What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple infections

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I am in desperate need of some assistance.
It started a couple of days ago with an MSN-virus. I downloaded Ad-aware and MSNVirusRemover.
Ran Ad-aware to start with, removed a couple of low-level threats but the MSN-virus was still there so I ran the MSNVirusRemover.
It fixed it for two days, then the virus started spamming links to contacts again.
I ran the Remover and I was once again okay.

I installed Outpost Firewall 2009, blocked all connections and then started opening the ones needed to write this.
Something strange happened when I blocked all connections. It was like a sleeping tiger was unleashed.
My Task manager is acting weird: refreshing every 10 seconds instead of every second, not showing the correct CPU-usage-% and sometimes not showing any processes at all. I can feel that the processor is under heavy load because programs takes ages to move and open/close and Speed Fan is showing 99-100% constant CPU-usage. Also the speed of the processor fan is maxed.

I just talked to my "attacker" through "Pandora's Chat Box" and it was quite entertaining. "Nerds can't help you now" was his first words so he knew I was writing this.

Anyway.. we exchanged a couple of sentances and he said he was going to remove himself from my computer. Fat chance.

How do I remove this and prevent this from happening again?

Here is my HiJackThis log produced after he talked to me and with latest version of HiJackThis.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:48:17, on 2010-07-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\WinRER.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program\Delade filer\Java\Java Update\jusched.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe
C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program\NetWorx\networx.exe
C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\LogMeIn Hamachi\hamachi-2.exe
C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\Java\jre6\bin\javaw.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\windows-krb.exe
C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\Program\SpeedFan\speedfan.exe
C:\Documents and Settings\Jonas\Lokala inställningar\Apps\2.0\B181AW0P.7GD\RGB4ATE4.9YE\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\CurseClient.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Jonas\Application Data\lsass.exe
C:\Program\Uniblue\RegistryBooster\registrybooster.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jonas\Skrivbord\Download\HijackThis.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program\Skype\Toolbars\Shared\SkypeNames2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: Shell=Explorer.exe "C:\Documents and Settings\Jonas\Application Data\lsass.exe"
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\TEMP\svchost.exe,C:\WINDOWS\system32\sdra64.exe,C:\Documents and Settings\Jonas\Application Data\dll\svchost.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &NetWorx Desk Band - {FEEA54B4-D80F-41C7-87B9-DC08E6D3255F} - C:\Program\NetWorx\deskband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VoddlerNet Manager] C:\Program\Voddler\service\VNetManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1053
O4 - HKLM\..\Run: [NetWorx] "C:\Program\NetWorx\networx.exe" /auto
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [crpgof.exe] C:\Program Files
O4 - HKLM\..\Run: [lsass.exe] C:\Program Files
O4 - HKLM\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKLM\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\winn\update2323.exe
O4 - HKLM\..\Run: [Microsoft Windows Hosting Service Login] C:\DOCUME~1\Jonas\LOKALA~1\Temp\explorer.exe
O4 - HKLM\..\Run: [WinRER.exe] WinRER.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Program\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [Windows Data Serivce] windows-krb.exe
O4 - HKCU\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKCU\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKCU\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Run: [SystemUpdate] C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
O4 - HKCU\..\Run: [Update] C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Java Sched Updater] "C:\Documents and Settings\Jonas\jupdate.jar"
O4 - HKCU\..\RunOnce: [UniblueRegistryBooster] "C:\Program\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe (User 'Default user')
O4 - Startup: 24530.exe
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Startup: SpeedFan.lnk = C:\Program\SpeedFan\speedfan.exe
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1258970862734
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\program\agnitum\outpos~1\wl_hook.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Program\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c) (gupdate1ca6bb2f4ff0f6c) - Google Inc. - C:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VoddlerNet - Voddler - C:\Program\Voddler\service\voddler.exe

–
End of file - 11512 bytes






And this is the log from before he talked to me but with an old version of HiJackThis.


Scan saved at 22:29:40, on 2010-07-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\WinRER.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program\Delade filer\Java\Java Update\jusched.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe
C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program\NetWorx\networx.exe
C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\LogMeIn Hamachi\hamachi-2.exe
C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\Java\jre6\bin\javaw.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\windows-krb.exe
C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\Program\SpeedFan\speedfan.exe
C:\Documents and Settings\Jonas\Lokala inställningar\Apps\2.0\B181AW0P.7GD\RGB4ATE4.9YE\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\CurseClient.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Jonas\Application Data\lsass.exe
C:\Program\Uniblue\RegistryBooster\registrybooster.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Trend Micro\HijackThis\MF\HijackThis.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Skype\Toolbars\Shared\SkypeNames2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: Shell=Explorer.exe "C:\Documents and Settings\Jonas\Application Data\lsass.exe"
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\TEMP\svchost.exe,C:\WINDOWS\system32\sdra64.exe,C:\Documents and Settings\Jonas\Application Data\dll\svchost.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &NetWorx Desk Band - {FEEA54B4-D80F-41C7-87B9-DC08E6D3255F} - C:\Program\NetWorx\deskband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VoddlerNet Manager] C:\Program\Voddler\service\VNetManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1053
O4 - HKLM\..\Run: [NetWorx] "C:\Program\NetWorx\networx.exe" /auto
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [crpgof.exe] C:\Program Files
O4 - HKLM\..\Run: [lsass.exe] C:\Program Files
O4 - HKLM\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKLM\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\system32\install\explorer.exe
O4 - HKLM\..\Run: [Microsoft Windows Hosting Service Login] C:\DOCUME~1\Jonas\LOKALA~1\Temp\explorer.exe
O4 - HKLM\..\Run: [WinRER.exe] WinRER.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Program\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [Windows Data Serivce] windows-krb.exe
O4 - HKCU\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKCU\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKCU\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\system32\install\explorer.exe
O4 - HKCU\..\Run: [SystemUpdate] C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
O4 - HKCU\..\Run: [Update] C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Java Sched Updater] "C:\Documents and Settings\Jonas\jupdate.jar"
O4 - HKCU\..\RunOnce: [UniblueRegistryBooster] "C:\Program\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe (User 'Default user')
O4 - Startup: 24530.exe
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Startup: SpeedFan.lnk = C:\Program\SpeedFan\speedfan.exe
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1258970862734
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\program\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Program\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c) (gupdate1ca6bb2f4ff0f6c) - Google Inc. - C:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VoddlerNet - Voddler - C:\Program\Voddler\service\voddler.exe

–
End of file - 11284 bytes
Post #3

Posted Image

I guess I don't understand why you'd be chatting with the person who infected you :smack:
Is this a game you two are playing?




Thank you for a warm welcome.
No, it's not a game. Atleast not for me. He opened up this "Pandora's chat box" which looks like a MSN Messenger window but all black. He started writing to me through it and said "Nerds can't save you now. Talk to me!". I didn't want to click anywhere near that scary window. After a couple of minutes of thinking I decided not to piss him off so I started talking to him. No joke, no game.

The last thing he said was "be safe and be careful of what you download". The only thing I have downloaded the last couple of weeks has been either well known programs from well known sites or *.AVI, *.FLV or *.MKV files. Can the containers of these file formats carry infections?
Post #4
OK.
We'll stsrt with the basics :thumbup:


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .
Post #5
It is a pain to do this with the processor constantly having 100% load. Processes that is using alot of CPU power is wmiprvse.exe and services.exe. I get an error when trying to run MBAM: The setup files are corrupted. Please obtain a new copy of the program.
Post #7
Open Taskmanager (Alt/Ctrl/Del) and end the process for these if listed:
lsass.exe
sdra64.exe
svchost.exe
WinRER.exe

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

F2 - REG:system.ini: Shell=Explorer.exe "C:\Documents and Settings\Jonas\Application Data\lsass.exe"
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\TEMP\svchost.exe,C:\WINDOWS\system32\sdra64.exe,C:\Documents and Settings\Jonas\Application Data\dll\svchost.exe,
O4 - HKLM\..\Run: [crpgof.exe] C:\Program Files
O4 - HKLM\..\Run: [lsass.exe] C:\Program Files
O4 - HKLM\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKLM\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\winn\update2323.exe
O4 - HKLM\..\Run: [Microsoft Windows Hosting Service Login] C:\DOCUME~1\Jonas\LOKALA~1\Temp\explorer.exe
O4 - HKLM\..\Run: [WinRER.exe] WinRER.exe
O4 - HKLM\..\Run: [Windows Data Serivce] windows-krb.exe
O4 - HKCU\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKCU\..\Run: [Microsoft] C:\Documents and Settings\Jonas\Application Data\lsass.exe
O4 - HKCU\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Run: [SystemUpdate] C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
O4 - HKCU\..\Run: [Update] C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
- HKUS\.DEFAULT\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\explorer.exe (User 'Default user')
O4 - Startup: 24530.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"



Delete these Files if listed:
C:\Documents and Settings\Jonas\Application Data\lsass.exe
C:\WINDOWS\TEMP\svchost.exe <–ONLY from the TEMP location
C:\Documents and Settings\Jonas\Application Data\dll\svchost.exe <–ONLY from this location
C:\Program Files\lsass.exe <–ONLY from this location
C:\WINDOWS\system32\sdra64.exe
C:\Documents and Settings\Jonas\Application Data\bot.exe
C:\Program Files\crpgof.exe
C:\WINDOWS\winn\update2323.exe
c:\WinRER.exe
C:\windows-krb.exe
C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe
C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe
C:\24530.exe

Delete this Folders if listed:
C:\WINDOWS\winn

Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #8
lsass.exe run by Jonas and lsass.exe run by System - Both are critical processes and can't be terminated Task manager tells me before crashing. My task manager has been stripped of everything except the processes window after the first crash. I can't start new processes manually or change to performance tap and in addition to this it seems to crash when I try to terminate any process.
Post #10
After running HJT and fixing CPU usage is back to normal 0 to 2% in idle. Thank you! Delete these Files if listed: C:\Documents and Settings\Jonas\Application Data\lsass.exe <– not existing C:\WINDOWS\TEMP\svchost.exe <–ONLY from the TEMP location <– not existing C:\Documents and Settings\Jonas\Application Data\dll\svchost.exe <–ONLY from this location <– not existing C:\Program Files\lsass.exe <–ONLY from this location <– not existing C:\WINDOWS\system32\sdra64.exe <– not existing C:\Documents and Settings\Jonas\Application Data\bot.exe <– can't remove because disk is full or the file is being used C:\Program Files\crpgof.exe <– not existing in this location but is found C:\crpgof.exe C:\WINDOWS\winn\update2323.exe <– not existing c:\WinRER.exe <– not existing C:\windows-krb.exe <– not existing C:\Documents and Settings\Jonas\Mina dokument\System32\24530.exe <– removed C:\Documents and Settings\Jonas\Mina dokument\SYS\winupdate.exe <– removed C:\24530.exe <– not existing Delete this Folders if listed: C:\WINDOWS\winn <– not existing I found C:\Program Filescrpgof.exe Rebooting now.
Post #12
Computer feels like normal but the task manager is still messed up and bot.exe is still running. I don't like that file.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:37:25, on 2010-07-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\WinRER.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program\Delade filer\Java\Java Update\jusched.exe
C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe
C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program\NetWorx\networx.exe
C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\Java\jre6\bin\javaw.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\Program\SpeedFan\speedfan.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Jonas\Lokala inställningar\Apps\2.0\B181AW0P.7GD\RGB4ATE4.9YE\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\CurseClient.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\Program\Uniblue\RegistryBooster\registrybooster.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Spotify\spotify.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jonas\Skrivbord\Download\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &NetWorx Desk Band - {FEEA54B4-D80F-41C7-87B9-DC08E6D3255F} - C:\Program\NetWorx\deskband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VoddlerNet Manager] C:\Program\Voddler\service\VNetManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1053
O4 - HKLM\..\Run: [NetWorx] "C:\Program\NetWorx\networx.exe" /auto
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OutpostMonitor] C:\Program\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\winn\update2323.exe
O4 - HKLM\..\Run: [WinRER.exe] WinRER.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Java Sched Updater] "C:\Documents and Settings\Jonas\jupdate.jar"
O4 - HKCU\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKCU\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\RunOnce: [UniblueRegistryBooster] "C:\Program\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Startup: SpeedFan.lnk = C:\Program\SpeedFan\speedfan.exe
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1258970862734
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\program\agnitum\outpos~1\wl_hook.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Program\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c) (gupdate1ca6bb2f4ff0f6c) - Google Inc. - C:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VoddlerNet - Voddler - C:\Program\Voddler\service\voddler.exe

–
End of file - 10126 bytes
Post #13
See if MBAM will run now. You might need to download again. <—Note if you have to download it again, save it as MBAM.com.
Post #14 last edited
Hmm.. He's back again. Popping up pictures and messing around with Firefox and windows explorer windows. Edit: Pulled the plug and I'm starting the computer back up without connection to the internet.
Post #15
Did you install logMeIn? O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI