Spyware / Malware / Virus Removal

Multiple infections

24 min read

Looking for the outcome? Ask AI

Bonnee

Post #16July 8, 2010, 4:53 PM UTC

I have installed Hamachi.
https://secure.logmein.com/products/hamachi2/

LDTate

Post #17July 8, 2010, 4:59 PM UTC

check some settings on your system:

Enter your Control Panel and double-click on Network Connections
Then right click on your Default Connection
- Usually Local Area Connection for Cable and DSL, or AOL Connection.
Left click on Properties
Double-Click on the Internet Protocol (TCP/IP) item
Select the radio dial that says Obtain DNS Servers Automatically
Press OK twice to get out of the properties screen
Restart the computer

Also make sure you have a firewall active

LDTate

Post #18July 8, 2010, 5:17 PM UTC

Lets try it this way.

Print this out.

Unplug the internet connection

Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O4 - HKLM\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\winn\update2323.exe
O4 - HKLM\..\Run: [WinRER.exe] WinRER.exe
O4 - HKCU\..\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKCU\..\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\winn\update2323.exe
O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\Documents and Settings\Jonas\Application Data\bot.exe
O4 - HKLM\..\Policies\Explorer\Run: [Windows Defender] C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\winn\update2323.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these Files if listed:
C:\Documents and Settings\Jonas\Application Data\bot.exe
C:\WINDOWS\winn\update2323.exe
C:\WinRER.exe
C:\DOCUME~1\Jonas\LOKALA~1\Temp\WinDefender.exe
C:\WINDOWS\winn\update2323.exe

Delete these Folders if listed:
C:\WINDOWS\winn

Empty Recycle Bin

Shutdown and plug the connection back in.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Bonnee

Post #19July 8, 2010, 5:20 PM UTC

Obtain DNS Servers Automatically was checked. A software firewall won't do much good if I don't have the right settings and I have no idea which one to use and how to set it up.

LDTate

Post #20July 8, 2010, 5:27 PM UTC last edited July 8, 2010, 5:28 PM UTC

Just activate Windows firewall for now. Start > Control Panel > Security Center Then do the last suggestion I posted.

Bonnee

Post #21July 8, 2010, 5:41 PM UTC

Only found 7 of the above mentioned when scanning in safe mode.

Here's the log after fixing.

I'm using my laptop to post and a flash drive to transfer logs from infected computer to this one.

Rebooting in normal mode now.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:36:13, on 2010-07-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Jonas\Skrivbord\Download\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &NetWorx Desk Band - {FEEA54B4-D80F-41C7-87B9-DC08E6D3255F} - C:\Program\NetWorx\deskband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VoddlerNet Manager] C:\Program\Voddler\service\VNetManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1053
O4 - HKLM\..\Run: [NetWorx] "C:\Program\NetWorx\networx.exe" /auto
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OutpostMonitor] C:\Program\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1258970862734
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\program\agnitum\outpos~1\wl_hook.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Program\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c) (gupdate1ca6bb2f4ff0f6c) - Google Inc. - C:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program\Delade filer\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VoddlerNet - Voddler - C:\Program\Voddler\service\voddler.exe

–
End of file - 7207 bytes

LDTate

Post #22July 8, 2010, 5:49 PM UTC

Cool. Download MBAM to the flash drive, copy it to the infected pc and run it.

LDTate

Post #23July 8, 2010, 6:30 PM UTC

I will be offline for the next 5 hrs or so.

After you run MBAM, if it runs, do this:

Download ComboFix from one of these locations to the flashdrive and transfer it directly to the desktop of the infected pc.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

———————————————————————

Transfer all files you just downloaded, to the desktop of the infected computer.

——————————————————————–

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Doulble click ComboFix.exe

[*]At the next prompt, click 'Yes' to run the full ComboFix scan.

[*]When the tool is finished, it will produce a report for you. Please post the C:\ComboFix.txt in your next reply using Copy/Paste.

