why is this happening? I am not even sitting on my laptop, but at my girlfriends', which is, supposedly clean.

Hope you can help!

Benjamin
Post #4
Hi Tomk, got the Combo Fix thing sorted. The link was blocked because of the restrictive network settings in the place I live. I just used the proxy settings of my university… I will post the log asap.
Post #5
Hi again Tomk,

here is the result of the ComboFix scan: (SORRY ABOUT THE GERMAN MESSAGES, I HOPE IT'S NOT AN ISSUE!)


ComboFix 09-09-05.03 - Benjamin Baar 06.09.2009 14:16.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1542 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Benjamin Baar\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
ADS - system32: deleted 40 bytes in 1 streams.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\inst.exe
c:\programme\driver
c:\programme\driver\DotNetInstaller.exe
c:\windows\system32\2.tmp
K:\Autorun.inf

.
((((((((((((((((((((((( Dateien erstellt von 2009-08-06 bis 2009-09-06 ))))))))))))))))))))))))))))))
.

2009-09-05 08:33 . 2009-09-05 08:33 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\SUPERAntiSpyware.com
2009-09-05 08:33 . 2009-09-05 08:33 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2009-09-03 21:29 . 2009-09-03 21:29 ——– d—–w- c:\programme\NVIDIA Corporation
2009-09-02 06:51 . 2009-09-02 06:51 ——– d—–w- c:\programme\ERUNT
2009-09-01 07:15 . 2009-09-01 07:15 ——– d—–w- c:\programme\Sophos
2009-08-31 18:51 . 2009-08-31 18:51 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-08-31 10:27 . 2009-08-31 10:27 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Malwarebytes
2009-08-31 10:10 . 2009-08-03 11:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 10:10 . 2009-08-31 10:10 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-31 10:10 . 2009-08-31 10:27 ——– d—–w- c:\programme\Malwarebytes' Anti-Malware
2009-08-31 10:10 . 2009-08-03 11:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 09:29 . 2009-08-31 09:29 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\DoctorWeb
2009-08-31 08:56 . 2009-08-31 18:51 ——– d—–w- c:\programme\SUPERAntiSpyware
2009-08-31 08:56 . 2009-08-31 08:56 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\SUPERAntiSpyware.com
2009-08-29 19:54 . 2009-08-29 19:54 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\dwhelper
2009-08-29 15:16 . 2009-08-29 15:16 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Logs
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\TVU Networks
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\LocalLow
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TVU Networks
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\LocalLow
2009-08-21 17:40 . 2007-08-23 22:15 315392 —-a-w- c:\windows\system32\nvwrshu.dll
2009-08-21 17:39 . 2007-08-23 22:15 2441216 —-a-w- c:\windows\system32\nvwssr.dll
2009-08-21 17:28 . 2009-08-21 17:28 ——– d—–w- c:\programme\NVIDIA
2009-08-20 13:45 . 2009-08-20 13:45 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-08-19 13:25 . 2009-08-19 13:25 ——– d—–w- c:\programme\Marvell
2009-08-19 13:21 . 2007-10-22 01:37 17928 —-a-w- c:\windows\system32\X3DAudio1_2.dll
2009-08-19 13:16 . 2009-08-19 13:16 ——– d—–w- c:\windows\Logs
2009-08-19 13:00 . 2009-07-10 05:01 485920 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-08-19 10:27 . 2009-09-04 23:37 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\vlc
2009-08-18 19:52 . 2009-08-18 19:52 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Blitware
2009-08-18 18:45 . 2009-08-18 18:45 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\Innovative Solutions
2009-08-18 18:45 . 2009-08-18 18:45 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Innovative Solutions
2009-08-18 11:02 . 2009-08-18 11:02 ——– d—–w- c:\programme\Gemeinsame Dateien\DivX Shared
2009-08-18 10:26 . 2009-08-18 10:26 ——– d—–w- c:\programme\Secunia
2009-08-18 10:26 . 2009-08-18 10:26 ——– d—–w- c:\programme\FileZilla FTP Client
2009-08-18 10:25 . 2009-08-18 10:25 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\ScummVM
2009-08-18 10:25 . 2009-08-18 10:25 ——– d—–w- c:\programme\7-Zip
2009-08-18 09:58 . 2009-08-18 09:58 ——– d—–w- c:\programme\iPod
2009-08-16 19:12 . 2009-08-16 19:12 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-08-16 19:12 . 2009-08-16 19:12 ——– d—–w- c:\programme\Gemeinsame Dateien\Skype
2009-08-16 10:03 . 2005-05-27 09:36 372736 —-a-r- c:\windows\system32\LVUI2RC.dll
2009-08-16 10:03 . 2005-05-27 09:31 22016 —-a-r- c:\windows\system32\drivers\LVUSBSta.sys
2009-08-16 10:03 . 2005-05-27 09:19 106496 —-a-r- c:\windows\system32\lvcoinst.dll
2009-08-16 10:03 . 2005-05-27 09:29 204800 —-a-r- c:\windows\system32\LVUI2.dll
2009-08-16 10:03 . 2005-05-27 09:26 204800 —-a-r- c:\windows\system32\lvcodec2.dll
2009-08-16 10:03 . 2005-05-27 09:23 2180096 —-a-r- c:\windows\system32\drivers\LVSVF2.sys
2009-08-16 09:56 . 2005-05-27 09:46 913280 —-a-r- c:\windows\system32\drivers\LV302AV.SYS
2009-08-15 19:44 . 2009-08-15 19:44 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-15 19:43 . 2009-08-15 19:43 ——– d—–w- c:\programme\MSBuild
2009-08-15 19:43 . 2009-08-15 19:43 ——– d—–w- c:\programme\Reference Assemblies
2009-08-15 19:42 . 2009-08-16 08:05 ——– d—–w- c:\windows\SxsCaPendDel
2009-08-15 12:18 . 2009-07-10 13:26 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-06 12:08 . 2007-08-08 19:56 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-09-06 12:02 . 2008-02-08 12:26 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Skype
2009-09-06 11:30 . 2008-02-08 12:29 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\skypePM
2009-09-05 23:23 . 2008-06-16 11:28 ——– d—–w- c:\programme\Spyware Terminator
2009-09-05 23:23 . 2008-06-16 11:28 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Spyware Terminator
2009-09-05 23:20 . 2008-04-25 15:44 ——– d—–w- c:\programme\Gabest
2009-09-05 23:16 . 2007-10-18 16:28 ——– d—–w- c:\programme\Xvid
2009-09-05 23:16 . 2009-05-23 13:28 ——– d—–w- c:\programme\Windows Media Connect 2
2009-09-05 23:16 . 2007-08-09 13:55 ——– d—–w- c:\programme\Windows Media Connect
2009-09-05 23:13 . 2007-08-08 18:16 ——– d–h–w- c:\programme\InstallShield Installation Information
2009-09-03 15:04 . 2007-09-22 10:35 ——– d—–w- c:\programme\Mozilla Thunderbird
2009-09-02 17:52 . 2007-11-03 18:12 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\dvdcss
2009-09-02 07:14 . 2008-02-08 19:24 ——– d—a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
2009-09-02 07:14 . 2008-01-26 10:57 ——– d—–w- c:\programme\SpywareBlaster
2009-08-31 21:57 . 2007-08-08 19:56 ——– d—–w- c:\programme\Spybot - Search & Destroy
2009-08-31 18:51 . 2009-01-18 12:42 ——– d—–w- c:\programme\Free FLV Converter
2009-08-31 18:51 . 2007-08-08 18:26 ——– d—–w- c:\programme\DivX
2009-08-31 18:51 . 2007-08-08 16:50 ——– d—–w- c:\programme\Picture It! Premium 10
2009-08-31 09:13 . 2007-11-01 00:08 ——– d—–w- c:\programme\PeerGuardian2
2009-08-31 08:56 . 2007-08-09 21:40 ——– d—–w- c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2009-08-30 16:38 . 2008-02-09 09:38 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan
2009-08-30 16:25 . 2007-08-22 08:52 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SlySoft
2009-08-30 11:07 . 2007-08-09 18:38 ——– d—–w- c:\programme\Hijack This
2009-08-30 11:04 . 2008-06-04 20:32 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg8
2009-08-30 09:23 . 2008-06-16 11:28 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spyware Terminator
2009-08-29 13:47 . 2009-05-23 13:16 ——– d—–w- c:\programme\SopCast
2009-08-25 21:27 . 2007-08-18 14:44 70028 —-a-w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\wklnhst.dat
2009-08-21 16:55 . 2009-03-22 07:33 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2009-08-21 16:55 . 2009-03-22 07:33 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2009-08-21 12:18 . 2009-07-23 17:35 ——– d—–w- c:\programme\CENEGA
2009-08-21 11:52 . 2004-08-04 12:00 80306 —-a-w- c:\windows\system32\perfc007.dat
2009-08-21 11:52 . 2004-08-04 12:00 449044 —-a-w- c:\windows\system32\perfh007.dat
2009-08-19 13:12 . 2009-06-18 17:20 ——– d—–w- c:\programme\SystemRequirementsLab
2009-08-19 10:28 . 2008-11-01 10:00 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-19 10:28 . 2008-11-01 10:00 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-19 10:28 . 2008-11-01 10:00 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-18 09:58 . 2007-10-24 15:14 ——– d—–w- c:\programme\iTunes
2009-08-18 09:58 . 2007-08-16 20:57 ——– d—–w- c:\programme\Gemeinsame Dateien\Apple
2009-08-18 09:56 . 2007-10-23 14:06 ——– d—–w- c:\programme\QuickTime
2009-08-18 09:43 . 2007-08-08 15:33 74304 —-a-w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-08-18 09:28 . 2007-10-19 15:14 ——– d—–w- c:\programme\VideoLAN
2009-08-16 19:12 . 2008-02-08 12:06 ——– d—–r- c:\programme\Skype
2009-08-16 19:12 . 2008-02-08 12:06 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype
2009-08-06 08:10 . 2009-08-06 08:10 282624 —-a-w- c:\windows\system32\yk51x86.dll
2009-08-05 08:59 . 2004-08-04 12:00 206336 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:34 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:34 . 2004-08-04 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-23 17:40 . 2009-07-23 17:40 ——– d—–w- c:\programme\directx
2009-07-17 19:01 . 2004-08-04 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-04 12:00 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 12:46 . 2007-08-08 18:49 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Ahead
2009-07-13 12:08 . 2009-07-13 12:08 ——– d—–w- c:\programme\Xilisoft
2009-07-13 11:31 . 2008-04-03 22:26 ——– d—–w- c:\programme\Pcsx2_0.9.4
2009-06-29 15:55 . 2004-08-04 12:00 827392 —-a-w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:55 . 2004-08-04 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2004-08-04 12:00 737792 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-04 12:00 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 12:00 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 12:00 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-04 12:00 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-04 12:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2005-02-24 18:14 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-15 10:43 . 2004-08-04 12:00 78848 —-a-w- c:\windows\system32\telnet.exe
2009-06-12 09:40 . 2007-08-10 12:14 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-06-10 14:13 . 2004-08-04 12:00 85504 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2007-08-08 15:19 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-05-13 21:55 . 2009-05-13 21:55 1044480 —-a-w- c:\programme\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 —-a-w- c:\programme\mozilla firefox\plugins\ssldivx.dll
2007-08-08 18:26 . 2007-08-08 18:26 8 –sh–r- c:\windows\system32\B641F5EEF4.sys
2007-08-08 18:29 . 2007-08-08 18:26 4184 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMWlanClient

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"InCDsrvR"=2 (0x2)
"InCDsrv"=2 (0x2)
"iPod Service"=3 (0x3)
"aawservice"=2 (0x2)
"sp_rssrv"=2 (0x2)
"CyberLink Media Library Service"=2 (0x2)
"CLSched"=2 (0x2)
"CLCapSvc"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"MSRSService"=2 (0x2)
"x10nets"=3 (0x3)
"SLService"=2 (0x2)
"NVSvc"=2 (0x2)
"IDriverT"=3 (0x3)
"btwdins"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"AVG8_TRAY"=c:\progra~1\AVG\AVG8\avgtray.exe
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Home Cinema\\PowerCinema\\PowerCinema.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\AVG\\AVG8\\avgemc.exe"=
"c:\\Programme\\AVG\\AVG8\\avgupd.exe"=
"c:\\Programme\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [01.11.2008 12:00 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [01.11.2008 12:00 108552]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [25.02.2005 14:32 3026]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [05.08.2009 16:06 9968]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [05.08.2009 16:06 74480]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [16.06.2008 13:28 141312]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [01.11.2008 12:00 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [01.11.2008 12:00 297752]
R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [01.03.2005 16:13 1013248]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\SLDRV\slazldrv.sys [08.02.2005 14:40 226768]
S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\Google\Update\GoogleUpdate.exe [05.06.2009 11:54 133104]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [06.02.2009 15:15 4352]
S3 DRHARD;DRHARD;\??\c:\windows\system32\DRIVERS\DRHARD.SYS –> c:\windows\system32\DRIVERS\DRHARD.SYS [?]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [06.02.2009 15:14 265088]
S3 jgameenp;jgameenp;\??\c:\dokume~1\BENJAM~1\LOKALE~1\Temp\jgameenp.sys –> c:\dokume~1\BENJAM~1\LOKALE~1\Temp\jgameenp.sys [?]
S3 nvhid;NVIDIA HID Filter Driver;c:\programme\NVIDIA Corporation\ForceWare\NVRemote\nvhid.sys [03.09.2009 23:29 5632]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17.06.2009 14:20 12648]
S3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [05.08.2009 16:06 7408]
.
Inhalt des "geplante Tasks" Ordners

2009-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-06-05 09:54]

2009-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-06-05 09:54]
.
.
——- Zusätzlicher Suchlauf ——-
.
uStart Page = hxxp://altavista.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 219.93.178.162:3128
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Mozilla\Firefox\Profiles\9uva9vku.default\
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL -
FF - prefs.js: keyword.enabled - false
FF - prefs.js: network.proxy.type - 2
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programme\Google\Google Earth Plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPinfotl.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 14:20
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse…

Scanne versteckte Autostarteinträge…

Scanne versteckte Dateien…

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
——————— Gesperrte Registrierungsschluessel ———————

[HKEY_USERS\S-1-5-21-1220945662-1123561945-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:60,0a,c6,d2,7a,9d,72,31,69,82,f6,d2,39,e5,ce,78,08,4e,0d,34,72,af,0a,
ad,16,50,76,6b,54,59,48,31,f4,c7,24,5a,e6,85,ad,1e,c9,aa,ae,25,3f,08,a1,75,\
"??"=hex:c4,d2,a7,97,2b,35,f5,8c,ee,47,f3,3d,23,13,8c,b1

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— Durch laufende Prozesse gestartete DLLs ———————

- - - - - - - > 'winlogon.exe'(584)
c:\programme\SUPERAntiSpyware\SASWINLO.dll
.
Zeit der Fertigstellung: 2009-09-06 14:22
ComboFix-quarantined-files.txt 2009-09-06 12:22

Vor Suchlauf: 5 Verzeichnis(se), 19.294.101.504 Bytes frei
Nach Suchlauf: 5 Verzeichnis(se), 19.267.788.800 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /noguiboot

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
295 — E O F — 2009-09-02 20:46



Looking forward to read from you!
Post #6
biba82,

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
c:\dokumente und einstellungen\benjamin baar\Lokale Einstellungen\temp\jgameenp.sys
c:\windows\system32\DRIVERS\DRHARD.SYS

Driver::
jgameenp
DRHARD

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #7
Here's the ComboFix log:



ComboFix 09-09-05.03 - Benjamin Baar 06.09.2009 19:39.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1590 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Benjamin Baar\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Benjamin Baar\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}

FILE ::
"c:\dokumente und einstellungen\benjamin baar\Lokale Einstellungen\temp\jgameenp.sys"
"c:\windows\system32\DRIVERS\DRHARD.SYS"
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DRHARD
——-\Legacy_JGAMEENP
——-\Service_DRHARD
——-\Service_jgameenp


((((((((((((((((((((((( Dateien erstellt von 2009-08-06 bis 2009-09-06 ))))))))))))))))))))))))))))))
.

2009-09-06 13:50 . 2008-06-21 02:54 65576 —-a-w- c:\windows\system32\drivers\SbFwIm.sys
2009-09-06 13:50 . 2008-10-31 05:09 270888 —-a-r- c:\windows\system32\drivers\SbFw.sys
2009-09-06 13:49 . 2009-09-06 13:49 ——– d—–w- c:\programme\Sunbelt Software
2009-09-05 08:33 . 2009-09-05 08:33 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\SUPERAntiSpyware.com
2009-09-05 08:33 . 2009-09-05 08:33 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2009-09-03 21:29 . 2009-09-03 21:29 ——– d—–w- c:\programme\NVIDIA Corporation
2009-09-02 06:51 . 2009-09-02 06:51 ——– d—–w- c:\programme\ERUNT
2009-09-01 07:15 . 2009-09-01 07:15 ——– d—–w- c:\programme\Sophos
2009-08-31 18:51 . 2009-08-31 18:51 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-08-31 10:27 . 2009-08-31 10:27 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Malwarebytes
2009-08-31 10:10 . 2009-08-03 11:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 10:10 . 2009-08-31 10:10 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-31 10:10 . 2009-08-31 10:27 ——– d—–w- c:\programme\Malwarebytes' Anti-Malware
2009-08-31 10:10 . 2009-08-03 11:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 09:29 . 2009-08-31 09:29 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\DoctorWeb
2009-08-31 08:56 . 2009-08-31 18:51 ——– d—–w- c:\programme\SUPERAntiSpyware
2009-08-31 08:56 . 2009-08-31 08:56 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\SUPERAntiSpyware.com
2009-08-29 19:54 . 2009-08-29 19:54 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\dwhelper
2009-08-29 15:16 . 2009-08-29 15:16 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Logs
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\TVU Networks
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\LocalLow
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TVU Networks
2009-08-28 18:39 . 2009-08-28 18:39 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\LocalLow
2009-08-21 17:40 . 2007-08-23 22:15 315392 —-a-w- c:\windows\system32\nvwrshu.dll
2009-08-21 17:39 . 2007-08-23 22:15 2441216 —-a-w- c:\windows\system32\nvwssr.dll
2009-08-21 17:28 . 2009-08-21 17:28 ——– d—–w- c:\programme\NVIDIA
2009-08-20 13:45 . 2009-08-20 13:45 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-08-19 13:25 . 2009-08-19 13:25 ——– d—–w- c:\programme\Marvell
2009-08-19 13:21 . 2007-10-22 01:37 17928 —-a-w- c:\windows\system32\X3DAudio1_2.dll
2009-08-19 13:16 . 2009-08-19 13:16 ——– d—–w- c:\windows\Logs
2009-08-19 13:00 . 2009-07-10 05:01 485920 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-08-19 10:27 . 2009-09-06 16:50 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\vlc
2009-08-18 19:52 . 2009-08-18 19:52 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Blitware
2009-08-18 18:45 . 2009-08-18 18:45 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\Innovative Solutions
2009-08-18 18:45 . 2009-08-18 18:45 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Innovative Solutions
2009-08-18 11:02 . 2009-08-18 11:02 ——– d—–w- c:\programme\Gemeinsame Dateien\DivX Shared
2009-08-18 10:26 . 2009-08-18 10:26 ——– d—–w- c:\programme\Secunia
2009-08-18 10:26 . 2009-08-18 10:26 ——– d—–w- c:\programme\FileZilla FTP Client
2009-08-18 10:25 . 2009-08-18 10:25 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\ScummVM
2009-08-18 10:25 . 2009-08-18 10:25 ——– d—–w- c:\programme\7-Zip
2009-08-18 09:58 . 2009-08-18 09:58 ——– d—–w- c:\programme\iPod
2009-08-16 19:12 . 2009-08-16 19:12 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-08-16 19:12 . 2009-08-16 19:12 ——– d—–w- c:\programme\Gemeinsame Dateien\Skype
2009-08-16 10:03 . 2005-05-27 09:36 372736 —-a-r- c:\windows\system32\LVUI2RC.dll
2009-08-16 10:03 . 2005-05-27 09:31 22016 —-a-r- c:\windows\system32\drivers\LVUSBSta.sys
2009-08-16 10:03 . 2005-05-27 09:19 106496 —-a-r- c:\windows\system32\lvcoinst.dll
2009-08-16 10:03 . 2005-05-27 09:29 204800 —-a-r- c:\windows\system32\LVUI2.dll
2009-08-16 10:03 . 2005-05-27 09:26 204800 —-a-r- c:\windows\system32\lvcodec2.dll
2009-08-16 10:03 . 2005-05-27 09:23 2180096 —-a-r- c:\windows\system32\drivers\LVSVF2.sys
2009-08-16 09:56 . 2005-05-27 09:46 913280 —-a-r- c:\windows\system32\drivers\LV302AV.SYS
2009-08-15 19:44 . 2009-08-15 19:44 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-15 19:43 . 2009-08-15 19:43 ——– d—–w- c:\programme\MSBuild
2009-08-15 19:43 . 2009-08-15 19:43 ——– d—–w- c:\programme\Reference Assemblies
2009-08-15 19:42 . 2009-08-16 08:05 ——– d—–w- c:\windows\SxsCaPendDel
2009-08-15 12:18 . 2009-07-10 13:26 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-06 17:18 . 2004-08-04 12:00 80306 —-a-w- c:\windows\system32\perfc007.dat
2009-09-06 17:18 . 2004-08-04 12:00 449044 —-a-w- c:\windows\system32\perfh007.dat
2009-09-06 16:57 . 2007-08-08 19:56 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-09-06 12:02 . 2008-02-08 12:26 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Skype
2009-09-06 11:30 . 2008-02-08 12:29 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\skypePM
2009-09-05 23:23 . 2008-06-16 11:28 ——– d—–w- c:\programme\Spyware Terminator
2009-09-05 23:23 . 2008-06-16 11:28 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Spyware Terminator
2009-09-05 23:20 . 2008-04-25 15:44 ——– d—–w- c:\programme\Gabest
2009-09-05 23:16 . 2007-10-18 16:28 ——– d—–w- c:\programme\Xvid
2009-09-05 23:16 . 2009-05-23 13:28 ——– d—–w- c:\programme\Windows Media Connect 2
2009-09-05 23:16 . 2007-08-09 13:55 ——– d—–w- c:\programme\Windows Media Connect
2009-09-05 23:13 . 2007-08-08 18:16 ——– d–h–w- c:\programme\InstallShield Installation Information
2009-09-03 15:04 . 2007-09-22 10:35 ——– d—–w- c:\programme\Mozilla Thunderbird
2009-09-02 17:52 . 2007-11-03 18:12 ——– d—–w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\dvdcss
2009-09-02 07:14 . 2008-02-08 19:24 ——– d—a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
2009-09-02 07:14 . 2008-01-26 10:57 ——– d—–w- c:\programme\SpywareBlaster
2009-08-31 21:57 . 2007-08-08 19:56 ——– d—–w- c:\programme\Spybot - Search & Destroy
2009-08-31 18:51 . 2009-01-18 12:42 ——– d—–w- c:\programme\Free FLV Converter
2009-08-31 18:51 . 2007-08-08 18:26 ——– d—–w- c:\programme\DivX
2009-08-31 18:51 . 2007-08-08 16:50 ——– d—–w- c:\programme\Picture It! Premium 10
2009-08-31 09:13 . 2007-11-01 00:08 ——– d—–w- c:\programme\PeerGuardian2
2009-08-31 08:56 . 2007-08-09 21:40 ——– d—–w- c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2009-08-30 16:38 . 2008-02-09 09:38 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan
2009-08-30 16:25 . 2007-08-22 08:52 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SlySoft
2009-08-30 11:07 . 2007-08-09 18:38 ——– d—–w- c:\programme\Hijack This
2009-08-30 11:04 . 2008-06-04 20:32 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg8
2009-08-30 09:23 . 2008-06-16 11:28 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spyware Terminator
2009-08-29 13:47 . 2009-05-23 13:16 ——– d—–w- c:\programme\SopCast
2009-08-25 21:27 . 2007-08-18 14:44 70028 —-a-w- c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\wklnhst.dat
2009-08-21 16:55 . 2009-03-22 07:33 413696 —-a-w- c:\windows\system32\wrap_oal.dll
2009-08-21 16:55 . 2009-03-22 07:33 110592 —-a-w- c:\windows\system32\OpenAL32.dll
2009-08-21 12:18 . 2009-07-23 17:35 ——– d—–w- c:\programme\CENEGA
2009-08-19 13:12 . 2009-06-18 17:20 ——– d—–w- c:\programme\SystemRequirementsLab
2009-08-19 10:28 . 2008-11-01 10:00 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-19 10:28 . 2008-11-01 10:00 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-19 10:28 . 2008-11-01 10:00 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-18 09:58 . 2007-10-24 15:14 ——– d—–w- c:\programme\iTunes
2009-08-18 09:58 . 2007-08-16 20:57 ——– d—–w- c:\programme\Gemeinsame Dateien\Apple
2009-08-18 09:56 . 2007-10-23 14:06 ——– d—–w- c:\programme\QuickTime
2009-08-18 09:43 . 2007-08-08 15:33 74304 —-a-w- c:\dokumente und einstellungen\Benjamin Baar\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-08-18 09:28 . 2007-10-19 15:14 ——– d—–w- c:\programme\VideoLAN
2009-08-16 19:12 . 2008-02-08 12:06 ——– d—–r- c:\programme\Skype
2009-08-16 19:12 . 2008-02-08 12:06 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype
2009-08-06 08:10 . 2009-08-06 08:10 282624 —-a-w- c:\windows\system32\yk51x86.dll
2009-08-05 08:59 . 2004-08-04 12:00 206336 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:34 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:34 . 2004-08-04 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-23 17:40 . 2009-07-23 17:40 ——– d—–w- c:\programme\directx
2009-07-17 19:01 . 2004-08-04 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-04 12:00 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 12:46 . 2007-08-08 18:49 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Ahead
2009-07-13 12:08 . 2009-07-13 12:08 ——– d—–w- c:\programme\Xilisoft
2009-07-13 11:31 . 2008-04-03 22:26 ——– d—–w- c:\programme\Pcsx2_0.9.4
2009-06-29 15:55 . 2004-08-04 12:00 827392 ——w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:55 . 2004-08-04 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2004-08-04 12:00 737792 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-04 12:00 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 12:00 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 12:00 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-04 12:00 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-04 12:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2005-02-24 18:14 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-15 10:43 . 2004-08-04 12:00 78848 —-a-w- c:\windows\system32\telnet.exe
2009-06-12 09:40 . 2007-08-10 12:14 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-06-10 14:13 . 2004-08-04 12:00 85504 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2007-08-08 15:19 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-05-13 21:55 . 2009-05-13 21:55 1044480 —-a-w- c:\programme\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 —-a-w- c:\programme\mozilla firefox\plugins\ssldivx.dll
2007-08-08 18:26 . 2007-08-08 18:26 8 –sh–r- c:\windows\system32\B641F5EEF4.sys
2007-08-08 18:29 . 2007-08-08 18:26 4184 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-09-06_12.20.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-04 12:00 . 2009-08-21 11:52 67646 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2009-09-06 17:18 67646 c:\windows\system32\perfc009.dat
+ 2008-06-21 02:54 . 2008-06-21 02:54 66600 c:\windows\system32\drivers\sbhips.sys
+ 2009-09-06 13:50 . 2009-09-06 13:50 57344 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
+ 2009-09-06 13:50 . 2009-09-06 13:50 18718 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
+ 2009-09-06 13:50 . 2009-09-06 13:50 18718 c:\windows\Installer\{82B1150E-9B37-49FC-83EB-D52197D900D0}\ARPPRODUCTICON.exe
+ 2004-08-04 12:00 . 2009-09-06 17:18 432690 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2009-08-21 11:52 432690 c:\windows\system32\perfh009.dat
+ 2009-09-06 13:50 . 2009-09-06 13:50 481280 c:\windows\Installer\c9e204.msi
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-23 8478720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"InCDsrvR"=2 (0x2)
"InCDsrv"=2 (0x2)
"iPod Service"=3 (0x3)
"aawservice"=2 (0x2)
"sp_rssrv"=2 (0x2)
"CyberLink Media Library Service"=2 (0x2)
"CLSched"=2 (0x2)
"CLCapSvc"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"MSRSService"=2 (0x2)
"x10nets"=3 (0x3)
"SLService"=2 (0x2)
"NVSvc"=2 (0x2)
"IDriverT"=3 (0x3)
"btwdins"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"AVG8_TRAY"=c:\progra~1\AVG\AVG8\avgtray.exe
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Home Cinema\\PowerCinema\\PowerCinema.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\AVG\\AVG8\\avgemc.exe"=
"c:\\Programme\\AVG\\AVG8\\avgupd.exe"=
"c:\\Programme\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [01.11.2008 12:00 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [01.11.2008 12:00 108552]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [25.02.2005 14:32 3026]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [05.08.2009 16:06 9968]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [05.08.2009 16:06 74480]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [06.09.2009 15:50 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.06.2008 04:54 66600]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [16.06.2008 13:28 141312]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [01.11.2008 12:00 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [01.11.2008 12:00 297752]
R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [01.03.2005 16:13 1013248]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [06.09.2009 15:50 65576]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\SLDRV\slazldrv.sys [08.02.2005 14:40 226768]
S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\Google\Update\GoogleUpdate.exe [05.06.2009 11:54 133104]
S2 SbPF.Launcher;SbPF.Launcher;c:\programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 07:24 95528]
S2 SPF4;Sunbelt Personal Firewall 4;c:\programme\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 07:24 1365288]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [06.02.2009 15:15 4352]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [06.02.2009 15:14 265088]
S3 nvhid;NVIDIA HID Filter Driver;c:\programme\NVIDIA Corporation\ForceWare\NVRemote\nvhid.sys [03.09.2009 23:29 5632]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17.06.2009 14:20 12648]
S3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [05.08.2009 16:06 7408]
.
Inhalt des "geplante Tasks" Ordners

