What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple infections

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #80
CF log for laptop:

ComboFix 10-07-10.01 - Jonas 2010-07-10 21:22:17.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.2814.1673 [GMT 2:00]
Körs från: c:\documents and settings\Jonas\Skrivbord\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Jonas\LOKALA~1\Temp\sfamcc00001.dll
c:\docume~1\Jonas\LOKALA~1\Temp\sfareca00001.dll
c:\documents and settings\Jonas\Application Data\Dealio
c:\documents and settings\Jonas\Application Data\Dealio\res\widgets.xml
c:\documents and settings\Jonas\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Jonas\Lokala inställningar\Temp\sfamcc00001.dll
c:\documents and settings\Jonas\Lokala inställningar\Temp\sfareca00001.dll
c:\program\Dealio Toolbar
c:\program\Dealio Toolbar\FF\chrome.manifest
c:\program\Dealio Toolbar\FF\chrome\content\chevron.js
c:\program\Dealio Toolbar\FF\chrome\content\chevron.xul
c:\program\Dealio Toolbar\FF\chrome\content\login.js
c:\program\Dealio Toolbar\FF\chrome\content\login.xul
c:\program\Dealio Toolbar\FF\chrome\content\parser.js
c:\program\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js
c:\program\Dealio Toolbar\FF\chrome\content\searchbox.js
c:\program\Dealio Toolbar\FF\chrome\content\searchbox.xul
c:\program\Dealio Toolbar\FF\chrome\content\widgichevron.js
c:\program\Dealio Toolbar\FF\chrome\content\widgicomm.js
c:\program\Dealio Toolbar\FF\chrome\content\widgihandling.js
c:\program\Dealio Toolbar\FF\chrome\content\widgilisteners.js
c:\program\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js
c:\program\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul
c:\program\Dealio Toolbar\FF\chrome\content\widgiui.js
c:\program\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd
c:\program\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd
c:\program\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties
c:\program\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif
c:\program\Dealio Toolbar\FF\chrome\skin\amazon.gif
c:\program\Dealio Toolbar\FF\chrome\skin\apple.gif
c:\program\Dealio Toolbar\FF\chrome\skin\barnes.gif
c:\program\Dealio Toolbar\FF\chrome\skin\bestbuy.gif
c:\program\Dealio Toolbar\FF\chrome\skin\chevron.gif
c:\program\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif
c:\program\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif
c:\program\Dealio Toolbar\FF\chrome\skin\ebay.gif
c:\program\Dealio Toolbar\FF\chrome\skin\icon_settings.gif
c:\program\Dealio Toolbar\FF\chrome\skin\macys.gif
c:\program\Dealio Toolbar\FF\chrome\skin\newegg.gif
c:\program\Dealio Toolbar\FF\chrome\skin\overstock.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search-button.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search-chevron.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search_amazon.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search_dealio.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search_ebay.gif
c:\program\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif
c:\program\Dealio Toolbar\FF\chrome\skin\searchbox.css
c:\program\Dealio Toolbar\FF\chrome\skin\separator.gif
c:\program\Dealio Toolbar\FF\chrome\skin\target.gif
c:\program\Dealio Toolbar\FF\chrome\skin\walmart.gif
c:\program\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css
c:\program\Dealio Toolbar\FF\components\config.ini
c:\program\Dealio Toolbar\FF\components\dealioToolbarFF.dll
c:\program\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt
c:\program\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt
c:\program\Dealio Toolbar\FF\install.rdf
c:\program\Dealio Toolbar\IE\4.0.2\config.ini
c:\program\Dealio Toolbar\Res\amazon.gif
c:\program\Dealio Toolbar\Res\apple.gif
c:\program\Dealio Toolbar\Res\barnes.gif
c:\program\Dealio Toolbar\Res\bestbuy.gif
c:\program\Dealio Toolbar\Res\dealio_logo.gif
c:\program\Dealio Toolbar\Res\dealio_logo_hover.gif
c:\program\Dealio Toolbar\Res\ebay.gif
c:\program\Dealio Toolbar\Res\icon_settings.gif
c:\program\Dealio Toolbar\Res\macys.gif
c:\program\Dealio Toolbar\Res\newegg.gif
c:\program\Dealio Toolbar\Res\overstock.gif
c:\program\Dealio Toolbar\Res\search-button-hover.gif
c:\program\Dealio Toolbar\Res\search-button.gif
c:\program\Dealio Toolbar\Res\search-chevron-hover.gif
c:\program\Dealio Toolbar\Res\search-chevron.gif
c:\program\Dealio Toolbar\Res\search_amazon.gif
c:\program\Dealio Toolbar\Res\search_dealio.gif
c:\program\Dealio Toolbar\Res\search_ebay.gif
c:\program\Dealio Toolbar\Res\search_yahoo.gif
c:\program\Dealio Toolbar\Res\target.gif
c:\program\Dealio Toolbar\Res\walmart.gif
c:\program\Dealio Toolbar\Res\widgets.xml
c:\program\Search Settings
c:\program\Search Settings\FF\chrome.manifest
c:\program\Search Settings\FF\chrome\content\plugin.js
c:\program\Search Settings\FF\chrome\content\plugin.xul
c:\program\Search Settings\FF\chrome\content\protection.js
c:\program\Search Settings\FF\chrome\content\utils.js
c:\program\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\program\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\program\Search Settings\FF\components\IFBHOSearch.xpt
c:\program\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\program\Search Settings\FF\components\IFHelperPreferences.xpt
c:\program\Search Settings\FF\components\SearchSettingsFF.dll
c:\program\Search Settings\FF\install.rdf
c:\windows\system32\drivers\lxny.sys
c:\windows\system32\st326222.dll
c:\windows\xpsp1hfm.log

.
((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ixnq


(((((((((((((((((((((((( Filer Skapade från 2010-06-10 till 2010-07-10 ))))))))))))))))))))))))))))))
.

2010-07-09 16:43 . 2010-07-09 16:43 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-08 19:57 . 2010-07-08 19:57 ——– d—–w- c:\program\ESET
2010-07-08 18:50 . 2010-07-08 18:50 ——– d—–w- c:\documents and settings\Jonas\Application Data\Malwarebytes
2010-07-08 18:50 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-08 18:49 . 2010-07-08 18:50 ——– d—–w- c:\program\Malwarebytes' Anti-Malware
2010-07-08 18:49 . 2010-07-08 18:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-08 18:49 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-23 21:32 . 2010-06-23 21:32 ——– d—–w- c:\program\iPod
2010-06-23 21:32 . 2010-06-23 21:33 ——– d—–w- c:\program\iTunes
2010-06-23 21:26 . 2010-04-19 18:47 3062048 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-06-23 21:26 . 2010-04-19 18:47 41984 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2010-06-23 21:24 . 2010-06-23 21:24 ——– d—–w- c:\program\Bonjour
2010-06-20 10:41 . 2010-06-20 10:41 ——– d—–w- c:\program\LogMeIn Hamachi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 19:36 . 2010-02-12 02:44 ——– d—–w- c:\program\Steam
2010-07-10 19:36 . 2010-02-12 00:03 ——– d—–w- c:\program\SpeedFan
2010-07-10 19:35 . 2010-02-11 21:26 ——– d—–w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-07-10 19:08 . 2010-03-07 20:09 ——– d—–w- c:\documents and settings\Jonas\Application Data\Skype
2010-07-10 18:20 . 2010-03-07 20:10 ——– d—–w- c:\documents and settings\Jonas\Application Data\skypePM
2010-07-03 18:17 . 2010-02-11 20:49 ——– d—–w- c:\documents and settings\Jonas\Application Data\vlc
2010-06-25 14:16 . 2009-04-16 11:46 79140 —-a-w- c:\windows\system32\perfc01D.dat
2010-06-25 14:16 . 2009-04-16 11:46 435098 —-a-w- c:\windows\system32\perfh01D.dat
2010-06-23 21:32 . 2010-02-11 19:59 ——– d—–w- c:\program\Delade filer\Apple
2010-06-23 21:18 . 2010-06-23 21:18 72504 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-23 14:14 . 2010-06-07 22:39 ——– d—–w- c:\program\Jamcast
2010-06-18 16:33 . 2010-02-12 08:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-17 17:21 . 2010-02-11 23:17 ——– d—–w- c:\documents and settings\Jonas\Application Data\Spotify
2010-06-16 18:02 . 2010-02-13 16:54 ——– d—–w- c:\program\Warcraft III
2010-06-16 16:57 . 2010-02-17 16:13 1 —-a-w- c:\documents and settings\Jonas\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-09 21:36 . 2010-03-24 21:32 ——– d—–w- c:\program\Replay Music 3
2010-06-09 21:36 . 2010-03-24 21:33 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2010-06-09 21:34 . 2010-04-17 13:59 8 —-a-w- c:\windows\system32\nvModes.dat
2010-06-09 08:01 . 2010-04-03 00:09 ——– d—–w- c:\program\World of Warcraft
2010-06-08 08:11 . 2010-06-08 08:10 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-08 08:04 . 2010-06-08 08:03 ——– d—–w- c:\program\QuickTime
2010-06-07 22:40 . 2010-06-07 22:40 ——– d—–w- c:\program\Crawler
2010-06-05 10:02 . 2010-02-12 08:44 ——– d—–w- c:\program\Microsoft Silverlight
2010-06-04 18:58 . 2010-03-02 12:17 ——– d—–w- c:\program\Free FLV Converter
2010-06-04 18:34 . 2010-03-02 12:17 ——– d—–w- c:\documents and settings\Jonas\Application Data\FreeFLVConverter
2010-06-04 14:07 . 2010-02-14 15:12 ——– d—–w- c:\documents and settings\Jonas\Application Data\dvdcss
2010-06-01 21:55 . 2010-06-04 18:58 311296 —-a-w- c:\windows\system32\TubeFinder.exe
2010-05-28 10:39 . 2010-05-28 10:39 12800 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-688372fb-n\decora-d3d.dll
2010-05-28 10:39 . 2010-05-28 10:39 61440 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-688372fb-n\decora-sse.dll
2010-05-28 10:39 . 2010-05-28 10:39 503808 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-31f5443c-n\msvcp71.dll
2010-05-28 10:39 . 2010-05-28 10:39 499712 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-31f5443c-n\jmc.dll
2010-05-28 10:39 . 2010-05-28 10:39 348160 —-a-w- c:\documents and settings\Jonas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-31f5443c-n\msvcr71.dll
2010-05-24 19:35 . 2010-05-24 19:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA
2010-05-18 17:34 . 2010-05-18 17:34 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-05-18 17:34 . 2010-05-18 17:34 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_RzSynapse_01007.Wdf
2010-04-20 05:34 . 2010-04-20 05:34 285696 —-a-w- c:\windows\system32\atmfd.dll
.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"uTorrent"="c:\program\uTorrent\uTorrent.exe" [2010-05-21 322352]
"Steam"="c:\program\Steam\Steam.exe" [2010-05-09 1238352]
"Skype"="c:\program\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
"RemotelessHelper"="c:\program\SpotifyRemotelessHelper\SpotifyRemotelessHelper.exe" [2010-02-06 2174976]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-16 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program\IDT\WDM\sttray.exe" [2009-07-13 458844]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]
"Apoint"="c:\program\Apoint2K\Apoint.exe" [2009-07-09 212992]
"nwiz"="nwiz.exe" [2009-06-26 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-26 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-26 13762560]
"Adobe Reader Speed Launcher"="c:\program\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"WirelessAssistant"="c:\program\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-03-10 684032]
"Adobe ARM"="c:\program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"NetWorx"="c:\program\NetWorx\networx.exe" [2010-02-28 2909184]
"SunJavaUpdateSched"="c:\program\Delade filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Razer Naga Driver"="c:\program\Razer\Naga\NagaTray.exe" [2010-05-11 810880]
"Jamcast System Tray Utility"="c:\program\Jamcast\jctray.exe" [2010-04-23 255160]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2010-03-17 421888]
"LogMeIn Hamachi Ui"="c:\program\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2010-06-15 141624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-16 15360]

c:\documents and settings\Jonas\Start-meny\Program\Autostart\
CurseClientStartup.ccip [2010-4-26 0]
Logitech Touch Mouse Server.lnk - c:\program\Logitech Touch Mouse Server\iTouch-Server-Win.exe [2009-10-23 228352]
Sk„rmurklipp och start f”r OneNote 2007.lnk - c:\program\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
SpeedFan.lnk - c:\program\SpeedFan\speedfan.exe [2009-11-25 4009592]