Notes:

Give it atleast 20-30 minutes to finish if needed.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Also please describe how your computer behaves in your next reply.

Bonnee

Post #24July 8, 2010, 8:16 PM UTC

Here's my ComboFix log.

Computer feels pretty much like before the attack if not a bit quicker.

Alot of swedish in this log. Good luck and thank you!

ComboFix 10-07-07.02 - Jonas 2010-07-08 21:42:29.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.3327.2874 [GMT 2:00]
Körs från: c:\documents and settings\Jonas\Skrivbord\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\documents and settings\Jonas\Application Data\3.4.exe
c:\documents and settings\Jonas\Application Data\data.dat
c:\documents and settings\Jonas\Application Data\Desktopicon
c:\documents and settings\Jonas\Application Data\Desktopicon\eBayShortcuts.exe
c:\documents and settings\Jonas\Application Data\dll
c:\documents and settings\Jonas\Application Data\dll\here.txt
c:\documents and settings\Jonas\Application Data\google_cache632.tmp
c:\documents and settings\Jonas\Application Data\SQLite3.dll
c:\documents and settings\Jonas\jupdate.jar
c:\documents and settings\Jonas\Mina dokument\SYS
C:\ntldr.exe
c:\windows\nigzss.txt
c:\windows\system32\config\systemprofile\Application Data\SQLite3.dll
c:\windows\system32\drivers\tmpp.exe
c:\windows\system32\launch.bat
c:\windows\system32\net.vbs
c:\windows\tmp.log
c:\windows\tmpp.log
c:\windows\WinRER.exe
D:\autorun.inf
E:\autorun.inf

.
(((((((((((((((((((((((( Filer Skapade från 2010-06-08 till 2010-07-08 ))))))))))))))))))))))))))))))
.

2010-07-08 18:50 . 2010-07-08 18:50 ——– d—–w- c:\documents and settings\Jonas\Application Data\Malwarebytes
2010-07-08 18:50 . 2010-07-08 18:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-08 18:50 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-08 18:50 . 2010-07-08 18:50 ——– d—–w- c:\program\Malwarebytes' Anti-Malware
2010-07-08 18:50 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-08 17:28 . 2010-07-08 17:28 ——– d—–w- c:\documents and settings\Administratör
2010-07-07 20:28 . 2010-07-07 20:28 ——– d—–w- c:\program\Trend Micro
2010-07-07 18:49 . 2010-07-07 18:49 118784 –sh–r- c:\windows\windows-krb.exe
2010-07-07 18:49 . 2010-07-07 18:49 118784 —-a-w- C:\592483prc.exe
2010-07-07 16:45 . 2010-07-08 18:40 ——– d-sh–r- c:\windows\winn
2010-07-05 20:45 . 2010-07-04 10:59 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-05 19:34 . 2010-07-05 19:34 ——– d—–w- c:\documents and settings\LocalService\Skrivbord
2010-07-05 18:58 . 2010-07-05 18:58 ——– d—–w- c:\program\Uniblue
2010-07-05 17:15 . 2010-07-05 17:15 ——– d—–w- C:\Users
2010-07-04 10:59 . 2010-07-04 10:57 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-04 10:59 . 2010-07-04 10:59 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-04 10:55 . 2010-07-04 10:55 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-07-04 10:55 . 2010-02-04 15:53 2954656 -c–a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-07-04 10:55 . 2010-07-04 10:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-04 10:55 . 2010-07-04 10:55 ——– d—–w- c:\program\Lavasoft
2010-07-04 10:49 . 2010-07-04 10:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-04 10:49 . 2010-07-04 10:51 ——– d—–w- c:\program\Spybot - Search & Destroy
2010-07-04 10:48 . 2010-07-05 18:46 ——– d—–w- C:\Backup för MSN virus remover
2010-07-03 23:51 . 2010-07-03 23:51 ——– d—–w- c:\program\Logitech Touch Mouse Server
2010-07-03 23:24 . 2010-07-03 23:24 263168 —-a-w- c:\documents and settings\Jonas\Application Data\smssx.exe
2010-07-03 22:09 . 2010-07-03 22:09 ——– d—–w- c:\windows\system32\wbem\Repository
2010-06-30 20:03 . 2010-06-30 20:03 150016 —-a-w- c:\documents and settings\Jonas\Application Data\cybernrs.exe
2010-06-30 15:33 . 2010-06-30 15:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-06-30 15:19 . 2010-06-30 15:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Blizzard
2010-06-30 15:17 . 2010-06-30 15:17 ——– d—–w- c:\program\Delade filer\Blizzard Entertainment
2010-06-30 13:37 . 2010-06-30 13:37 ——– d—–w- c:\documents and settings\LocalService\Application Data\Personal
2010-06-29 20:53 . 2010-06-29 20:53 3839 —-a-w- c:\windows\system32\launchhh.bat
2010-06-29 20:51 . 2010-06-29 20:51 3996 —-a-w- c:\windows\system32\launchh.bat
2010-06-29 20:51 . 2010-06-29 20:51 142 —-a-w- c:\windows\system32\launchhh.vbs
2010-06-29 20:51 . 2010-06-29 20:51 141 —-a-w- c:\windows\system32\launchh.vbs
2010-06-28 15:33 . 2010-06-28 15:33 588801 –sha-w- C:\Program Fileslsass.exe
2010-06-28 15:33 . 2010-06-28 15:33 588800 —-a-w- C:\Program Filescrpgof.exe
2010-06-28 15:33 . 2010-06-28 15:33 588800 —-a-w- C:\crpgof.exe
2010-06-23 21:09 . 2010-06-23 21:09 ——– d—–w- c:\program\iPod
2010-06-23 21:09 . 2010-06-23 21:09 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-23 21:08 . 2010-06-23 21:08 ——– d—–w- c:\program\QuickTime
2010-06-23 21:07 . 2010-06-23 21:07 ——– d—–w- c:\program\Bonjour
2010-06-23 21:04 . 2010-06-23 21:04 72504 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-20 10:40 . 2010-06-20 10:40 ——– d—–w- c:\program\LogMeIn Hamachi
2010-06-20 10:00 . 2008-04-14 16:04 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-06-18 18:14 . 2010-06-18 18:14 ——– d—–w- c:\windows\system32\LogFiles
2010-06-17 20:31 . 2010-06-17 20:31 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-06-17 20:31 . 2010-07-05 14:08 ——– d—–w- c:\documents and settings\Jonas\Application Data\skypePM
2010-06-17 20:30 . 2010-07-05 21:40 ——– d—–w- c:\documents and settings\Jonas\Application Data\Skype
2010-06-17 20:30 . 2010-06-17 20:30 ——– d—–w- c:\program\Delade filer\Skype
2010-06-17 20:30 . 2010-06-17 20:30 ——– d—–r- c:\program\Skype
2010-06-17 20:30 . 2010-06-17 20:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-06-17 16:11 . 2010-06-17 16:11 38976 —-a-w- c:\windows\system32\drivers\pssdk42.sys
2010-06-17 16:11 . 2010-06-17 16:11 ——– d—–w- c:\program\NetWorx
2010-06-17 16:11 . 2010-06-17 16:11 ——– d—–w- c:\documents and settings\All Users\Application Data\SoftPerfect
2010-06-17 15:25 . 2010-06-17 15:25 ——– d—–w- c:\program\Linksys
2010-06-17 15:25 . 2008-12-12 16:05 23984 —-a-w- c:\windows\system32\drivers\pnarp.sys
2010-06-17 15:25 . 2008-12-12 16:05 25264 —-a-w- c:\windows\system32\drivers\purendis.sys
2010-06-17 15:25 . 2010-06-17 15:25 ——– d—–w- c:\program\Delade filer\Pure Networks Shared
2010-06-17 15:25 . 2010-06-17 15:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Pure Networks
2010-06-17 15:23 . 2009-01-13 23:32 712704 —-a-r- c:\windows\system32\drivers\rt2860.sys
2010-06-17 15:23 . 2009-01-13 23:32 221184 —-a-r- c:\windows\system32\RaCoInst.dll
2010-06-17 15:23 . 2009-01-13 23:32 15312 —-a-r- c:\windows\system32\RaCoInst.dat
2010-06-12 01:04 . 2008-04-14 16:04 221184 —-a-w- c:\windows\system32\wmpns.dll
2010-06-09 18:46 . 2010-06-30 18:02 ——– d—–w- c:\program\World of Warcraft
2010-06-09 18:21 . 2010-04-12 15:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-09 18:20 . 2010-06-09 18:20 655360 —-a-w- c:\documents and settings\Jonas\Application Data\Spotify\Gracenote\gnsdk_sdkmanager.dll
2010-06-09 18:20 . 2010-06-09 18:20 282624 —-a-w- c:\documents and settings\Jonas\Application Data\Spotify\Gracenote\gnsdk_musicid_file.dll
2010-06-09 18:20 . 2010-06-09 18:20 208896 —-a-w- c:\documents and settings\Jonas\Application Data\Spotify\Gracenote\gnsdk_dsp.dll
2010-06-09 18:19 . 2010-06-09 18:19 61440 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5f4f14e8-n\decora-sse.dll
2010-06-09 18:19 . 2010-06-09 18:19 503808 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4024100d-n\msvcp71.dll
2010-06-09 18:19 . 2010-06-09 18:19 499712 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4024100d-n\jmc.dll
2010-06-09 18:19 . 2010-06-09 18:19 348160 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4024100d-n\msvcr71.dll
2010-06-09 18:19 . 2010-06-09 18:19 12800 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5f4f14e8-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-08 19:08 . 2009-11-25 12:40 ——– d—–w- c:\program\Steam
2010-07-08 19:05 . 2010-01-05 11:52 ——– d—–w- c:\program\Delade filer\Nero
2010-07-08 19:05 . 2010-01-05 11:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2010-07-08 18:57 . 2009-11-27 21:12 ——– d—–w- c:\program\SpeedFan
2010-07-08 16:31 . 2009-12-11 17:16 ——– d—–w- c:\documents and settings\Jonas\Application Data\Spotify
2010-07-07 16:45 . 2010-07-07 16:45 5 —-a-w- c:\windows\system32\YoItzVlad22222x.tmp
2010-07-07 16:45 . 2010-07-07 16:45 5 —-a-w- c:\windows\system32\qwdijxxixojdxf.tmp
2010-07-05 21:36 . 2009-11-23 15:38 ——– d—–w- c:\documents and settings\Jonas\Application Data\vlc
2010-07-05 21:36 . 2009-11-22 15:29 196608 —-a-w- c:\windows\system32\drivers\nStandard.bin
2010-07-05 14:33 . 2009-11-22 15:40 ——– d—–w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-06-23 21:09 . 2010-02-02 13:49 ——– d—–w- c:\program\iTunes
2010-06-23 21:09 . 2009-11-22 20:25 ——– d—–w- c:\program\Delade filer\Apple
2010-06-23 21:05 . 2003-04-24 12:00 78942 —-a-w- c:\windows\system32\perfc01D.dat
2010-06-23 21:05 . 2003-04-24 12:00 434860 —-a-w- c:\windows\system32\perfh01D.dat
2010-06-11 08:47 . 2009-12-25 03:38 ——– d—–w- c:\program\Replay Music 3
2010-06-11 08:06 . 2009-12-25 03:39 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2010-06-09 18:21 . 2009-12-03 20:23 ——– d—–w- c:\program\Java
2010-06-09 18:18 . 2009-11-22 20:32 ——– d—–w- c:\program\Google
2010-05-18 14:35 . 2010-05-18 14:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 197920 —-a-w- c:\windows\system32\dnssdX.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-04 17:20 . 2006-06-23 12:30 832512 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2004-08-04 08:33 78336 ——w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2003-04-24 12:00 17408 ——w- c:\windows\system32\corpol.dll
2010-05-02 08:10 . 2003-04-24 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:34 . 2003-04-24 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-19 18:47 . 2009-11-22 20:25 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-04-19 18:47 . 2009-11-22 20:25 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys
.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"SunJavaUpdateSched"="c:\program\Delade filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"nmctxth"="c:\program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"NetWorx"="c:\program\NetWorx\networx.exe" [2010-06-06 2929152]
"LogMeIn Hamachi Ui"="c:\program\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2010-06-15 141624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Jonas\Start-meny\Program\Autostart\
CurseClientStartup.ccip [2010-6-26 0]
Logitech Touch Mouse Server.lnk - c:\program\Logitech Touch Mouse Server\iTouch-Server-Win.exe [2009-10-23 228352]
SpeedFan.lnk - c:\program\SpeedFan\speedfan.exe [2008-11-21 3835904]

c:\documents and settings\All Users\Start-meny\Program\Autostart\
BankID s„kerhetsprogram.lnk - c:\program\Personal\bin\Personal.exe [2009-11-27 939920]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program\\Steam\\Steam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program\\Ventrilo\\Ventrilo.exe"=
"Host Process For Windows Service"= c:\documents and settings\Jonas\Application Data\svchost.exe
"c:\\Program\\Steam\\steamapps\\common\\monster trucks nitro demo\\MonsterTrucksNitro.exe"=
"c:\\Program\\Steam\\steamapps\\bonnee2k4\\counter-strike\\hl.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Jonas\\Application Data\\cybernrs.exe"=
"c:\\Documents and Settings\\Jonas\\Application Data\\smssx.exe"=
"c:\\Program\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=
"Windows Firewall"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Windows Defense"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Microsoft Windows Hosting Service Login"= c:\docume~1\Jonas\LOKALA~1\Temp\explorer.exe
"c:\\Documents and Settings\\Jonas\\Lokala inställningar\\Apps\\2.0\\B181AW0P.7GD\\RGB4ATE4.9YE\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-07-04 64288]
R1 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2010-06-17 38976]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R3 RT80x86;Linksys WPC600N/WMP600N Wireless-N Card Driver;c:\windows\system32\drivers\rt2860.sys [2010-06-17 712704]
S2 gupdate1ca6bb2f4ff0f6c;Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c);c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\Lavasoft\Ad-Aware\AAWService.exe [2010-02-04 1352832]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2009-11-22 38656]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-11-22 17408]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-11-22 691696]
[HKEY_CURRENT_USER\software\microsoft\active setup\installed components\{BDD3DECD-6DCC-DB2C-AAEE-0FECD90AC1F8}]
c:\documents and settings\Jonas\Application Data\bot.exe [BU]
[HKEY_CURRENT_USER\software\microsoft\active setup\installed components\{C4FDB5BF-DA3E-5F92-6CDE-6EDA0E5A2EEF}]
c:\docume~1\Jonas\LOKALA~1\Temp\WinDefender.exe [BU]
.
Innehållet i mappen 'Schemalagda aktiviteter':

2010-07-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 10:57]

2010-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]
.
.
——- Extra genomsökning ——-
.
uInternet Settings,ProxyOverride = *.local
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\2neiu904.default\
FF - component: c:\program\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program\Personal\bin\np_prsnl.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICY —-
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.
- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

HKCU-Run-Java Sched Updater - c:\documents and settings\Jonas\jupdate.jar
ActiveSetup-{82AACC66-DCE2-AFC3-1F88-A70CFABA89AD} - c:\docume~1\Jonas\LOKALA~1\Temp\\Winlogon.exe
ActiveSetup-{BDD3DECD-6DCC-DB2C-AAEE-0FECD90AC1F8} - c:\documents and settings\Jonas\Application Data\bot.exe
ActiveSetup-{C4FDB5BF-DA3E-5F92-6CDE-6EDA0E5A2EEF} - c:\docume~1\Jonas\LOKALA~1\Temp\WinDefender.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-08 21:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Sluttid: 2010-07-08 21:44:54
ComboFix-quarantined-files.txt 2010-07-08 19:44

Före genomsökningen: 26 735 632 384 byte ledigt
Efter genomsökningen: 28 815 994 880 byte ledigt

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - AF8BA0EE6F4B11B444A65C82E5C86F06

LDTate

Post #25July 8, 2010, 9:43 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\windows-krb.exe
C:\592483prc.exe
c:\documents and settings\Jonas\Application Data\smssx.exe
c:\documents and settings\Jonas\Application Data\cybernrs.exe
c:\windows\system32\launchhh.bat
c:\windows\system32\launchh.bat
C:\Program Fileslsass.exe
C:\Program Filescrpgof.exe
C:\crpgof.exe
c:\windows\system32\YoItzVlad22222x.tmp
c:\windows\system32\qwdijxxixojdxf.tmp
c:\docume~1\Jonas\LOKALA~1\Temp\explorer.exe
c:\documents and settings\Jonas\Application Data\bot.exe
c:\docume~1\Jonas\LOKALA~1\Temp\WinDefender.exe

Folder::
c:\windows\winn


Registry::
[-HKEY_CURRENT_USER\software\microsoft\active setup\installed components\{BDD3DECD-6DCC-DB2C-AAEE-0FECD90AC1F8}]
[-HKEY_CURRENT_USER\software\microsoft\active setup\installed components\{C4FDB5BF-DA3E-5F92-6CDE-6EDA0E5A2EEF}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Bonnee

Post #26July 8, 2010, 10:00 PM UTC

The time here is 00.00 and I got to get up for work at 05.00. This will be my last post for today.

ComboFix 10-07-07.02 - Jonas 2010-07-08 23:51:35.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.3327.2933 [GMT 2:00]
Körs från: c:\documents and settings\Jonas\Skrivbord\ComboFix.exe
Använda kommandoväxlar :: c:\documents and settings\Jonas\Skrivbord\CFScript.txt
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

(((((((((((((((((((((((( Filer Skapade från 2010-06-08 till 2010-07-08 ))))))))))))))))))))))))))))))
.

Inga nya filer har skapats under denna tid.

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-07-08_19.44.09 )))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2010-05-09 09:50 2517088 —-a-w- c:\program\ZoneAlarm\tbZone.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"SunJavaUpdateSched"="c:\program\Delade filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"nmctxth"="c:\program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"NetWorx"="c:\program\NetWorx\networx.exe" [2010-06-06 2929152]
"LogMeIn Hamachi Ui"="c:\program\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"ZoneAlarm Client"="c:\program\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"ISW"="c:\program\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Jonas\Start-meny\Program\Autostart\
CurseClientStartup.ccip [2010-6-26 0]
Logitech Touch Mouse Server.lnk - c:\program\Logitech Touch Mouse Server\iTouch-Server-Win.exe [2009-10-23 228352]
SpeedFan.lnk - c:\program\SpeedFan\speedfan.exe [2008-11-21 3835904]

c:\documents and settings\All Users\Start-meny\Program\Autostart\
BankID s„kerhetsprogram.lnk - c:\program\Personal\bin\Personal.exe [2009-11-27 939920]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program\\Steam\\Steam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program\\Ventrilo\\Ventrilo.exe"=
"Host Process For Windows Service"= c:\documents and settings\Jonas\Application Data\svchost.exe
"c:\\Program\\Steam\\steamapps\\common\\monster trucks nitro demo\\MonsterTrucksNitro.exe"=
"c:\\Program\\Steam\\steamapps\\bonnee2k4\\counter-strike\\hl.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Jonas\\Application Data\\cybernrs.exe"=
"c:\\Documents and Settings\\Jonas\\Application Data\\smssx.exe"=
"c:\\Program\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=
"Windows Firewall"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Windows Defense"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Microsoft Windows Hosting Service Login"= c:\docume~1\Jonas\LOKALA~1\Temp\explorer.exe
"c:\\Documents and Settings\\Jonas\\Lokala inställningar\\Apps\\2.0\\B181AW0P.7GD\\RGB4ATE4.9YE\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=

R2 gupdate1ca6bb2f4ff0f6c;Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c);c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 133104]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\Lavasoft\Ad-Aware\AAWService.exe [2010-07-04 1352832]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-11-22 691696]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-07-04 64288]
S1 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk42.sys [2010-06-17 38976]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program\CheckPoint\ZAForceField\ISWKL.sys [2010-05-26 26352]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program\CheckPoint\ZAForceField\IswSvc.exe [2010-05-26 493032]
S3 RT80x86;Linksys WPC600N/WMP600N Wireless-N Card Driver;c:\windows\system32\DRIVERS\RT2860.sys [2009-01-13 712704]

.
Innehållet i mappen 'Schemalagda aktiviteter':

2010-07-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 10:57]

2010-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]
.
.
——- Extra genomsökning ——-
.
uInternet Settings,ProxyOverride = *.local
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\2neiu904.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ZoneAlarm Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2611275&SearchSource=13
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICY —-
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-08 23:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLer som "laddats" under processer som körs ———————

- - - - - - - > 'winlogon.exe'(684)
c:\program\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(740)
c:\program\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Sluttid: 2010-07-08 23:56:23
ComboFix-quarantined-files.txt 2010-07-08 21:56
ComboFix2.txt 2010-07-08 19:44

Före genomsökningen: 28 597 571 584 byte ledigt
Efter genomsökningen: 28 589 600 768 byte ledigt

- - End Of File - - E7AA71C533E22A10B4C79F8BF7E5720E

LDTate

Post #27July 8, 2010, 10:02 PM UTC

OK. Post back sometime tomorrow and let me know how it's running. We're not finished yet

Bonnee

Post #28July 9, 2010, 4:45 PM UTC last edited July 9, 2010, 5:11 PM UTC

I'm back

What's the next step, LDTate?
The computer feels very good except from some programs that have been disabled/deleted during the cleansing process and my Task manager is still messed up.

This is my current MBAM log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4294

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

2010-07-09 19:00:59
mbam-log-2010-07-09 (19-00-59).txt

Scan type: Quick scan
Objects scanned: 130968
Time elapsed: 2 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

This is my current Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:03:38, on 2010-07-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\LogMeIn Hamachi\hamachi-2.exe
C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program\Delade filer\Java\Java Update\jusched.exe
C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe
C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program\NetWorx\networx.exe
C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\Personal\bin\Personal.exe
C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\Program\CheckPoint\ZAForceField\ForceField.exe
C:\Program\SpeedFan\speedfan.exe
C:\Program\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jonas\Skrivbord\Download\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program\ZoneAlarm\tbZone.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program\ZoneAlarm\tbZone.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &NetWorx Desk Band - {FEEA54B4-D80F-41C7-87B9-DC08E6D3255F} - C:\Program\NetWorx\deskband.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program\ZoneAlarm\tbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1053
O4 - HKLM\..\Run: [NetWorx] "C:\Program\NetWorx\networx.exe" /auto
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Startup: SpeedFan.lnk = C:\Program\SpeedFan\speedfan.exe
O4 - Global Startup: BankID säkerhetsprogram.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1258970862734
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c) (gupdate1ca6bb2f4ff0f6c) - Google Inc. - C:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 9001 bytes

LDTate

Post #29July 10, 2010, 1:11 AM UTC

1. download Process Explorer
2. extract it into a "known stable" location. I suggest "c:\program files\processexplorer"
3. Run procexp.exe
4. On the Options menu, select Restore Task Manager

Now try running taskmgr.exe - it should be restored!

Bonnee

Post #30July 10, 2010, 1:46 AM UTC

Do you mean "Replace Task Manager"?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Multiple infections

✨ Ask AI

Ask AI