2009-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-06-05 09:54]

2009-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-06-05 09:54]
.
.
——- Zusätzlicher Suchlauf ——-
.
uStart Page = hxxp://altavista.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 219.93.178.162:3128
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\dokumente und einstellungen\Benjamin Baar\Anwendungsdaten\Mozilla\Firefox\Profiles\9uva9vku.default\
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL -
FF - prefs.js: keyword.enabled - false
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programme\Google\Google Earth Plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPinfotl.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 19:48
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse…

Scanne versteckte Autostarteinträge…

Scanne versteckte Dateien…

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
——————— Gesperrte Registrierungsschluessel ———————

[HKEY_USERS\S-1-5-21-1220945662-1123561945-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:60,0a,c6,d2,7a,9d,72,31,69,82,f6,d2,39,e5,ce,78,08,4e,0d,34,72,af,0a,
ad,16,50,76,6b,54,59,48,31,f4,c7,24,5a,e6,85,ad,1e,c9,aa,ae,25,3f,08,a1,75,\
"??"=hex:c4,d2,a7,97,2b,35,f5,8c,ee,47,f3,3d,23,13,8c,b1
.
——————— Durch laufende Prozesse gestartete DLLs ———————

- - - - - - - > 'explorer.exe'(2368)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2009-09-06 19:52
ComboFix-quarantined-files.txt 2009-09-06 17:52
ComboFix2.txt 2009-09-06 12:22

Vor Suchlauf: 5 Verzeichnis(se), 19.104.870.400 Bytes frei
Nach Suchlauf: 5 Verzeichnis(se), 19.063.058.432 Bytes frei

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
296 — E O F — 2009-09-02 20:46
Post #8
biba82,

Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 6 update 16


Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #9
Hi Tomk, the test is finally finished. It took over the three hours last night, just to download the update (that's strange, since the connection speed should actually be higher). The test itself took the whole night. But it seems to have been worth it as the result looks good: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, September 7, 2009 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, September 07, 2009 00:30:08 Records in database: 2754415 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ G:\ K:\ Scan statistics: Objects scanned: 95023 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 06:57:52 No threats found. Scanned area is clean. Selected area has been scanned. Benjamin
Post #11
Hi Tomk, Firefox is veeeeeeery slow and crashes regularly! Took some time to finally get this up, but here are the logs: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 18:12:16,53 on 07.09.2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1523 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: Sunbelt Personal Firewall *enabled* {82B1150E-9B37-49FC-83EB-D52197D900D0} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Programme\Bonjour\mDNSResponder.exe svchost.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFSvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Programme\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Programme\AVG\AVG8\avgcsrvx.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFCl.exe C:\Programme\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\taskmgr.exe C:\Dokumente und Einstellungen\Benjamin Baar\Desktop\virus\Install Software\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://altavista.co.uk/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = 219.93.178.162:3128 uInternet Settings,ProxyOverride = *.local BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [SunJavaUpdateSched] "c:\programme\java\jre6\bin\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186694380734 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\programme\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\BTXPPanel.dll Notify: avgrsstarter - avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\programme\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\dokume~1\benjam~1\anwend~1\mozilla\firefox\profiles\9uva9vku.default\ FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - FF - prefs.js: keyword.enabled - false FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll FF - plugin: c:\programme\google\google earth plugin\npgeplugin.dll FF - plugin: c:\programme\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\programme\mozilla firefox\plugins\NPinfotl.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-1 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-1 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-1 108552] R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2005-2-25 3026] R1 SASDIFSV;SASDIFSV;c:\programme\superantispyware\sasdifsv.sys [2009-8-5 9968] R1 SASKUTIL;SASKUTIL;c:\programme\superantispyware\SASKUTIL.SYS [2009-8-5 74480] R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2009-9-6 270888] R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-6-21 66600] R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-6-16 141312] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-1 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-1 297752] R2 SbPF.Launcher;SbPF.Launcher;c:\programme\sunbelt software\personal firewall\SbPFLnch.exe [2008-10-31 95528] R2 SPF4;Sunbelt Personal Firewall 4;c:\programme\sunbelt software\personal firewall\SbPFSvc.exe [2008-10-31 1365288] R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [2005-3-1 1013248] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [2009-9-6 65576] R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\sldrv\slazldrv.sys [2005-2-8 226768] S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\google\update\GoogleUpdate.exe [2009-6-5 133104] S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2009-2-6 4352] S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [2009-2-6 265088] S3 mbr;mbr;\??\c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys –> c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys [?] S3 nvhid;NVIDIA HID Filter Driver;c:\programme\nvidia corporation\forceware\nvremote\nvhid.sys [2009-9-3 5632] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S3 SASENUM;SASENUM;c:\programme\superantispyware\SASENUM.SYS [2009-8-5 7408] =============== Created Last 30 ================ 2009-09-06 22:56 411,368 a——- c:\windows\system32\deploytk.dll 2009-09-06 22:56 73,728 a——- c:\windows\system32\javacpl.cpl 2009-09-06 20:38 95 a——- c:\windows\system32\productregistry 2009-09-06 20:35 –d—– C:\Sun 2009-09-06 15:50 65,576 a——- c:\windows\system32\drivers\SbFwIm.sys 2009-09-06 15:50 270,888 a—-r– c:\windows\system32\drivers\SbFw.sys 2009-09-06 15:49 –d—– c:\programme\Sunbelt Software 2009-09-06 14:15 a-dshr– C:\cmdcons 2009-09-06 14:13 230,912 a——- c:\windows\PEV.exe 2009-09-06 14:13 161,792 a——- c:\windows\SWREG.exe 2009-09-06 14:13 98,816 a——- c:\windows\sed.exe 2009-09-03 23:29 35,328 a——- c:\windows\system32\NvRemote.cpl 2009-09-03 23:29 –d—– c:\programme\NVIDIA Corporation 2009-09-01 09:15 –d—– c:\programme\Sophos 2009-08-31 20:51 –d—– c:\dokume~1\alluse~1\anwend~1\SUPERAntiSpyware.com 2009-08-31 20:51 7,168 a–sh— c:\windows\Thumbs.db 2009-08-31 12:27 –d—– c:\dokume~1\benjam~1\anwend~1\Malwarebytes 2009-08-31 12:10 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-31 12:10 –d—– c:\dokume~1\alluse~1\anwend~1\Malwarebytes 2009-08-31 12:10 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-31 12:10 –d—– c:\programme\Malwarebytes' Anti-Malware 2009-08-31 11:29 –d—– c:\dokumente und einstellungen\benjamin baar\DoctorWeb 2009-08-31 10:56 –d—– c:\programme\SUPERAntiSpyware 2009-08-31 10:56 –d—– c:\dokume~1\benjam~1\anwend~1\SUPERAntiSpyware.com 2009-08-29 21:54 –d—– c:\dokumente und einstellungen\benjamin baar\dwhelper 2009-08-29 17:16 –d—– c:\dokume~1\benjam~1\anwend~1\Logs 2009-08-28 20:39 –d—– c:\dokume~1\alluse~1\anwend~1\TVU Networks 2009-08-28 20:39 –d—– c:\dokumente und einstellungen\benjamin baar\LocalLow 2009-08-21 19:40 315,392 a——- c:\windows\system32\nvwrshu.dll 2009-08-21 19:39 2,441,216 a——- c:\windows\system32\nvwssr.dll 2009-08-21 19:28 –d—– c:\programme\NVIDIA 2009-08-20 15:45 –d—– c:\windows\system32\CatRoot_bak 2009-08-19 15:25 –d—– c:\programme\Marvell 2009-08-19 15:21 266,088 a——- c:\windows\system32\xactengine2_8.dll 2009-08-19 15:16 –d—– c:\windows\Logs 2009-08-19 15:00 485,920 a——- c:\windows\system32\NVUNINST.EXE 2009-08-18 21:52 –d—– c:\dokume~1\benjam~1\anwend~1\Blitware 2009-08-18 20:45 –d—– c:\dokume~1\alluse~1\anwend~1\Innovative Solutions 2009-08-18 13:02 –d—– c:\programme\gemeinsame dateien\DivX Shared 2009-08-18 12:26 –d—– c:\programme\Secunia 2009-08-18 12:25 –d—– c:\dokume~1\benjam~1\anwend~1\ScummVM 2009-08-18 11:58 –d—– c:\programme\iPod 2009-08-16 21:12 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-16 12:03 372,736 a—-r– c:\windows\system32\LVUI2RC.dll 2009-08-16 12:03 106,496 a—-r– c:\windows\system32\lvcoinst.dll 2009-08-16 12:03 22,016 a—-r– c:\windows\system32\drivers\LVUSBSta.sys 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\LVUI2.dll 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\lvcodec2.dll 2009-08-16 12:03 2,180,096 a—-r– c:\windows\system32\drivers\LVSVF2.sys 2009-08-16 11:56 913,280 a—-r– c:\windows\system32\drivers\LV302AV.SYS 2009-08-15 21:44 –d—– c:\windows\system32\XPSViewer 2009-08-15 21:42 –d—– c:\windows\SxsCaPendDel 2009-08-15 14:18 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx 2009-08-15 14:18 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll ==================== Find3M ==================== 2009-09-07 14:53 70,062 a——- c:\dokume~1\benjam~1\anwend~1\wklnhst.dat 2009-09-06 19:18 449,044 a——- c:\windows\system32\perfh007.dat 2009-09-06 19:18 80,306 a——- c:\windows\system32\perfc007.dat 2009-08-21 18:55 413,696 a——- c:\windows\system32\wrap_oal.dll 2009-08-21 18:55 110,592 a——- c:\windows\system32\OpenAL32.dll 2009-08-19 12:28 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-19 12:28 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-06 10:10 282,624 a——- c:\windows\system32\yk51x86.dll 2009-08-05 10:59 206,336 a——- c:\windows\system32\mswebdvd.dll 2009-07-29 06:34 119,808 a——- c:\windows\system32\t2embed.dll 2009-07-29 06:34 81,920 a——- c:\windows\system32\fontsub.dll 2009-07-17 21:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-06-29 17:55 827,392 ——– c:\windows\system32\wininet.dll 2009-06-29 17:55 78,336 a——- c:\windows\system32\ieencode.dll 2009-06-29 17:55 17,408 a——- c:\windows\system32\corpol.dll 2009-06-25 10:25 737,792 a——- c:\windows\system32\lsasrv.dll 2009-06-25 10:25 301,568 a——- c:\windows\system32\kerberos.dll 2009-06-25 10:25 147,456 a——- c:\windows\system32\schannel.dll 2009-06-25 10:25 136,192 a——- c:\windows\system32\msv1_0.dll 2009-06-25 10:25 56,832 a——- c:\windows\system32\secur32.dll 2009-06-25 10:25 54,272 a——- c:\windows\system32\wdigest.dll 2009-06-15 12:43 78,848 a——- c:\windows\system32\telnet.exe 2009-06-10 16:13 85,504 a——- c:\windows\system32\avifil32.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-10 08:14 132,096 a——- c:\windows\system32\wkssvc.dll 2009-03-06 12:33 47,360 a——- c:\dokume~1\benjam~1\anwend~1\pcouffin.sys 2009-03-06 12:31 94,208 a——- c:\dokume~1\benjam~1\anwend~1\ezplay.sys 2009-02-01 21:15 74,304 a——- c:\dokume~1\benjam~1\anwend~1\GDIPFONTCACHEV1.DAT 2008-02-08 14:29 32 a——- c:\dokume~1\alluse~1\anwend~1\ezsid.dat 2007-08-08 20:26 8 —shr– c:\windows\system32\B641F5EEF4.sys 2007-08-08 20:29 4,184 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 18:13:54,95 ===============

Attachments:

Post #12
biba82,

Are you using a Malaysian proxy on purpose?

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Post #13
Hi Tomk, WTF???!!! I didn't know that! The test didn't detect anything …. Here's the result: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 18:12:16,53 on 07.09.2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.2046.1523 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: Sunbelt Personal Firewall *enabled* {82B1150E-9B37-49FC-83EB-D52197D900D0} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Programme\Bonjour\mDNSResponder.exe svchost.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFSvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Programme\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Programme\AVG\AVG8\avgcsrvx.exe C:\Programme\Sunbelt Software\Personal Firewall\SbPFCl.exe C:\Programme\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\taskmgr.exe C:\Dokumente und Einstellungen\Benjamin Baar\Desktop\virus\Install Software\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://altavista.co.uk/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = 219.93.178.162:3128 uInternet Settings,ProxyOverride = *.local BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [SunJavaUpdateSched] "c:\programme\java\jre6\bin\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186694380734 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\programme\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\BTXPPanel.dll Notify: avgrsstarter - avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\programme\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\dokume~1\benjam~1\anwend~1\mozilla\firefox\profiles\9uva9vku.default\ FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - FF - prefs.js: keyword.enabled - false FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll FF - plugin: c:\programme\google\google earth plugin\npgeplugin.dll FF - plugin: c:\programme\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\programme\mozilla firefox\plugins\NPinfotl.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-1 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-1 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-1 108552] R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2005-2-25 3026] R1 SASDIFSV;SASDIFSV;c:\programme\superantispyware\sasdifsv.sys [2009-8-5 9968] R1 SASKUTIL;SASKUTIL;c:\programme\superantispyware\SASKUTIL.SYS [2009-8-5 74480] R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2009-9-6 270888] R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-6-21 66600] R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-6-16 141312] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-1 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-1 297752] R2 SbPF.Launcher;SbPF.Launcher;c:\programme\sunbelt software\personal firewall\SbPFLnch.exe [2008-10-31 95528] R2 SPF4;Sunbelt Personal Firewall 4;c:\programme\sunbelt software\personal firewall\SbPFSvc.exe [2008-10-31 1365288] R3 LVHybrid;LVHybrid service;c:\windows\system32\drivers\LVHybrid.sys [2005-3-1 1013248] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [2009-9-6 65576] R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\sldrv\slazldrv.sys [2005-2-8 226768] S2 gupdate1c9e5c393d15dc8;Google Update Service (gupdate1c9e5c393d15dc8);c:\programme\google\update\GoogleUpdate.exe [2009-6-5 133104] S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2009-2-6 4352] S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [2009-2-6 265088] S3 mbr;mbr;\??\c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys –> c:\dokume~1\benjam~1\lokale~1\temp\mbr.sys [?] S3 nvhid;NVIDIA HID Filter Driver;c:\programme\nvidia corporation\forceware\nvremote\nvhid.sys [2009-9-3 5632] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648] S3 SASENUM;SASENUM;c:\programme\superantispyware\SASENUM.SYS [2009-8-5 7408] =============== Created Last 30 ================ 2009-09-06 22:56 411,368 a——- c:\windows\system32\deploytk.dll 2009-09-06 22:56 73,728 a——- c:\windows\system32\javacpl.cpl 2009-09-06 20:38 95 a——- c:\windows\system32\productregistry 2009-09-06 20:35 –d—– C:\Sun 2009-09-06 15:50 65,576 a——- c:\windows\system32\drivers\SbFwIm.sys 2009-09-06 15:50 270,888 a—-r– c:\windows\system32\drivers\SbFw.sys 2009-09-06 15:49 –d—– c:\programme\Sunbelt Software 2009-09-06 14:15 a-dshr– C:\cmdcons 2009-09-06 14:13 230,912 a——- c:\windows\PEV.exe 2009-09-06 14:13 161,792 a——- c:\windows\SWREG.exe 2009-09-06 14:13 98,816 a——- c:\windows\sed.exe 2009-09-03 23:29 35,328 a——- c:\windows\system32\NvRemote.cpl 2009-09-03 23:29 –d—– c:\programme\NVIDIA Corporation 2009-09-01 09:15 –d—– c:\programme\Sophos 2009-08-31 20:51 –d—– c:\dokume~1\alluse~1\anwend~1\SUPERAntiSpyware.com 2009-08-31 20:51 7,168 a–sh— c:\windows\Thumbs.db 2009-08-31 12:27 –d—– c:\dokume~1\benjam~1\anwend~1\Malwarebytes 2009-08-31 12:10 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-31 12:10 –d—– c:\dokume~1\alluse~1\anwend~1\Malwarebytes 2009-08-31 12:10 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-31 12:10 –d—– c:\programme\Malwarebytes' Anti-Malware 2009-08-31 11:29 –d—– c:\dokumente und einstellungen\benjamin baar\DoctorWeb 2009-08-31 10:56 –d—– c:\programme\SUPERAntiSpyware 2009-08-31 10:56 –d—– c:\dokume~1\benjam~1\anwend~1\SUPERAntiSpyware.com 2009-08-29 21:54 –d—– c:\dokumente und einstellungen\benjamin baar\dwhelper 2009-08-29 17:16 –d—– c:\dokume~1\benjam~1\anwend~1\Logs 2009-08-28 20:39 –d—– c:\dokume~1\alluse~1\anwend~1\TVU Networks 2009-08-28 20:39 –d—– c:\dokumente und einstellungen\benjamin baar\LocalLow 2009-08-21 19:40 315,392 a——- c:\windows\system32\nvwrshu.dll 2009-08-21 19:39 2,441,216 a——- c:\windows\system32\nvwssr.dll 2009-08-21 19:28 –d—– c:\programme\NVIDIA 2009-08-20 15:45 –d—– c:\windows\system32\CatRoot_bak 2009-08-19 15:25 –d—– c:\programme\Marvell 2009-08-19 15:21 266,088 a——- c:\windows\system32\xactengine2_8.dll 2009-08-19 15:16 –d—– c:\windows\Logs 2009-08-19 15:00 485,920 a——- c:\windows\system32\NVUNINST.EXE 2009-08-18 21:52 –d—– c:\dokume~1\benjam~1\anwend~1\Blitware 2009-08-18 20:45 –d—– c:\dokume~1\alluse~1\anwend~1\Innovative Solutions 2009-08-18 13:02 –d—– c:\programme\gemeinsame dateien\DivX Shared 2009-08-18 12:26 –d—– c:\programme\Secunia 2009-08-18 12:25 –d—– c:\dokume~1\benjam~1\anwend~1\ScummVM 2009-08-18 11:58 –d—– c:\programme\iPod 2009-08-16 21:12 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-16 12:03 372,736 a—-r– c:\windows\system32\LVUI2RC.dll 2009-08-16 12:03 106,496 a—-r– c:\windows\system32\lvcoinst.dll 2009-08-16 12:03 22,016 a—-r– c:\windows\system32\drivers\LVUSBSta.sys 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\LVUI2.dll 2009-08-16 12:03 204,800 a—-r– c:\windows\system32\lvcodec2.dll 2009-08-16 12:03 2,180,096 a—-r– c:\windows\system32\drivers\LVSVF2.sys 2009-08-16 11:56 913,280 a—-r– c:\windows\system32\drivers\LV302AV.SYS 2009-08-15 21:44 –d—– c:\windows\system32\XPSViewer 2009-08-15 21:42 –d—– c:\windows\SxsCaPendDel 2009-08-15 14:18 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx 2009-08-15 14:18 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll ==================== Find3M ==================== 2009-09-07 14:53 70,062 a——- c:\dokume~1\benjam~1\anwend~1\wklnhst.dat 2009-09-06 19:18 449,044 a——- c:\windows\system32\perfh007.dat 2009-09-06 19:18 80,306 a——- c:\windows\system32\perfc007.dat 2009-08-21 18:55 413,696 a——- c:\windows\system32\wrap_oal.dll 2009-08-21 18:55 110,592 a——- c:\windows\system32\OpenAL32.dll 2009-08-19 12:28 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-19 12:28 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-06 10:10 282,624 a——- c:\windows\system32\yk51x86.dll 2009-08-05 10:59 206,336 a——- c:\windows\system32\mswebdvd.dll 2009-07-29 06:34 119,808 a——- c:\windows\system32\t2embed.dll 2009-07-29 06:34 81,920 a——- c:\windows\system32\fontsub.dll 2009-07-17 21:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-06-29 17:55 827,392 ——– c:\windows\system32\wininet.dll 2009-06-29 17:55 78,336 a——- c:\windows\system32\ieencode.dll 2009-06-29 17:55 17,408 a——- c:\windows\system32\corpol.dll 2009-06-25 10:25 737,792 a——- c:\windows\system32\lsasrv.dll 2009-06-25 10:25 301,568 a——- c:\windows\system32\kerberos.dll 2009-06-25 10:25 147,456 a——- c:\windows\system32\schannel.dll 2009-06-25 10:25 136,192 a——- c:\windows\system32\msv1_0.dll 2009-06-25 10:25 56,832 a——- c:\windows\system32\secur32.dll 2009-06-25 10:25 54,272 a——- c:\windows\system32\wdigest.dll 2009-06-15 12:43 78,848 a——- c:\windows\system32\telnet.exe 2009-06-10 16:13 85,504 a——- c:\windows\system32\avifil32.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-10 08:14 132,096 a——- c:\windows\system32\wkssvc.dll 2009-03-06 12:33 47,360 a——- c:\dokume~1\benjam~1\anwend~1\pcouffin.sys 2009-03-06 12:31 94,208 a——- c:\dokume~1\benjam~1\anwend~1\ezplay.sys 2009-02-01 21:15 74,304 a——- c:\dokume~1\benjam~1\anwend~1\GDIPFONTCACHEV1.DAT 2008-02-08 14:29 32 a——- c:\dokume~1\alluse~1\anwend~1\ezsid.dat 2007-08-08 20:26 8 —shr– c:\windows\system32\B641F5EEF4.sys 2007-08-08 20:29 4,184 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 18:13:54,95 ===============
Post #15
Hi again, sorry about that! Here's the log: Malwarebytes' Anti-Malware 1.40 Database version: 2754 Windows 5.1.2600 Service Pack 3 07.09.2009 21:06:32 mbam-log-2009-09-07 (21-06-32).txt Scan type: Quick Scan Objects scanned: 97950 Time elapsed: 7 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Btw: No, I am not using the proxy on purpose. I am working in a place with quite a restrictive access to the internet. It is in Norway, though. I am not aware of my employers proxy settings… Can't help you with that, but will try and find out from the guy who set up the network.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI