What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

explorer.exe doesn't boot after combofix scan

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hi,

CombFix scan ran properly this time, here is the log
Computer is working normally :)

Regards
doug61



ComboFix 10-10-18.03 - Andrea 2010-10-19 12:25:33.7.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.1789.1173 [GMT 2:00]
Körs från: c:\users\Andrea\Desktop\ComboFix.exe
* Skapade en ny återställningspunkt
.

(((((((((((((((((((((((( Filer Skapade från 2010-09-19 till 2010-10-19 ))))))))))))))))))))))))))))))
.

2010-10-19 10:32 . 2010-10-19 10:32 ——– d—–w- c:\users\Andrea\AppData\Local\temp
2010-10-19 10:32 . 2010-10-19 10:32 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-10-18 21:10 . 2009-07-14 01:14 26112 —-a-w- c:\windows\system32\userinit.exe
2010-10-15 16:20 . 2010-09-09 22:52 6084944 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0564856A-9065-49E4-AACB-CF198E0E9862}\mpengine.dll
2010-10-13 22:10 . 2010-08-31 04:32 954752 —-a-w- c:\windows\system32\mfc40.dll
2010-10-13 22:10 . 2010-08-31 04:32 954288 —-a-w- c:\windows\system32\mfc40u.dll
2010-10-13 22:10 . 2010-09-01 04:26 164864 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-13 22:10 . 2010-09-01 04:23 12625408 —-a-w- c:\windows\system32\wmploc.DLL
2010-10-13 22:10 . 2010-09-01 02:34 2327552 —-a-w- c:\windows\system32\win32k.sys
2010-10-13 22:10 . 2010-08-27 05:46 168448 —-a-w- c:\windows\system32\srvsvc.dll
2010-10-13 22:10 . 2010-08-27 03:31 310784 —-a-w- c:\windows\system32\drivers\srv.sys
2010-10-13 22:10 . 2010-08-27 03:30 308736 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-10-13 22:10 . 2010-08-27 03:30 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-13 22:10 . 2010-08-21 05:36 738816 —-a-w- c:\windows\system32\wmpmde.dll
2010-10-13 22:10 . 2010-05-05 06:46 363520 —-a-w- c:\windows\system32\StructuredQuery.dll
2010-10-08 12:40 . 2010-10-08 12:40 ——– d—–w- c:\program files\ERUNT
2010-10-06 22:40 . 2009-10-31 06:00 2614272 —-a-w- c:\windows\system32\userinit.old
2010-09-29 16:32 . 2010-06-19 06:15 2048 —-a-w- c:\windows\system32\tzres.dll
2010-09-25 21:46 . 2010-09-25 21:46 ——– d—–w- C:\Device
2010-09-25 21:45 . 2009-07-14 01:19 106064 —-a-w- c:\windows\system32\drivers\ql40xx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-10-18_20.41.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-10 00:42 . 2010-10-19 10:26 39884 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 04:55 . 2010-10-18 20:42 60036 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2010-10-19 10:26 60036 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-12-29 14:05 . 2010-10-19 10:26 11664 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3760139838-320174693-3477707339-1002_UserData.bin
- 2009-12-29 14:24 . 2010-10-18 20:20 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-12-29 14:24 . 2010-10-19 10:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-12-29 14:24 . 2010-10-19 10:26 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-29 14:24 . 2010-10-18 20:20 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-29 14:24 . 2010-10-18 20:20 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-12-29 14:24 . 2010-10-19 10:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-12-29 14:24 . 2010-10-19 10:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-12-29 14:24 . 2010-10-18 20:20 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-12-29 14:24 . 2010-10-19 10:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-12-29 14:24 . 2010-10-18 20:20 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-18 22:23 . 2010-10-18 22:23 25088 c:\windows\Installer\2782cd.msi
- 2010-10-18 20:41 . 2010-10-18 20:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-10-19 10:24 . 2010-10-19 10:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-10-19 10:24 . 2010-10-19 10:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-10-18 20:41 . 2010-10-18 20:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-09-10 01:15 . 2010-10-18 20:22 620290 c:\windows\System32\perfh01D.dat
+ 2009-09-10 01:15 . 2010-10-19 10:29 620290 c:\windows\System32\perfh01D.dat
- 2009-07-14 02:05 . 2010-10-18 20:22 610094 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2010-10-19 10:29 610094 c:\windows\System32\perfh009.dat
- 2009-09-10 01:15 . 2010-10-18 20:22 121922 c:\windows\System32\perfc01D.dat
+ 2009-09-10 01:15 . 2010-10-19 10:29 121922 c:\windows\System32\perfc01D.dat
- 2009-07-14 02:05 . 2010-10-18 20:22 104412 c:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2010-10-19 10:29 104412 c:\windows\System32\perfc009.dat
- 2009-07-14 02:03 . 2010-10-18 20:03 7077888 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-07-14 02:03 . 2010-10-18 21:50 7077888 c:\windows\System32\SMI\Store\Machine\schema.dat
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-09 39408]

c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-2-18 95232]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BankID s„kerhetsprogram.lnk - c:\program files\Personal\bin\Personal.exe [2010-2-15 939920]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-30 795936]
Telenor Mobilt Bredband.lnk - c:\program files\Option\Telenor Mobilt Bredband\Telenor Mobilt Bredband.exe [2007-5-18 724992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Users^Andrea^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Antimalware Doctor.lnk]
path=c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk
backup=c:\windows\pss\Antimalware Doctor.lnk.Startup
backupExtension=.Startup

R1 cjliwvfj;cjliwvfj;c:\windows\system32\drivers\cjliwvfj.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 135664]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\DRIVERS\Gtm51Irp.sys [2007-01-15 122240]
R3 GTUQBUS;GT UQ BUS;c:\windows\system32\DRIVERS\gtuqbus.sys [2007-01-15 36992]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-13 1120752]
R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\aestsrv.exe [2009-03-02 81920]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-04 176128]
S2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [2007-02-09 176128]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-06-18 635416]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-20 313856]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 19:11 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Innehållet i mappen 'Schemalagda aktiviteter':

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:53]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:53]

2010-10-18 c:\windows\Tasks\HPCeeScheduleForAndrea.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 02:22]
.
.
——- Extra genomsökning ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=92&bd=all&pf=cmnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=92&bd=all&pf=cmnb
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Skicka bild till &Bluetooth-enhet… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Skicka sida till &Bluetooth-enhet… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\7fuwrb8s.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Personal\bin\np_prsnl.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICY —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x83202000]<< >>UNKNOWN [0x88F9F000]<< >>UNKNOWN [0x89BC2000]<< >>UNKNOWN [0x88D90000]<< >>UNKNOWN [0x83612000]<< >>UNKNOWN [0x89100000]<< >>UNKNOWN [0x88F26000]<< >>UNKNOWN [0x89182000]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\system\ControlSet002\services\wpruqsrhrapbupm]
"imagepath"="\??\c:\windows\TEMP\5B58.tmp"
.
——————— LÅSTA REGISTERNYCKLAR ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Sluttid: 2010-10-19 12:34:34
ComboFix-quarantined-files.txt 2010-10-19 10:34
ComboFix2.txt 2010-10-18 20:44

Före genomsökningen: 96 399 478 784 byte ledigt
Efter genomsökningen: 96 194 973 696 byte ledigt

- - End Of File - - 07FB34114E1B134C2F17B2AC3741AC40
Post #32
Hi,

Let's run Combofix again.

Please do the following:

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\TEMP\5B58.tmp
c:\windows\system32\drivers\cjliwvfj.sys
c:\windows\pss\Antimalware Doctor.lnk.Startup
c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk

Driver::
cjliwvfj
wpruqsrhrapbupm

Registry::
[-HKLM\~\startupfolder\C:^Users^Andrea^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Antimalware Doctor.lnk]

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Post #33
Hi, ComboFix ran OK and produced a log report. After that no programmes would open, Error message "trying to access registery key marked for deletion" Rebooted and all now runs as normal. Regards doug61 ComboFix 10-10-19.03 - Andrea 2010-10-20 12:30:12.8.2 - x86 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.1789.1149 [GMT 2:00] Körs från: c:\users\Andrea\Desktop\ComboFix.exe Använda kommandoväxlar :: c:\users\Andrea\Desktop\CFScript.txt FILE :: "c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk" "c:\windows\pss\Antimalware Doctor.lnk.Startup" "c:\windows\system32\drivers\cjliwvfj.sys" "c:\windows\TEMP\5B58.tmp" . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\pss\Antimalware Doctor.lnk.Startup . ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Service_cjliwvfj ——-\Service_wpruqsrhrapbupm (((((((((((((((((((((((( Filer Skapade från 2010-09-20 till 2010-10-20 )))))))))))))))))))))))))))))) . 2010-10-20 10:37 . 2010-10-20 10:39 ——– d—–w- c:\users\Andrea\AppData\Local\temp 2010-10-20 10:37 . 2010-10-20 10:37 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-10-19 17:00 . 2010-10-07 23:21 6146896 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FA021F91-C1B2-44F2-A439-0F3BF4AFBDEB}\mpengine.dll 2010-10-18 21:10 . 2009-07-14 01:14 26112 —-a-w- c:\windows\system32\userinit.exe 2010-10-13 22:10 . 2010-08-31 04:32 954752 —-a-w- c:\windows\system32\mfc40.dll 2010-10-13 22:10 . 2010-08-31 04:32 954288 —-a-w- c:\windows\system32\mfc40u.dll 2010-10-13 22:10 . 2010-09-01 04:26 164864 —-a-w- c:\program files\Windows Media Player\wmplayer.exe 2010-10-13 22:10 . 2010-09-01 04:23 12625408 —-a-w- c:\windows\system32\wmploc.DLL 2010-10-13 22:10 . 2010-09-01 02:34 2327552 —-a-w- c:\windows\system32\win32k.sys 2010-10-13 22:10 . 2010-08-27 05:46 168448 —-a-w- c:\windows\system32\srvsvc.dll 2010-10-13 22:10 . 2010-08-27 03:31 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-10-13 22:10 . 2010-08-27 03:30 308736 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-10-13 22:10 . 2010-08-27 03:30 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2010-10-13 22:10 . 2010-08-21 05:36 738816 —-a-w- c:\windows\system32\wmpmde.dll 2010-10-13 22:10 . 2010-05-05 06:46 363520 —-a-w- c:\windows\system32\StructuredQuery.dll 2010-10-08 12:40 . 2010-10-08 12:40 ——– d—–w- c:\program files\ERUNT 2010-10-06 22:40 . 2009-10-31 06:00 2614272 —-a-w- c:\windows\system32\userinit.old 2010-09-29 16:32 . 2010-06-19 06:15 2048 —-a-w- c:\windows\system32\tzres.dll 2010-09-25 21:46 . 2010-09-25 21:46 ——– d—–w- C:\Device 2010-09-25 21:45 . 2009-07-14 01:19 106064 —-a-w- c:\windows\system32\drivers\ql40xx.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* Tomma poster & legitima standardposter visas inte. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-09 39408] c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-2-18 95232] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BankID s„kerhetsprogram.lnk - c:\program files\Personal\bin\Personal.exe [2010-2-15 939920] Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-30 795936] Telenor Mobilt Bredband.lnk - c:\program files\Option\Telenor Mobilt Bredband\Telenor Mobilt Bredband.exe [2007-5-18 724992] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys] @="FSFilter System Recovery" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408] R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\DRIVERS\Gtm51Irp.sys [2007-01-15 122240] R3 GTUQBUS;GT UQ BUS;c:\windows\system32\DRIVERS\gtuqbus.sys [2007-01-15 36992] R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-13 1120752] R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\aestsrv.exe [2009-03-02 81920] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-04 176128] S2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [2007-02-09 176128] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 135664] S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-06-18 635416] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-20 313856] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 19:11 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Innehållet i mappen 'Schemalagda aktiviteter': 2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:53] 2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 19:53] 2010-10-18 c:\windows\Tasks\HPCeeScheduleForAndrea.job - c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 02:22] . . ——- Extra genomsökning ——- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=92&bd=all&pf=cmnb mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=sv_SE&c=92&bd=all&pf=cmnb uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Skicka bild till &Bluetooth-enhet… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Skicka sida till &Bluetooth-enhet… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm FF - ProfilePath - c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\7fuwrb8s.default\ FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Personal\bin\np_prsnl.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll —- FIREFOX POLICY —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . [HKEY_LOCAL_MACHINE\system\ControlSet002\services\pdfcDispatcher] "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . ——————— LÅSTA REGISTERNYCKLAR ——————— [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLer som "laddats" under processer som körs ——————— - - - - - - - > 'Explorer.exe'(3540) c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll . ———————— Andra processer som körs ———————— . c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\STacSV.exe c:\windows\system32\atieclxx.exe c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\windows\system32\taskhost.exe c:\program files\LSI SoftModem\agrsmsvc.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\conhost.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\servicing\TrustedInstaller.exe c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe c:\windows\system32\sppsvc.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE . ************************************************************************** . Sluttid: 2010-10-20 12:43:37 - datorn startades om. ComboFix-quarantined-files.txt 2010-10-20 10:43 ComboFix2.txt 2010-10-19 10:34 ComboFix3.txt 2010-10-18 20:44 Före genomsökningen: 96 011 816 960 byte ledigt Efter genomsökningen: 95 749 902 336 byte ledigt - - End Of File - - DE15054081550278000FFE9F580B0CEB
Post #34
Hi,

I missed one. :)

Please do the following:
  • Right Click on Windows 7 Start Menu and select Properties.
  • Under Customize Start Menu window, click on Customize under Start Menu tab.
  • Scroll down and put a check mark by clicking on the box beside Run Command checkbox.
  • Click OK button to save the settings.
–Next–
  • Click on Windows 7 Start Menu and right-click Run.. then choose Run as Administrator
  • Copy and paste the following text inside the quotebox:

    cmd /c del /f/a/q c:\windows\system32\userinit.old

  • Click OK or press the Enter key.
–Next–
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


–Next–

Please be patient as this scan can take a while to complete:

Run an on-line scan with Kaspersky

Right click Internet Explorer or Firefox then choose "Run as Administrator" to run the program.

NOTE: After scanning with Kaspersky, close your browser then run it without administrator privileges for your browsing.

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
–Next–

Run a fresh DDS scan for me please then test your computer's performance.

To post in your next reply:
1. Malwarebytes' log.
2. Kaspersky log.
3. DDS logs.
4. How is your computer?
Post #35
Hi, 1) MBAM didn't find anything, log file below: 2) Kaspersky did find stuff, log file below 3) DDS files below\attached 4) Computer appears to be working fine :) Regards doug61 MBAM log: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4904 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 2010-10-21 21:36:09 mbam-log-2010-10-21 (21-36-09).txt Scan type: Quick scan Objects scanned: 144384 Time elapsed: 6 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Kaspersky Log: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Friday, October 22, 2010 Operating system: Microsoft Home Edition (build 7600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, October 21, 2010 17:43:52 Records in database: 4184827 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ E:\ F:\ Scan statistics: Objects scanned: 170253 Threats found: 12 Infected objects found: 19 Suspicious objects found: 0 Scan duration: 02:48:15 File name / Threat / Threats count C:\Qoobox\Quarantine\C\Users\Andrea\AppData\Roaming\hotfix.exe.vir Infected: Trojan.Win32.FakeAV.hko 1 C:\Qoobox\Quarantine\C\windows\explorer.exe.vir Infected: Trojan.Win32.Patched.kl 1 C:\Qoobox\Quarantine\C\windows\system32\Drivers\ql40xx.sys.vir_ Infected: Virus.Win32.TDSS.b 1 C:\Qoobox\Quarantine\C\windows\system32\USRINI~1.EXE.vir Infected: Packed.Win32.Krap.ao 1 C:\Qoobox\Quarantine\C\windows\system32\wininit.exe.vir Infected: Trojan.Win32.Patched.kl 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\22406dd0-3ad702a9 Infected: Trojan-Downloader.Java.Agent.bk 2 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\22406dd0-3ad702a9 Infected: Exploit.Java.Agent.f 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\22406dd0-3ad702a9 Infected: Exploit.Java.Agent.a 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\4991fdd-449655f0 Infected: Exploit.Java.Agent.dm 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\4991fdd-449655f0 Infected: Trojan-Downloader.Java.Agent.hf 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\606c9061-6dfbda8a Infected: Exploit.Java.CVE-2008-5353.e 4 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\7171f5ac-1bc2cb03 Infected: Exploit.Java.Agent.a 1 C:\Users\Andrea\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\7171f5ac-1bc2cb03 Infected: Trojan.Java.ClassLoader.aw 1 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2K2SKOY\default[1] Infected: Trojan.HTML.Fraud.bp 1 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2K2SKOY\default[2] Infected: Trojan.HTML.Fraud.bp 1 Selected area has been scanned. DDS log: DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 1:25:35,38 on 2010-10-22 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.1789.1137 [GMT 2:00] ============== Running Processes =============== C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\STacSV.exe C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\atieclxx.exe C:\windows\system32\svchost.exe -k NetworkService C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\windows\Explorer.EXE C:\windows\system32\taskhost.exe C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\aestsrv.exe C:\Program Files\LSI SoftModem\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\PDF Complete\pdfsvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Personal\bin\Personal.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Option\Telenor Mobilt Bredband\Telenor Mobilt Bredband.exe C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe C:\windows\system32\SearchIndexer.exe C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\windows\System32\svchost.exe -k secsvcs C:\Program Files\Windows Media Player\wmpnetwk.exe C:\windows\system32\taskhost.exe C:\windows\system32\taskmgr.exe C:\windows\system32\NOTEPAD.EXE C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\Dwm.exe C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\system32\wbem\wmiprvse.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Andrea\Desktop\dds.scr C:\windows\system32\conhost.exe C:\windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=sv_SE&c;=92&bd;=all&pf;=cmnb mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=sv_SE&c;=92&bd;=all&pf;=cmnb uInternet Settings,ProxyOverride = *.local BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll TB: &Windows; Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" StartupFolder: c:\users\andrea\appdata\roaming\micros~1\windows\startm~1\programs\startup\bbcipl~1.lnk - c:\program files\bbc iplayer desktop\BBC iPlayer Desktop.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\bankid~1.lnk - c:\program files\personal\bin\Personal.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\teleno~1.lnk - c:\program files\option\telenor mobilt bredband\Telenor Mobilt Bredband.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Skicka bild till &Bluetooth-enhet;… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Skicka sida till &Bluetooth-enhet;… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\users\andrea\appdata\roaming\mozilla\firefox\profiles\7fuwrb8s.default\ FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\personal\bin\np_prsnl.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B"); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_x86_neutral_b3d7bbbd6875f4bb\AEstSrv.exe [2009-12-29 81920] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-4 176128] R2 GtFlashSwitch;GtFlashSwitch;c:\program files\common files\gtflashswitch\GtFlashSwitch.exe [2007-2-9 176128] R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2009-9-10 635416] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-20 313856] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-9 135664] S2 myAgtSvc;McAfee Virus and Spyware Protection Service;"c:\program files\mcafee\managed virusscan\agent\myagtsvc.exe" /servicestart –> c:\program files\mcafee\managed virusscan\agent\myAgtSvc.Exe [?] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2009-12-29 29472] S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-9-10 228408] S3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\drivers\Gtm51Irp.sys [2007-1-15 122240] S3 GTUQBUS;GT UQ BUS;c:\windows\system32\drivers\gtuqbus.sys [2007-1-15 36992] S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2009-6-13 1120752] S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-19 1343400] =============== Created Last 30 ================ 2010-10-20 10:42:32 0 d-sh–w- C:\$RECYCLE.BIN 2010-10-18 21:10:47 26112 —-a-w- c:\windows\system32\userinit.exe 2010-10-13 22:10:59 954752 —-a-w- c:\windows\system32\mfc40.dll 2010-10-13 22:10:59 954288 —-a-w- c:\windows\system32\mfc40u.dll 2010-10-13 22:10:55 12625408 —-a-w- c:\windows\system32\wmploc.DLL 2010-10-13 22:10:54 2327552 —-a-w- c:\windows\system32\win32k.sys 2010-10-13 22:10:53 738816 —-a-w- c:\windows\system32\wmpmde.dll 2010-10-13 22:10:53 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-10-13 22:10:53 308736 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-10-13 22:10:53 168448 —-a-w- c:\windows\system32\srvsvc.dll 2010-10-13 22:10:53 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2010-10-13 22:10:52 363520 —-a-w- c:\windows\system32\StructuredQuery.dll 2010-09-29 16:32:01 2048 —-a-w- c:\windows\system32\tzres.dll 2010-09-25 21:46:50 0 d—–w- C:\Device 2010-09-25 21:45:07 106064 —-a-w- c:\windows\system32\drivers\ql40xx.sys 2010-09-25 21:42:09 98816 —-a-w- c:\windows\sed.exe 2010-09-25 21:42:09 77312 —-a-w- c:\windows\MBR.exe 2010-09-25 21:42:09 256512 —-a-w- c:\windows\PEV.exe 2010-09-25 21:42:09 161792 —-a-w- c:\windows\SWREG.exe 2010-09-25 08:12:42 65536 –sha-w- c:\users\andrea\ntuser.dat{a0e7d50a-c87c-11df-8373-0ceee6dc25a5}.TM.blf 2010-09-25 08:12:42 524288 –sha-w- c:\users\andrea\ntuser.dat{a0e7d50a-c87c-11df-8373-0ceee6dc25a5}.TMContainer00000000000000000002.regtrans-ms 2010-09-25 08:12:42 524288 –sha-w- c:\users\andrea\ntuser.dat{a0e7d50a-c87c-11df-8373-0ceee6dc25a5}.TMContainer00000000000000000001.regtrans-ms ==================== Find3M ==================== 2010-10-21 23:19:24 620290 —-a-w- c:\windows\system32\perfh01D.dat 2010-10-21 23:19:24 121922 —-a-w- c:\windows\system32\perfc01D.dat 2010-09-13 18:48:49 125 —-a-w- c:\users\andrea\appdata\roaming\file.bat 2010-09-13 16:51:45 43088 —-a-w- c:\windows\system32\drivers\pcw.sys 2010-09-08 04:30:04 978432 —-a-w- c:\windows\system32\wininet.dll 2010-09-08 04:28:15 44544 —-a-w- c:\windows\system32\licmgr10.dll 2010-08-26 04:39:58 109056 —-a-w- c:\windows\system32\t2embed.dll 2010-08-21 05:36:24 224256 —-a-w- c:\windows\system32\schannel.dll 2010-08-21 05:33:24 530432 —-a-w- c:\windows\system32\comctl32.dll 2010-07-29 06:30:49 197632 —-a-w- c:\windows\system32\ir32_32.dll 2010-07-29 06:30:34 82944 —-a-w- c:\windows\system32\iccvid.dll 2009-09-10 01:14:13 37052 —-a-w- c:\windows\inf\perflib\041d\perfd.dat 2009-09-10 01:14:13 37052 —-a-w- c:\windows\inf\perflib\041d\perfc.dat 2009-09-10 01:14:13 294764 —-a-w- c:\windows\inf\perflib\041d\perfi.dat 2009-09-10 01:14:13 294764 —-a-w- c:\windows\inf\perflib\041d\perfh.dat 2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat 2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe ============= FINISH: 1:26:04,45 ===============

Attachments:

Post #36
Hi,

Some of those infections found by Kaspersky are already quarantined and poses no threat, some of them are in your java cache and temp files. We will be cleaning those in the next steps.

Download TFC to your desktop
  • Close any open windows.
  • Right click the TFC icon then choose "Run as Administrator" to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
Let's do a little clean up before you go.

Delete the following:
  • DDS
  • RootkitUnhooker
  • MBRcheck
  • Mcafee removal tool
  • Systemlook
  • fix.reg
  • GMER
  • All the logs we've created.
You can keep TFC and use it to clean your computer of some junk atleast once a week. You can also keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

[external image: Posted Image]

–Next–

You need to create a new Clean restore point.
  • Click Start - All Programs - Accessories - System Tools - System Restore
  • Click on open System Protection.
  • On the System Protection tab in System Properties click on Create.
  • Give the restore point an appropriate name and click Create.
–Next–
  • Open any folder.
  • Click on Organize button.
  • Select Folders and Search Options.
  • On the Folder Options window, click on View tab.
  • Select Show hidden files and folders from the list.
  • Click OK to save the new settings and close the Folder Options window.

–Next–

Outdated Java [external image: Posted Image]

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

Java™ 6 Update 17

This is outdated, and a security risk by having it installed still. Java™ 6 Update 17 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. Let me know if it does not.

Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

Once the install is complete…

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
–Next–

To keep your operating system up to date visit
  • Secunia Software inspector to check your program update status.
  • Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Limited User Accounts
Malware: Help prevent the Infection by Sandi Hardmeier
Preventing Malware - Tools and Practices for Safe Computing

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked as "Resolved".

Good luck, happy computing and stay clean! ^_^
Post #37
Hi, I've updated the system as per your last post and everything is working fine. I really appreciate your help with this one, it has been an interesting journey! Thanks again to you and the other WTT helpers that offer hope to us amateurs when all seems lost. Regards, Goodbye and Good Luck doug61

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI