[Closed] Date and time suddenly changed to 12 arpil 2016. What to do?
#1
Posted 19 November 2009 - 12:35 PM
Register to Remove
#2
Posted 19 November 2009 - 04:30 PM
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. The logs from our tools can take a while to research, so please be patient and I'd be grateful if you would note the following:
- I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for the issues on this machine.
- Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
- It's often worth reading through these instructions and printing them for ease of reference.
- If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
- Please reply to this thread. Do not start a new topic.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.
I am checking over your log , I will post back shortly with instructions.
Proud Graduate of the WTT Classroom
#3
Posted 20 November 2009 - 02:39 AM
#4
Posted 20 November 2009 - 10:42 AM
Re-Scanning with DDS
Please re-run DDS by sUBs.
Make sure to pay attention to the directions below:
- Disable any script blocking protection (How to Disable your Security Programs)
- Double click DDS icon to run the tool (may take up to 3 minutes to run)
- When done, DDS.txt will open.
- After a few moments, attach.txt will open in a second window.
- Save both reports to your desktop.
- Post the contents of the DDS.txt report in your next reply
- Attach the Attach.txt report to your post by doing the following:
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on to insert the attachment into your post
- Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
- If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
Click the image to enlarge it
- In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
- Save it where you can easily find it, such as your desktop, and attach it in your reply.
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Please make sure you include the following items in your next post:
1. The logs that were produced after running DDS.
2. The log that was produced after running GMER.
Proud Graduate of the WTT Classroom
#5
Posted 21 November 2009 - 10:20 AM
DDS.txt:
DDS (Ver_09-10-26.01) - NTFSx86
Run by Joakim at 13:18:50,56 on 2009-11-21
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1014.621 [GMT 1:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\Atheros\ACU.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program\Synaptics\SynTP\SynTPLpr.exe
C:\Program\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE
C:\Program\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\bcd3kcpan.exe
C:\Program\Delade filer\Nokia\MPlatform\NokiaMServer.exe
C:\Program\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Joakim\Skrivbord\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyOverride = *.local;<local>
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [ACU] c:\program\atheros\ACU.exe -nogui
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SynTPLpr] c:\program\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program\synaptics\syntp\SynTPEnh.exe
mRun: [EPSON Stylus DX5000 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibve.exe /fu "c:\windows\temp\E_SCF.tmp" /EF "HKLM"
mRun: [QuickTime Task] "c:\program\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [BCD3000] %SystemRoot%\system32\bcd3kcpan.exe
mRun: [NokiaMServer] c:\program\delade filer\nokia\mplatform\NokiaMServer /watchfiles
mRun: [NokiaMusic FastStart] "c:\program\nokia\nokia music\NokiaMusic.exe" /command:faststart
mRun: [AdobeCS4ServiceManager] "c:\program\delade filer\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Save YouTube Video as MP3 - c:\program\delade filer\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1246127144390
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program\delade~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {67KLN5J0-4OPM-01WE-AAX2-5657QCA554112} - c:\sud\ssow\sep.exe
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\joakim\applic~1\mozilla\firefox\profiles\q5lqbj6p.default\
FF - component: c:\program\delade filer\dvdvideosoft\dll\ffcontextmenuy\components\FFContextMenu.dll
FF - plugin: c:\documents and settings\joakim\lokala instã¤llningar\application data\myvrnpapi\npmyvr.dll
FF - plugin: c:\program\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program\veetle\player\npvlc.dll
FF - plugin: c:\program\veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");
============= SERVICES / DRIVERS ===============
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2003-4-24 14336]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-3-4 8704]
R2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-1-14 4010]
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [2009-8-10 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [2009-8-10 21600]
S3 kwwalpgr;kwwalpgr;c:\docume~1\joakim\lokala~1\temp\kwwalpgr.sys [2003-3-2 31232]
=============== Created Last 30 ================
2009-11-12 22:50:19 0 d-sh--r- C:\SUD
2009-11-12 17:46:25 14385 ----a-w- c:\documents and settings\joakim\.recently-used.xbel
2009-11-07 01:30:23 0 d-----w- c:\program\Hasbro
2009-11-03 23:19:43 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-11-03 23:19:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-11-03 23:14:53 0 d-----w- c:\docume~1\alluse~1\applic~1\Nokia
==================== Find3M ====================
2009-11-14 13:55:25 443186 ----a-w- c:\windows\system32\perfh01D.dat
2009-11-14 13:55:24 82334 ----a-w- c:\windows\system32\perfc01D.dat
2009-10-11 03:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-11 14:19:53 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05:41 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:00:24 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:02:18 247326 ----a-w- c:\windows\system32\strmdll.dll
============= FINISH: 13:19:44,56 ===============
GMER.txt:
GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-11-21 17:08:42
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Joakim\LOKALA~1\Temp\kfpyiaow.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
---- EOF - GMER 1.0.15 ----
Attach.txt:
Attach.txt 11.86KB 777 downloads
Thank you once again for helping me out. Just want to point out that from what I understand you didn't post any link on where to download GMER. It was no stress, I searched the forum and downloaded it anyway. I hope I did everything correct.
Talk to you soon!
#6
Posted 22 November 2009 - 11:08 AM
- Double-click My Computer.
- Click the Tools menu, and then click Folder Options.
- Click the View tab.
- Uncheck "Hide file extensions for known file types."
- Under the "Hidden files" folder, select "Show hidden files and folders."
- Uncheck "Hide protected operating system files."
- Click Apply, and then click OK.
Please go to: VirusTotal
- Click the Browse button and search for the following file: c:\docume~1\joakim\lokala~1\temp\kwwalpgr.sys
- Click Open
- Then click Send File
- Please be patient while the file is scanned.
- Once the scan results appear, please provide them in your next reply.
Please post the results in your next reply
Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
- Double click on ComboFix.exe & follow the prompts.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
- Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
- Click on Yes, to continue scanning for malware.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Please make sure you include the following items in your next post:
1. The results of the VirusTotal scan.
2. The log that was produced after running ComboFix.
3. An update on the status of your computer.
Proud Graduate of the WTT Classroom
#7
Posted 23 November 2009 - 05:09 PM
Here are the results from VirusTotal scan:
Fil kwwalpgr.sys mottagen 2009.11.23 22:33:47 (UTC)
Närvarande status: Laddar ... köad väntar söker genomförd EJ FUNNEN STOPPAD
Resultat: 0/40 (0%)
Laddar server information...
Din fil är köad i position: 3.
Uppskattat starttid är mellan 60 och 85 sekunder.
Stäng inte ner detta fönster förens sökningen är genomförd.
Scannern som arbetade med din fil har stoppat, vi kommer att vänta ett par sekunder för att försöka återställa ditt resultat.
Om du väntar i mer än 5 minuter måste du skicka in din fil igen.
Din fil blir genomsökt av VirusTotal för tillfället,
resultat kommer att visas när de är klara.
Compact Compact
Skriv ut resultat Skriv ut resultat
Din fil har upphört eller existerar inte.
Tjänsten är stoppad för tillfället, din fil väntar på att bli genomsökt (position: ) för en obestämd tid.
Du kan vänta på ett svar (automatisk uppdatering) eller ange din email i formuläret nedan och klicka "begär" så kommer systemet att skicka dig ett email när sökningen är genomförd.
Email:
Antivirus Version Senaste Uppdatering Resultat
a-squared 4.5.0.43 2009.11.23 -
AhnLab-V3 5.0.0.2 2009.11.23 -
AntiVir 7.9.1.70 2009.11.23 -
Antiy-AVL 2.0.3.7 2009.11.23 -
Authentium 5.2.0.5 2009.11.23 -
Avast 4.8.1351.0 2009.11.23 -
AVG 8.5.0.425 2009.11.23 -
BitDefender 7.2 2009.11.23 -
CAT-QuickHeal 10.00 2009.11.23 -
ClamAV 0.94.1 2009.11.23 -
Comodo 3013 2009.11.23 -
DrWeb 5.0.0.12182 2009.11.23 -
eSafe 7.0.17.0 2009.11.23 -
eTrust-Vet 35.1.7137 2009.11.23 -
F-Prot 4.5.1.85 2009.11.23 -
Fortinet 3.120.0.0 2009.11.23 -
GData 19 2009.11.23 -
Ikarus T3.1.1.74.0 2009.11.23 -
Jiangmin 11.0.800 2009.11.23 -
K7AntiVirus 7.10.903 2009.11.23 -
Kaspersky 7.0.0.125 2009.11.23 -
McAfee 5811 2009.11.23 -
McAfee+Artemis 5811 2009.11.23 -
McAfee-GW-Edition 6.8.5 2009.11.23 -
Microsoft 1.5302 2009.11.23 -
NOD32 4631 2009.11.23 -
Norman 6.03.02 2009.11.23 -
nProtect 2009.1.8.0 2009.11.23 -
Panda 10.0.2.2 2009.11.23 -
PCTools 7.0.3.5 2009.11.23 -
Prevx 3.0 2009.11.23 -
Rising 22.23.00.09 2009.11.23 -
Sophos 4.47.0 2009.11.23 -
Sunbelt 3.2.1858.2 2009.11.23 -
Symantec 1.4.4.12 2009.11.23 -
TheHacker 6.5.0.2.076 2009.11.23 -
TrendMicro 9.0.0.1003 2009.11.23 -
VBA32 3.12.12.0 2009.11.22 -
ViRobot 2009.11.23.2049 2009.11.23 -
VirusBuster 5.0.21.0 2009.11.23 -
Övrig information
File size: 31232 bytes
MD5...: 9e902ad0e29f342f0b145466044ff7a0
SHA1..: 50a3de5696e511cac27c09a6e697161b1a30a349
SHA256: 9a3d48e334982d203b80a45f0a67e4b9f6ec7926fb83cddfc477a73790cdfbdf
ssdeep: 384:sV7BL971Vf57q9rbZuXI8woZFnXnKRtrMrv6ATCptii6wJ7PHFI8V9I7gAy:
sVDfex8naRtr1S2q80R
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1fb0
timedatestamp.....: 0x4395b421 (Tue Dec 06 15:54:09 2005)
machinetype.......: 0x14c (I386)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5f38 0x6000 5.97 071dbff74d11b1d59bacccd448acbe41
.rdata 0x7000 0x4f4 0x600 4.66 57f17eea5efed6557c713575ec96af96
.data 0x8000 0xb78 0x200 0.10 d0a0a7e2f73d139162bee2a3160d89ab
INIT 0x9000 0x694 0x800 4.72 975ec054cd51f4473e16ff3368b82968
.reloc 0xa000 0x488 0x600 5.49 b3f830bd075673cb5644d434ea3ee002
( 2 imports )
> ntoskrnl.exe: ExAllocatePoolWithTag, IoGetDeviceObjectPointer, RtlInitUnicodeString, ObfDereferenceObject, ZwClose, ZwReadFile, ZwQueryInformationFile, ZwCreateFile, IoRegisterDriverReinitialization, IofCompleteRequest, IoUnregisterPlugPlayNotification, KeSetEvent, DbgBreakPoint, IoFreeWorkItem, IoRegisterPlugPlayNotification, IoQueueWorkItem, KeWaitForSingleObject, IoAllocateWorkItem, RtlCompareMemory, KeInitializeEvent, IoCreateDevice, IoDeleteDevice, IoDeleteSymbolicLink, IofCallDriver, IoBuildSynchronousFsdRequest, RtlUnicodeStringToAnsiString, ZwQueryValueKey, ZwOpenKey, ZwWriteFile, KeQuerySystemTime, PsGetCurrentProcessId, IoGetAttachedDeviceReference, DbgPrint, MmMapLockedPagesSpecifyCache, RtlCompareUnicodeString, IoBuildDeviceIoControlRequest, RtlAnsiStringToUnicodeString, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, RtlCopyUnicodeString, RtlEqualUnicodeString, RtlAppendUnicodeStringToString, RtlUnicodeStringToInteger, RtlIntegerToUnicodeString, IoFreeMdl, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, _except_handler3, MmUnmapLockedPages, memset, memcpy, RtlFreeAnsiString, ExFreePool, RtlInitAnsiString, KeInitializeSpinLock
> HAL.dll: KeStallExecutionProcessor, KeGetCurrentIrql, KfAcquireSpinLock, KfReleaseSpinLock, KeQueryPerformanceCounter
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Here are the results from Combofix:
ComboFix 09-11-23.01 - Joakim 2009-11-23 23:45.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1014.663 [GMT 1:00]
Körs från: c:\documents and settings\Joakim\Skrivbord\ComboFix.exe
* Skapade en ny återställningspunkt
.
(((((((((((((((((((((((( Filer Skapade från 2009-10-23 till 2009-11-23 ))))))))))))))))))))))))))))))
.
2009-11-12 22:50 . 2009-11-12 22:50 -------- d-----r- C:\SUD
2009-11-07 01:30 . 2009-11-07 01:30 -------- d-----w- c:\program\Hasbro
2009-11-03 23:19 . 2001-09-06 19:33 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-11-03 23:19 . 2008-04-14 17:04 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-11-03 23:16 . 2009-11-03 23:15 24411168 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_1.8.10SE.exe
2009-11-03 23:15 . 2009-11-03 23:15 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2009-11-03 23:15 . 2009-11-03 23:15 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2009-11-03 23:15 . 2009-11-03 23:15 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2009-11-03 23:15 . 2009-11-03 23:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-11-03 23:14 . 2009-11-03 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-11-03 22:57 . 2009-11-03 22:57 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:00 . 2009-11-03 17:06 -------- d-----w- c:\documents and settings\Joakim\Application Data\dvdcss
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-23 22:40 . 2009-06-30 23:12 -------- d-----w- c:\documents and settings\Joakim\Application Data\uTorrent
2009-11-21 18:28 . 2009-06-27 22:38 -------- d-----w- c:\documents and settings\Joakim\Application Data\Spotify
2009-11-21 17:37 . 2009-09-27 21:39 -------- d-----w- c:\documents and settings\Joakim\Application Data\vlc
2009-11-18 18:33 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\Skype
2009-11-18 18:31 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\skypePM
2009-11-14 13:55 . 2003-04-24 12:00 443186 ----a-w- c:\windows\system32\perfh01D.dat
2009-11-14 13:55 . 2003-04-24 12:00 82334 ----a-w- c:\windows\system32\perfc01D.dat
2009-11-12 17:46 . 2009-10-19 12:42 -------- d-----w- c:\documents and settings\Joakim\Application Data\gtk-2.0
2009-11-12 17:28 . 2009-07-31 10:35 1 ----a-w- c:\documents and settings\Joakim\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-03 23:17 . 2009-09-03 11:40 -------- d-----w- c:\program\Delade filer\Nokia
2009-11-03 23:17 . 2009-09-03 11:38 -------- d-----w- c:\program\Nokia
2009-11-03 23:13 . 2009-09-03 12:04 -------- d-----w- c:\documents and settings\Joakim\Application Data\Nseries
2009-11-03 22:57 . 2009-07-31 10:31 -------- d-----w- c:\program\Java
2009-10-19 15:00 . 2009-08-10 11:29 -------- d-----w- c:\program\Audacity
2009-10-19 12:37 . 2009-10-19 12:37 -------- d-----w- c:\program\GIMP-2.0
2009-10-18 17:04 . 2009-10-18 16:46 -------- d-----w- c:\documents and settings\Joakim\Application Data\FileZilla
2009-10-18 16:45 . 2009-10-18 16:45 -------- d-----w- c:\program\FileZilla FTP Client
2009-10-11 03:17 . 2009-07-31 10:32 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-06 20:26 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live
2009-10-06 20:26 . 2009-10-06 20:26 -------- d-----w- c:\program\Microsoft
2009-10-06 20:25 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live SkyDrive
2009-10-06 20:14 . 2009-10-06 20:14 -------- d-----w- c:\program\Delade filer\Windows Live
2009-09-30 12:59 . 2009-08-01 14:22 -------- d-----w- c:\program\Delade filer\DVDVideoSoft
2009-09-28 12:26 . 2009-09-09 21:03 -------- d-----w- c:\documents and settings\Joakim\Application Data\TraderaProLister
2009-09-11 14:19 . 2003-04-24 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 11:01 . 2009-09-10 11:01 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:05 . 2003-04-24 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:00 . 2003-04-24 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2003-04-24 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NokiaMServer"="c:\program\Delade filer\Nokia\MPlatform\NokiaMServer" [X]
"ACU"="c:\program\Atheros\ACU.exe" [2005-01-31 253952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-01-23 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-01-23 126976]
"SynTPLpr"="c:\program\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 102490]
"SynTPEnh"="c:\program\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 708698]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"BCD3000"="c:\windows\system32\bcd3kcpan.exe" [2009-08-10 552960]
"NokiaMusic FastStart"="c:\program\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"AdobeCS4ServiceManager"="c:\program\Delade filer\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-04-15 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program\\SopCast\\SopCast.exe"=
"c:\\Program\\Mozilla Firefox\\firefox.exe"=
"c:\\Program\\Delade filer\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Delade filer\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59389:TCP"= 59389:TCP:1
"60039:TCP"= 60039:TCP:127.0.0.1
"5353:TCP"= 5353:TCP:Adobe CSI CS4
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [2009-08-10 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [2009-08-10 21600]
S3 kwwalpgr;kwwalpgr;\??\c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys --> c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{67KLN5J0-4OPM-01WE-AAX2-5657QCA554112}]
c:\sud\SSOW\sep.exe
.
Innehållet i mappen 'Schemalagda aktiviteter':
2009-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2009-11-23 c:\windows\Tasks\User_Feed_Synchronization-{AC9A189E-7CC2-4C9D-92CE-361B9D2E9F9D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Extra genomsökning -------
.
uInternet Settings,ProxyOverride = *.local;<local>
IE: Save YouTube Video as MP3 - c:\program\Delade filer\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
FF - ProfilePath - c:\documents and settings\Joakim\Application Data\Mozilla\Firefox\Profiles\q5lqbj6p.default\
FF - component: c:\program\Delade filer\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program\Veetle\Player\npvlc.dll
FF - plugin: c:\program\Veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICY ----
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.
- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -
AddRemove-Broadcom 802.11b Network Adapter - c:\windows\system32\BCMWLU00.exe verbose
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-23 23:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLer som "laddats" under processer som körs ---------------------
- - - - - - - > 'winlogon.exe'(540)
c:\program\Delade filer\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'explorer.exe'(1576)
c:\program\Bonjour\mdnsNSP.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Sluttid: 2009-11-23 23:51
ComboFix-quarantined-files.txt 2009-11-23 22:51
Före genomsökningen: 8 002 809 856 byte ledigt
Efter genomsökningen: 8 876 900 352 byte ledigt
WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 4897369485081C6AD903E0BCEEC16F38
How the computer is acting:
It doesn't seem slower or faster than usual but the startmenu-list sometimes crashes and has to restart. When it restarted the last time an icon had been added to the desktop. It was the "Internet Explorer" icon. I always use Mozilla Firefox and when I'm on the internet and when I started it after the crash it asked me if I wanted to have it as the standard web-browser although it already should have been the standard webbrowser. I answerd yes on the question and put it back as the standard one.
Thanks for helping.
Joakim
#8
Posted 23 November 2009 - 11:26 PM
When you ran ComboFix it reset your default browser. Hence, why you were prompted to set Firefox as your default browser after running ComboFix.When it restarted the last time an icon had been added to the desktop. It was the "Internet Explorer" icon. I always use Mozilla Firefox and when I'm on the internet and when I started it after the crash it asked me if I wanted to have it as the standard web-browser although it already should have been the standard webbrowser. I answerd yes on the question and put it back as the standard one.
Could you please elaborate on this a little bit more??the startmenu-list sometimes crashes and has to restart.
ComboFix Script
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/Date_time_suddenly_changed_12_arpil_2016_What_do_t108373.html&view=findpost&p=612938#entry612938 Folder:: C:\SUD Suspect:: c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{67KLN5J0-4OPM-01WE-AAX2-5657QCA554112}]
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
**Note**
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. - Ensure you are connected to the internet and click OK on the message box.
Please make sure that you post the log that was produced after running ComboFix.
Proud Graduate of the WTT Classroom
#9
Posted 24 November 2009 - 03:10 AM
ComboFix 09-11-23.01 - Joakim 2009-11-24 9:26.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1014.694 [GMT 1:00]
Körs från: c:\documents and settings\Joakim\Skrivbord\ComboFix.exe
Använda kommandoväxlar :: c:\documents and settings\Joakim\Skrivbord\CFScript.txt
.
((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\SUD
c:\sud\SSOW\DesKTop.ini
c:\sud\SSOW\sep.exe
.
(((((((((((((((((((((((( Filer Skapade från 2009-10-24 till 2009-11-24 ))))))))))))))))))))))))))))))
.
2009-11-23 23:16 . 2009-11-23 23:18 -------- d-----w- c:\program\Yawcam
2009-11-07 01:30 . 2009-11-07 01:30 -------- d-----w- c:\program\Hasbro
2009-11-03 23:19 . 2001-09-06 19:33 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-11-03 23:19 . 2008-04-14 17:04 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-11-03 23:16 . 2009-11-03 23:15 24411168 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_1.8.10SE.exe
2009-11-03 23:15 . 2009-11-03 23:15 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2009-11-03 23:15 . 2009-11-03 23:15 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2009-11-03 23:15 . 2009-11-03 23:15 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2009-11-03 23:15 . 2009-11-03 23:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-11-03 23:14 . 2009-11-03 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-11-03 22:57 . 2009-11-03 22:57 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:00 . 2009-11-03 17:06 -------- d-----w- c:\documents and settings\Joakim\Application Data\dvdcss
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-23 23:21 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\Skype
2009-11-23 23:09 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\skypePM
2009-11-23 22:40 . 2009-06-30 23:12 -------- d-----w- c:\documents and settings\Joakim\Application Data\uTorrent
2009-11-21 18:28 . 2009-06-27 22:38 -------- d-----w- c:\documents and settings\Joakim\Application Data\Spotify
2009-11-21 17:37 . 2009-09-27 21:39 -------- d-----w- c:\documents and settings\Joakim\Application Data\vlc
2009-11-14 13:55 . 2003-04-24 12:00 443186 ----a-w- c:\windows\system32\perfh01D.dat
2009-11-14 13:55 . 2003-04-24 12:00 82334 ----a-w- c:\windows\system32\perfc01D.dat
2009-11-12 17:46 . 2009-10-19 12:42 -------- d-----w- c:\documents and settings\Joakim\Application Data\gtk-2.0
2009-11-12 17:28 . 2009-07-31 10:35 1 ----a-w- c:\documents and settings\Joakim\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-03 23:17 . 2009-09-03 11:40 -------- d-----w- c:\program\Delade filer\Nokia
2009-11-03 23:17 . 2009-09-03 11:38 -------- d-----w- c:\program\Nokia
2009-11-03 23:13 . 2009-09-03 12:04 -------- d-----w- c:\documents and settings\Joakim\Application Data\Nseries
2009-11-03 22:57 . 2009-07-31 10:31 -------- d-----w- c:\program\Java
2009-10-19 15:00 . 2009-08-10 11:29 -------- d-----w- c:\program\Audacity
2009-10-19 12:37 . 2009-10-19 12:37 -------- d-----w- c:\program\GIMP-2.0
2009-10-18 17:04 . 2009-10-18 16:46 -------- d-----w- c:\documents and settings\Joakim\Application Data\FileZilla
2009-10-18 16:45 . 2009-10-18 16:45 -------- d-----w- c:\program\FileZilla FTP Client
2009-10-11 03:17 . 2009-07-31 10:32 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-06 20:26 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live
2009-10-06 20:26 . 2009-10-06 20:26 -------- d-----w- c:\program\Microsoft
2009-10-06 20:25 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live SkyDrive
2009-10-06 20:14 . 2009-10-06 20:14 -------- d-----w- c:\program\Delade filer\Windows Live
2009-09-30 12:59 . 2009-08-01 14:22 -------- d-----w- c:\program\Delade filer\DVDVideoSoft
2009-09-28 12:26 . 2009-09-09 21:03 -------- d-----w- c:\documents and settings\Joakim\Application Data\TraderaProLister
2009-09-11 14:19 . 2003-04-24 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 11:01 . 2009-09-10 11:01 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:05 . 2003-04-24 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:00 . 2003-04-24 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-11-23_22.50.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2016-04-12 00:00 . 2016-04-12 00:00 16384 c:\windows\Temp\Perflib_Perfdata_44c.dat
+ 2009-11-23 23:08 . 2008-04-14 17:04 54272 c:\windows\system32\vfwwdm32.dll
+ 2009-11-23 23:08 . 2008-04-13 19:46 19200 c:\windows\system32\drivers\WSTCODEC.SYS
+ 2009-11-23 23:08 . 2008-04-13 19:46 15232 c:\windows\system32\drivers\StreamIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 11136 c:\windows\system32\drivers\SLIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 10880 c:\windows\system32\drivers\NdisIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 85248 c:\windows\system32\drivers\NABTSFEC.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 17024 c:\windows\system32\drivers\CCDECODE.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 19200 c:\windows\system32\dllcache\wstcodec.sys
+ 2009-11-23 23:08 . 2008-04-14 17:04 54272 c:\windows\system32\dllcache\vfwwdm32.dll
+ 2009-11-23 23:08 . 2008-04-13 19:46 15232 c:\windows\system32\dllcache\streamip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 11136 c:\windows\system32\dllcache\slip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 10880 c:\windows\system32\dllcache\ndisip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 85248 c:\windows\system32\dllcache\nabtsfec.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 17024 c:\windows\system32\dllcache\ccdecode.sys
+ 2009-11-23 23:08 . 2008-04-13 19:39 5504 c:\windows\system32\drivers\MSTEE.sys
+ 2009-11-23 23:08 . 2008-04-13 19:39 5504 c:\windows\system32\dllcache\mstee.sys
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NokiaMServer"="c:\program\Delade filer\Nokia\MPlatform\NokiaMServer" [X]
"ACU"="c:\program\Atheros\ACU.exe" [2005-01-31 253952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-01-23 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-01-23 126976]
"SynTPLpr"="c:\program\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 102490]
"SynTPEnh"="c:\program\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 708698]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"BCD3000"="c:\windows\system32\bcd3kcpan.exe" [2009-08-10 552960]
"NokiaMusic FastStart"="c:\program\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"AdobeCS4ServiceManager"="c:\program\Delade filer\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-04-15 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program\\SopCast\\SopCast.exe"=
"c:\\Program\\Mozilla Firefox\\firefox.exe"=
"c:\\Program\\Delade filer\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Delade filer\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59389:TCP"= 59389:TCP:1
"60039:TCP"= 60039:TCP:127.0.0.1
"5353:TCP"= 5353:TCP:Adobe CSI CS4
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [2009-08-10 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [2009-08-10 21600]
S3 kwwalpgr;kwwalpgr;\??\c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys --> c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys [?]
.
Innehållet i mappen 'Schemalagda aktiviteter':
2009-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2009-11-24 c:\windows\Tasks\User_Feed_Synchronization-{AC9A189E-7CC2-4C9D-92CE-361B9D2E9F9D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Extra genomsökning -------
.
uInternet Settings,ProxyOverride = *.local;<local>
IE: Save YouTube Video as MP3 - c:\program\Delade filer\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
FF - ProfilePath - c:\documents and settings\Joakim\Application Data\Mozilla\Firefox\Profiles\q5lqbj6p.default\
FF - component: c:\program\Delade filer\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program\Veetle\Player\npvlc.dll
FF - plugin: c:\program\Veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICY ----
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-24 09:33
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLer som "laddats" under processer som körs ---------------------
- - - - - - - > 'winlogon.exe'(544)
c:\program\Delade filer\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\System32\BCMLogon.dll
.
Sluttid: 2009-11-24 09:35
ComboFix-quarantined-files.txt 2009-11-24 08:35
ComboFix2.txt 2009-11-23 22:51
Före genomsökningen: 8 866 136 064 byte ledigt
Efter genomsökningen: 8 831 733 760 byte ledigt
- - End Of File - - 2893A325D40F4BCBEDF2A42EDEC5A644
How the computer is acting:
I'm sorry I was so unclear last time I tried to explain the problem. This is what is happening. It actually happend while I was running the combofix-scan.
A message-box pops up saying:
Explorer.exe has preformed an illegal operation and has to be terminated.
I googled for pics that is similar to what the message-box looks like and this is kind of close: (I believe the pic is not from a XP-computer which mine is)
After I click "close" everthing on screen disappears and you can only see my desktop-background for a couple of seconds.
Then there's another little message box appearing for a short period of seconds. It says:
Installing adjusted settings for:
c:\sud\SSOW\sep.exe
After the message-box has disappeard everthing goes back normal. The start-menu and the icons come back on the desktop and I can manage my computer just like before.
When this happened while ComboFix was running the CF-window never disappeard. I never clicked the on the CF-window but I clicked "close" on the message-box.
I hope this elaboration is helping you understand whats going on.
#10
Posted 24 November 2009 - 09:08 PM
ComboFix Script
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/Date_time_suddenly_changed_12_arpil_2016_What_do_t108373.html&view=findpost&p=613051#entry613051 KillAll:: File:: c:\windows\Temp\Perflib_Perfdata_44c.dat Suspect:: c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys Collect:: c:\sud\SSOW\sep.exe Folder:: c:\sud\ Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{67KLN5J0-4OPM-01WE-AAX2-5657QCA554112}]
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
- Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Please post the log that is produced after running ComboFix.
Proud Graduate of the WTT Classroom
#11
Posted 25 November 2009 - 03:22 PM
ComboFix 09-11-23.01 - Joakim 2009-11-25 22:06.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1014.676 [GMT 1:00]
Körs från: c:\documents and settings\Joakim\Skrivbord\ComboFix.exe
Använda kommandoväxlar :: c:\documents and settings\Joakim\Skrivbord\CFScript.txt
* Skapade en ny återställningspunkt
FILE ::
"c:\windows\Temp\Perflib_Perfdata_44c.dat"
.
(((((((((((((((((((((((( Filer Skapade från 2009-10-25 till 2009-11-25 ))))))))))))))))))))))))))))))
.
2009-11-23 23:16 . 2009-11-23 23:18 -------- d-----w- c:\program\Yawcam
2009-11-07 01:30 . 2009-11-07 01:30 -------- d-----w- c:\program\Hasbro
2009-11-03 23:19 . 2001-09-06 19:33 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-11-03 23:19 . 2008-04-14 17:04 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-11-03 23:16 . 2009-11-03 23:15 24411168 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_1.8.10SE.exe
2009-11-03 23:15 . 2009-11-03 23:15 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2009-11-03 23:15 . 2009-11-03 23:15 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2009-11-03 23:15 . 2009-11-03 23:15 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2009-11-03 23:15 . 2009-11-03 23:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-11-03 23:14 . 2009-11-03 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-11-03 22:57 . 2009-11-03 22:57 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-03 09:00 . 2009-11-03 17:06 -------- d-----w- c:\documents and settings\Joakim\Application Data\dvdcss
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-24 22:02 . 2009-06-27 22:38 -------- d-----w- c:\documents and settings\Joakim\Application Data\Spotify
2009-11-24 18:25 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\Skype
2009-11-24 17:31 . 2009-06-27 21:52 -------- d-----w- c:\documents and settings\Joakim\Application Data\skypePM
2009-11-24 10:37 . 2009-06-30 23:12 -------- d-----w- c:\documents and settings\Joakim\Application Data\uTorrent
2009-11-21 17:37 . 2009-09-27 21:39 -------- d-----w- c:\documents and settings\Joakim\Application Data\vlc
2009-11-14 13:55 . 2003-04-24 12:00 443186 ----a-w- c:\windows\system32\perfh01D.dat
2009-11-14 13:55 . 2003-04-24 12:00 82334 ----a-w- c:\windows\system32\perfc01D.dat
2009-11-12 17:46 . 2009-10-19 12:42 -------- d-----w- c:\documents and settings\Joakim\Application Data\gtk-2.0
2009-11-12 17:28 . 2009-07-31 10:35 1 ----a-w- c:\documents and settings\Joakim\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-03 23:17 . 2009-09-03 11:40 -------- d-----w- c:\program\Delade filer\Nokia
2009-11-03 23:17 . 2009-09-03 11:38 -------- d-----w- c:\program\Nokia
2009-11-03 23:13 . 2009-09-03 12:04 -------- d-----w- c:\documents and settings\Joakim\Application Data\Nseries
2009-11-03 22:57 . 2009-07-31 10:31 -------- d-----w- c:\program\Java
2009-10-19 15:00 . 2009-08-10 11:29 -------- d-----w- c:\program\Audacity
2009-10-19 12:37 . 2009-10-19 12:37 -------- d-----w- c:\program\GIMP-2.0
2009-10-18 17:04 . 2009-10-18 16:46 -------- d-----w- c:\documents and settings\Joakim\Application Data\FileZilla
2009-10-18 16:45 . 2009-10-18 16:45 -------- d-----w- c:\program\FileZilla FTP Client
2009-10-11 03:17 . 2009-07-31 10:32 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-06 20:26 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live
2009-10-06 20:26 . 2009-10-06 20:26 -------- d-----w- c:\program\Microsoft
2009-10-06 20:25 . 2009-10-06 20:25 -------- d-----w- c:\program\Windows Live SkyDrive
2009-10-06 20:14 . 2009-10-06 20:14 -------- d-----w- c:\program\Delade filer\Windows Live
2009-09-30 12:59 . 2009-08-01 14:22 -------- d-----w- c:\program\Delade filer\DVDVideoSoft
2009-09-28 12:26 . 2009-09-09 21:03 -------- d-----w- c:\documents and settings\Joakim\Application Data\TraderaProLister
2009-09-11 14:19 . 2003-04-24 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 11:01 . 2009-09-10 11:01 152576 ----a-w- c:\documents and settings\Joakim\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:05 . 2003-04-24 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:00 . 2003-04-24 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-11-23_22.50.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-25 21:14 . 2009-11-25 21:14 16384 c:\windows\temp\Perflib_Perfdata_798.dat
+ 2009-11-23 23:08 . 2008-04-14 17:04 54272 c:\windows\system32\vfwwdm32.dll
+ 2009-11-23 23:08 . 2008-04-13 19:46 19200 c:\windows\system32\drivers\WSTCODEC.SYS
+ 2009-11-23 23:08 . 2008-04-13 19:46 15232 c:\windows\system32\drivers\StreamIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 11136 c:\windows\system32\drivers\SLIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 10880 c:\windows\system32\drivers\NdisIP.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 85248 c:\windows\system32\drivers\NABTSFEC.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 17024 c:\windows\system32\drivers\CCDECODE.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 19200 c:\windows\system32\dllcache\wstcodec.sys
+ 2009-11-23 23:08 . 2008-04-14 17:04 54272 c:\windows\system32\dllcache\vfwwdm32.dll
+ 2009-11-23 23:08 . 2008-04-13 19:46 15232 c:\windows\system32\dllcache\streamip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 11136 c:\windows\system32\dllcache\slip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 10880 c:\windows\system32\dllcache\ndisip.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 85248 c:\windows\system32\dllcache\nabtsfec.sys
+ 2009-11-23 23:08 . 2008-04-13 19:46 17024 c:\windows\system32\dllcache\ccdecode.sys
+ 2009-11-23 23:08 . 2008-04-13 19:39 5504 c:\windows\system32\drivers\MSTEE.sys
+ 2009-11-23 23:08 . 2008-04-13 19:39 5504 c:\windows\system32\dllcache\mstee.sys
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"NokiaMServer"="c:\program\Delade filer\Nokia\MPlatform\NokiaMServer" [X]
"ACU"="c:\program\Atheros\ACU.exe" [2005-01-31 253952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-01-23 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-01-23 126976]
"SynTPLpr"="c:\program\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 102490]
"SynTPEnh"="c:\program\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 708698]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"BCD3000"="c:\windows\system32\bcd3kcpan.exe" [2009-08-10 552960]
"NokiaMusic FastStart"="c:\program\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"AdobeCS4ServiceManager"="c:\program\Delade filer\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-04-15 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program\\SopCast\\SopCast.exe"=
"c:\\Program\\Mozilla Firefox\\firefox.exe"=
"c:\\Program\\Delade filer\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Delade filer\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59389:TCP"= 59389:TCP:1
"60039:TCP"= 60039:TCP:127.0.0.1
"5353:TCP"= 5353:TCP:Adobe CSI CS4
S3 BCD3000;Behringer BCD3000 V1.1.2.0;c:\windows\system32\drivers\BCD3000.SYS [2009-08-10 42496]
S3 BCD3000WDM;Behringer BCD3000WDM V1.1.2.0;c:\windows\system32\drivers\BCD3000WDM.SYS [2009-08-10 21600]
S3 kwwalpgr;kwwalpgr;\??\c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys --> c:\docume~1\Joakim\LOKALA~1\Temp\kwwalpgr.sys [?]
.
Innehållet i mappen 'Schemalagda aktiviteter':
2009-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2009-11-25 c:\windows\Tasks\User_Feed_Synchronization-{AC9A189E-7CC2-4C9D-92CE-361B9D2E9F9D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Extra genomsökning -------
.
uInternet Settings,ProxyOverride = *.local;<local>
IE: Save YouTube Video as MP3 - c:\program\Delade filer\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
FF - ProfilePath - c:\documents and settings\Joakim\Application Data\Mozilla\Firefox\Profiles\q5lqbj6p.default\
FF - component: c:\program\Delade filer\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program\Veetle\Player\npvlc.dll
FF - plugin: c:\program\Veetle\plugins\npVeetle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICY ----
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-25 22:15
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLer som "laddats" under processer som körs ---------------------
- - - - - - - > 'winlogon.exe'(544)
c:\program\Delade filer\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'explorer.exe'(796)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andra processer som körs ------------------------
.
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLTRAY.exe
c:\program\Delade filer\Nokia\MPlatform\NokiaMServer.exe
c:\acer\eManager\anbmServ.exe
c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program\Bonjour\mDNSResponder.exe
c:\program\Java\jre6\bin\jqs.exe
c:\program\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Sluttid: 2009-11-25 22:18 - datorn startades om.
ComboFix-quarantined-files.txt 2009-11-25 21:18
ComboFix2.txt 2009-11-24 08:35
ComboFix3.txt 2009-11-23 22:51
Före genomsökningen: 8 785 702 912 byte ledigt
Efter genomsökningen: 8 752 254 976 byte ledigt
- - End Of File - - 2E7079E08FE951D1F0D7217A16F900C4
#12
Posted 25 November 2009 - 07:31 PM
Please download Malwarebytes' Anti-Malware to your desktop.
- Double-click mbam-setup.exe and follow the prompts to install the program.
- At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform quick scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected.
- When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
- Check
- Click the button.
- Accept any security warnings from your browser.
- Check
- Make sure that the option "Remove found threats" is Unchecked
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time. - When the scan completes, push
- Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply. - Push the button.
- Push
I would also like to see a list of installed programs, so please do this:
Click Start > Run then copy/paste the following single-line command into the Run box and click OK:
C:\Qoobox\Add-Remove Programs.txt
A text file should open. Post the contents of that file in your next reply.
Please make sure you include the following items in your next post:
1. The log that was produced after running MalwareBytes' Anti-Malware.
2. The log that was produced after running the ESET Online Scanner.
3. The contnets of the Add-Remove Programs file.
4. An update on how your computer is running.
Proud Graduate of the WTT Classroom
#13
Posted 28 November 2009 - 01:41 PM
Proud Graduate of the WTT Classroom
#14
Posted 01 December 2009 - 07:44 PM
Proud Graduate of the WTT Classroon
If you are happy with the help you recieved, please consider making a Donation
Curiosity didn't kill the cat. Ignorance did, curiosity was framed.
Learn how to protect Yourself
Microsoft MVP 2011-2015
Threads will be closed if no response after 5 days.0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users