c:\documents and settings\All Users\Start-meny\Program\Autostart\
BankID s„kerhetsprogram.lnk - c:\program\Personal\bin\Personal.exe [2010-4-22 939920]
BTTray.lnk - c:\program\WIDCOMM\Bluetooth Software\BTTray.exe [2009-5-5 607584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Steam\\Steam.exe"=
"c:\\Program\\Steam\\steamapps\\bonnee2k4\\counter-strike\\hl.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program\\Boxee\\BOXEE.exe"=
"c:\\Program\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program\\SpotifyRemotelessHelper\\SpotifyRemotelessHelper.exe"=
"c:\\Program\\Ventrilo\\Ventrilo.exe"=
"c:\\Documents and Settings\\Jonas\\Lokala inställningar\\Apps\\2.0\\X88C4ZAX.NXM\\3A8BZE7O.COZ\\curs..tion_eee711038731a406_0004.0000_152ef8e82e8f5a48\\CurseClient.exe"=
"c:\\Program\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-08-23 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-08-23 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2009-07-01 103792]
R1 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2010-03-08 38976]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2009-08-23 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
R2 Application Updater;Application Updater;c:\program\Application Updater\ApplicationUpdater.exe [2009-12-16 375296]
R2 BOTService;BOTService;c:\program\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-08-23 113664]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-05-11 56480]
S2 Jamcast;Jamcast;c:\program\Jamcast\jamcastsvc.exe [2010-04-23 66744]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2010-02-11 17408]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-08-23 165888]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 RzSynapse;Razer Naga Driver;c:\windows\system32\drivers\RzSynapse.sys [2010-05-18 60032]
S3 Tdsshbecr;Handelsbanken card reader;c:\windows\system32\drivers\shbecr.sys [2010-04-22 42368]
.
Innehållet i mappen 'Schemalagda aktiviteter':

2010-06-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-10 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]
.
.
——- Extra genomsökning ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=94&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=94&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: &AOL Verktygsfalt Sök - c:\documents and settings\All Users\Application Data\AOL\ieToolbar\resources\sv-SE\local\search.html
IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\Office12\EXCEL.EXE/3000
IE: Skicka till &Bluetooth-enhet… - c:\program\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Skicka till Bluetooth - c:\program\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: %SYSTEMROOT%\system32\nvLsp.dll
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\a4yvk208.default\
FF - prefs.js: browser.startup.homepage - hxxp://johannniiisandberg.blogg.se/
FF - component: c:\program\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program\Personal\bin\np_prsnl.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICY —-
c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-10 21:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLer som "laddats" under processer som körs ———————

- - - - - - - > 'lsass.exe'(1012)
c:\windows\system32\nvLsp.dll

- - - - - - - > 'explorer.exe'(2548)
c:\windows\system32\btmmhook.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Andra processer som körs ————————
.
c:\windows\system32\nvsvc32.exe
c:\program\idt\wdm\STacSV.exe
c:\windows\System32\SCardSvr.exe
c:\program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program\Bonjour\mDNSResponder.exe
c:\windows\system32\RUNDLL32.EXE
c:\program\Apoint2K\ApMsgFwd.exe
c:\program\Apoint2K\Apntex.exe
c:\program\Skype\Phone\Skype.exe
c:\program\Java\jre6\bin\jqs.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
c:\program\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\program\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\wscntfy.exe
c:\program\Windows Live\Contacts\wlcomm.exe
c:\program\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program\Hewlett-Packard\Shared\hpqToaster.exe
c:\program\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Sluttid: 2010-07-10 21:45:44 - datorn startades om.
ComboFix-quarantined-files.txt 2010-07-10 19:45

Före genomsökningen: 8 361 963 520 byte ledigt
Efter genomsökningen: 8 504 369 152 byte ledigt

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 6E65DCE29EE2011CA22BCBE147432A2A
Post #81
CF log from stationary PC:
ComboFix 10-07-10.01 - Jonas 2010-07-10 21:42:59.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.3327.2543 [GMT 2:00]
Körs från: c:\documents and settings\Jonas\Skrivbord\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Jonas\LOKALA~1\Temp\sfamcc00001.dll
c:\docume~1\Jonas\LOKALA~1\Temp\sfareca00001.dll
c:\documents and settings\Jonas\Lokala inställningar\temp\sfamcc00001.dll
c:\documents and settings\Jonas\Lokala inställningar\temp\sfareca00001.dll
C:\taskmgr.exe

.
(((((((((((((((((((((((( Filer Skapade från 2010-06-10 till 2010-07-10 ))))))))))))))))))))))))))))))
.

Inga nya filer har skapats under denna tid.

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2010-05-09 09:50 2517088 —-a-w- c:\program\ZoneAlarm\tbZone.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"uTorrent"="c:\program\uTorrent\uTorrent.exe" [2009-11-22 289584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"SunJavaUpdateSched"="c:\program\Delade filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"nmctxth"="c:\program\Delade filer\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"NetWorx"="c:\program\NetWorx\networx.exe" [2010-06-06 2929152]
"QuickTime Task"="c:\program\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"ZoneAlarm Client"="c:\program\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"ISW"="c:\program\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]
"avast5"="c:\program\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Jonas\Start-meny\Program\Autostart\
CurseClientStartup.ccip [2010-6-26 0]
Logitech Touch Mouse Server.lnk - c:\program\Logitech Touch Mouse Server\iTouch-Server-Win.exe [2009-10-23 228352]
SpeedFan.lnk - c:\program\SpeedFan\speedfan.exe [2008-11-21 3835904]

c:\documents and settings\All Users\Start-meny\Program\Autostart\
BankID s„kerhetsprogram.lnk - c:\program\Personal\bin\Personal.exe [2009-11-27 939920]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program\\uTorrent\\uTorrent.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program\\Steam\\Steam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program\\Ventrilo\\Ventrilo.exe"=
"Host Process For Windows Service"= c:\documents and settings\Jonas\Application Data\svchost.exe
"c:\\Program\\Steam\\steamapps\\common\\monster trucks nitro demo\\MonsterTrucksNitro.exe"=
"c:\\Program\\Steam\\steamapps\\bonnee2k4\\counter-strike\\hl.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"Windows Firewall"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Windows Defense"= c:\documents and settings\Jonas\Application Data\winlogon.exe
"Microsoft Windows Hosting Service Login"= c:\docume~1\Jonas\LOKALA~1\Temp\explorer.exe
"c:\\Documents and Settings\\Jonas\\Lokala inställningar\\Apps\\2.0\\B181AW0P.7GD\\RGB4ATE4.9YE\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program\\Skype\\Phone\\Skype.exe"=


R2 gupdate1ca6bb2f4ff0f6c;Tjänsten Google Update (gupdate1ca6bb2f4ff0f6c);c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 133104]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-11-22 691696]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-07-06 64288]
S1 aswSP;aswSP; [x]
S1 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk42.sys [2010-06-17 38976]
S2 aswFsBlk;aswFsBlk; [x]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program\CheckPoint\ZAForceField\ISWKL.sys [2010-05-26 26352]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program\CheckPoint\ZAForceField\IswSvc.exe [2010-05-26 493032]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\Lavasoft\Ad-Aware\AAWService.exe [2010-07-06 1352832]
S3 RT80x86;Linksys WPC600N/WMP600N Wireless-N Card Driver;c:\windows\system32\DRIVERS\RT2860.sys [2009-01-13 712704]

.
Innehållet i mappen 'Schemalagda aktiviteter':

2010-07-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-06 17:28]

2010-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]

2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program\Google\Update\GoogleUpdate.exe [2009-11-22 20:32]
.
.
——- Extra genomsökning ——-
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\2neiu904.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ZoneAlarm Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2611275&SearchSource=13
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICY —-
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-10 21:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLer som "laddats" under processer som körs ———————

- - - - - - - > 'winlogon.exe'(636)
c:\program\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(692)
c:\program\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'explorer.exe'(828)
c:\program\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\System32\msimtf.dll
.
———————— Andra processer som körs ————————
.
c:\program\Alwil Software\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
c:\program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program\Bonjour\mDNSResponder.exe
c:\program\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\program\Delade filer\Pure Networks Shared\Platform\nmsrvc.exe
c:\program\iPod\bin\iPodService.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program\Windows Live\Contacts\wlcomm.exe
c:\program\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Sluttid: 2010-07-10 21:50:19 - datorn startades om.
ComboFix-quarantined-files.txt 2010-07-10 19:50
ComboFix2.txt 2010-07-08 21:56

Före genomsökningen: 29 903 626 240 byte ledigt
Efter genomsökningen: 29 894 873 088 byte ledigt

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - FBE6E8A03A61D2712E6D3FA733A926C9
Post #84
Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

To be on the safe side, I would also change all my passwords.


This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.


Here's my usual all clean post

Log looks good :D


This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.


  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

Only run one Anti-Virus and Firewall program.


I would suggest you read:
PC Safety and Security–What Do I Need?.
How to Prevent Malware:
Post #87 last edited
I forgot to ask you this.. Is there any way of telling from what file this originated? Or where/in what this kind of malware usually hides in?
Post #88

I forgot to ask you this.. Is there any way of telling from what file this originated? Or where/in what this kind of malware usually hides in?

Not that I know of. Most are random .exe files.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI