What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Is this computer clean?

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
Logfile of HijackThis v1.99.1
Scan saved at 00:07:06, on 09.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe
C:\Programfiler\Fellesfiler\Logitech\G-series Software\LGDCore.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDCountdown.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDPOP3.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\WinTV\Ir.exe
C:\Programfiler\Logitech\SetPoint\SetPoint.exe
C:\Programfiler\SpeedFan\speedfan.exe
C:\Programfiler\Fellesfiler\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\FREE DOWNLOAD MANAGER\IEFDM2.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CTAPR2] "C:\Programfiler\Creative\Sound Blaster X-Fi\Console Launcher\CTAPR2.exe" /r
O4 - HKLM\..\Run: [VolPanel] "C:\Programfiler\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Programfiler\Fellesfiler\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Programfiler\SpeedFan\speedfan.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Programfiler\WinTV\Ir.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programfiler\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED89E036-D0A9-4C67-AFF0-39B776944F20}: NameServer = 130.67.60.68,130.67.15.198,193.213.112.4
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programfiler\Fellesfiler\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FELLES~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Programfiler\Windows Live\installer\WLSetupSvc.exe



ComboFix 07-11-08.1 - Mikael 2007-11-09 0:04:29.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.1558 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Skrivebord\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 )))))))))))))))))))))))))))))))
.

2007-11-07 23:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-11-06 08:30 d——– C:\Programfiler\EsetOnlineScanner
2007-11-05 08:25 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-11-01 15:24 dr-h—– C:\Documents and Settings\Mikael\Siste
2007-10-30 21:18 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys
2007-10-29 16:22 d——– C:\WINDOWS\system32\Assassins Creed Diaporama dir
2007-10-28 19:49 d——– C:\Programfiler\Fellesfiler\Wise Installation Wizard
2007-10-24 18:36 d——– C:\Programfiler\MSN Messenger
2007-10-24 14:41 d——– C:\Documents and Settings\Mikael\Programdata\Apple Computer
2007-10-23 20:03 d——– C:\Programfiler\AnswersThatWork
2007-10-23 20:03 368,912 –a—— C:\WINDOWS\system32\vbar332.dll
2007-10-23 19:33 34,816 –a—— C:\WINDOWS\system32\iprip.dll
2007-10-23 19:33 34,816 –a–c— C:\WINDOWS\system32\dllcache\iprip.dll
2007-10-23 19:33 18,944 –a—— C:\WINDOWS\system32\simptcp.dll
2007-10-23 19:33 18,944 –a–c— C:\WINDOWS\system32\dllcache\simptcp.dll
2007-10-23 18:06 d——– C:\Programfiler\TuneXP
2007-10-22 20:55 d——– C:\Programfiler\Apple Software Update
2007-10-22 20:55 d——– C:\Documents and Settings\All Users\Programdata\Apple Computer
2007-10-22 20:55 d——– C:\Documents and Settings\All Users\Programdata\Apple
2007-10-21 15:17 d——– C:\Programfiler\Fellesfiler\Nero
2007-10-20 21:12 d——– C:\Program Files
2007-10-19 13:54 d——– C:\RegSeeker
2007-10-19 13:51 439,644 –a—— C:\WINDOWS\system32\prfh0414.dat
2007-10-19 13:51 78,668 –a—— C:\WINDOWS\system32\prfc0414.dat
2007-10-12 20:44 d–h—– C:\WINDOWS\PIF
2007-10-11 16:54 d——– C:\Documents and Settings\Mikael\Skrivebord2142 fonts
2007-10-10 16:27 d——– C:\Programfiler\SpywareBlaster
2007-10-08 18:28 79,024 –a—— C:\WINDOWS\system32\devcon.exe
2007-10-08 15:41 d——– C:\Documents and Settings\Mikael\Programdata\Hamachi
2007-10-08 15:41 25,544 –a—— C:\WINDOWS\system32\drivers\hamachi.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 22:57 ——— d—–w C:\Programfiler\SpeedFan
2007-11-08 22:50 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Azureus
2007-11-08 21:04 ——— d—–w C:\Documents and Settings\All Users\Programdata\Symantec
2007-11-08 18:28 ——— d—–w C:\Programfiler\Fellesfiler\Symantec Shared
2007-11-08 15:02 ——— d—a-w C:\Documents and Settings\All Users\Programdata\TEMP
2007-11-06 15:38 ——— d–h–w C:\Programfiler\InstallShield Installation Information
2007-11-05 19:07 ——— d—–w C:\Documents and Settings\All Users\Programdata\Microsoft Help
2007-11-04 12:47 22,328 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-04 12:47 103,736 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-04 12:46 66,872 —-a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-11-01 15:25 ——— d—–w C:\Documents and Settings\Mikael\Programdata\teamspeak2
2007-10-31 15:11 ——— d—–w C:\Programfiler\Panda Security
2007-10-31 14:46 ——— d—–w C:\Programfiler\Opera
2007-10-30 18:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-30 18:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-28 19:00 ——— d—–w C:\Programfiler\Java
2007-10-27 13:57 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Canon
2007-10-23 16:19 ——— d—–w C:\Documents and Settings\Mikael\Programdata\FileZilla
2007-10-21 14:17 ——— d—–w C:\Documents and Settings\All Users\Programdata\Nero
2007-10-15 13:49 ——— d—–w C:\Programfiler\Symantec
2007-10-07 12:15 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Media Player Classic
2007-10-07 12:14 ——— d—–w C:\Programfiler\K-Lite Codec Pack
2007-10-05 15:03 ——— d—–w C:\Programfiler\DivX
2007-10-05 01:49 13,056 —-a-w C:\WINDOWS\system32\drivers\FlashSys.sys
2007-10-04 21:55 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Nero
2007-10-03 20:48 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-03 20:48 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-03 20:48 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-03 20:48 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-02 16:45 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Joost
2007-09-30 17:44 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Eltima Software
2007-09-30 17:24 ——— d—–w C:\Documents and Settings\Mikael\Programdata\PE Explorer
2007-09-30 16:54 ——— d—–w C:\Programfiler\QuickTime
2007-09-26 14:53 ——— d—–w C:\Documents and Settings\All Users\Programdata\FLEXnet
2007-09-26 13:44 ——— d—–w C:\Programfiler\Fellesfiler\Adobe
2007-09-26 13:39 ——— d—–w C:\Programfiler\Fellesfiler\Macrovision Shared
2007-09-24 07:05 132,904 —-a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-09-24 07:05 11,304 —-a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-09-22 20:58 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Free Download Manager
2007-09-22 20:40 ——— d—–w C:\Programfiler\Electronic Arts
2007-09-22 15:57 ——— d—–w C:\Programfiler\Norton Internet Security
2007-09-20 07:59 972,072 —-a-w C:\WINDOWS\UNRecode.exe
2007-09-20 07:55 95,600 —-a-w C:\WINDOWS\system32\NeroCo.dll
2007-09-18 12:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 12:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 12:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 12:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 12:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 12:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 12:43 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 12:43 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 12:43 278,576 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-09-12 12:52 ——— d—–w C:\Programfiler\CCleaner
2007-09-11 19:09 ——— d—–w C:\Programfiler\Windows Live
2007-09-11 19:08 ——— d—–w C:\Documents and Settings\All Users\Programdata\WLInstaller
2007-09-11 14:39 ——— d—–w C:\Programfiler\Microsoft CAPICOM 2.1.0.2
2007-09-11 14:29 ——— d—–w C:\Programfiler\Microsoft.NET
2007-09-11 14:29 ——— d—–w C:\Programfiler\Microsoft Works
2007-09-11 14:24 ——— d—–w C:\Documents and Settings\Mikael\Programdata\DivX
2007-09-10 18:29 ——— d—–w C:\Documents and Settings\Mikael\Programdata\Grisoft
2007-09-10 18:29 ——— d—–w C:\Documents and Settings\All Users\Programdata\Grisoft
2007-09-09 13:46 ——— d—–w C:\Documents and Settings\All Users\Programdata\FreeDownloadManager.ORG
2007-09-09 12:45 76,560 —-a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-09-08 23:01 ——— d—–w C:\Programfiler\ATITool
2007-09-08 19:58 12,528 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-09-08 19:52 ——— d—–w C:\Programfiler\Fellesfiler\InstallShield
2007-09-08 17:26 ——— d—–w C:\Programfiler\WinTidy
2007-09-08 16:50 ——— d—–w C:\Programfiler\WinTV
2007-09-08 16:41 142 —-a-w C:\CPU Kritisk Temp.bat
2007-09-08 15:43 ——— d—–w C:\Programfiler\vtplus
2007-08-21 06:18 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-17 16:55 409,600 —-a-w C:\WINDOWS\system32\wrap_oal.dll
2007-08-17 16:55 114,688 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2007-08-16 14:17 51,568 —-a-w C:\WINDOWS\system32\sirenacm.dll
2007-08-08 15:30 19,456 —-a-w C:\WINDOWS\system32\OnlineScannerLang.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"CTAPR2"="C:\Programfiler\Creative\Sound Blaster X-Fi\Console Launcher\CTAPR2.exe" [2007-02-15 15:39]
"VolPanel"="C:\Programfiler\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-02-28 16:50]
"SPIRun"="SPIRun.dll" [2006-11-29 11:35 C:\WINDOWS\system32\SPIRun.dll]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 C:\WINDOWS\KHALMNPR.Exe]
"Launch LCDMon"="C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 15:54]
"Launch LGDCore"="C:\Programfiler\Fellesfiler\Logitech\G-series Software\LGDCore.exe" [2007-04-26 16:22]
"ccApp"="C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" [2007-02-20 13:17]
"osCheck"="C:\Programfiler\Norton Internet Security\osCheck.exe" [2007-02-20 13:16]
"Symantec PIF AlertEng"="C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 16:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:03]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

C:\Documents and Settings\Mikael\Start-meny\Programmer\Oppstart\
SpeedFan.lnk - C:\Programfiler\SpeedFan\speedfan.exe [2007-02-28 19:28:02]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\
AutoStart IR.lnk - C:\Programfiler\WinTV\Ir.exe [2007-08-17 19:16:12]
Logitech SetPoint.lnk - C:\Programfiler\Logitech\SetPoint\SetPoint.exe [2007-08-17 19:36:43]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
"D:\ADOBE\ACROBAT 8.0\ACROBAT\ACROTRAY.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"D:\ADOBE\READER 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Programfiler\Fellesfiler\Nero\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"D:\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Programfiler\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"D:\NERO\NERO 8\NERO BACKITUP\NBKEYSCAN.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Programfiler\Fellesfiler\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe"

R0 Si3531;SiI-3531 SATA Controller;C:\WINDOWS\system32\DRIVERS\Si3531.sys
R1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys
R2 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;"C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
R3 hcwPVRP2;Hauppauge WinTV PVR PCI II (Encoder/Decoder);C:\WINDOWS\system32\DRIVERS\hcwPVRP2.sys
R3 t3;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\t3.sys
R3 t3filt;t3filt;C:\WINDOWS\system32\drivers\t3filt.sys
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;\??\C:\DOCUME~1\Mikael\LOKALE~1\Temp\OnlineScanner\Anti-Virus\fsgk.sys
S3 p2pgasvc;Gruppegodkjenning for nodenettverk;C:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2pimsvc;Identitetsbehandling for nodenettverk;C:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2psvc;Nodenettverk;C:\WINDOWS\system32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe -k p2psvc
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;M:\Nero\Nero 8\Nero BackItUp\NBService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aded19a-4ceb-11dc-ae91-806d6172696f}]
\Shell\AutoRun\command - H:\setup.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-05 20:04:56 C:\WINDOWS\Tasks\Norton Internet Security Online - Kjør fullstendig systemsøk - Mikael.job"
- C:\Programfiler\Norton Internet Security\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 00:06:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-09 0:06:42
.
— E O F —



EDIT: I just noticed that my hosts file was not like the standard one, with information and examples.
But just the text : 127.0.0.1 local host
Is this because of all the fixes we've run, or ?
Post #32
Do you know what this batch file is?
C:\CPU Kritisk Temp.bat

C:\Documents and Settings\All Users\Programdata\TEMP <–Empty this folder. Don't delete the folder.

Unless you know what this file is, I'd either delete it or rename it.
H:\setup.exe
Post #33
Hi LDTate,

Do you know what this batch file is?
C:\CPU Kritisk Temp.bat

Yes, it's a batch file I made for shutting the computer down if it gets too hot. I have to take these precautions because my computer is water cooled, and therefore there's so much more that can go wrong :P

C:\Documents and Settings\All Users\Programdata\TEMP <–Empty this folder. Don't delete the folder.

Done, I cleaned all I could find with CCleaner

Unless you know what this file is, I'd either delete it or rename it.
H:\setup.exe

I cannot even open that drive, because it is my cardreader and only works when there's a memory card in it.
So I don't understand how a setup.exe is there
Post #34

EDIT: I just noticed that my hosts file was not like the standard one, with information and examples.
But just the text : 127.0.0.1 local host
Is this because of all the fixes we've run, or ?

The fixes we ran reset's the host

My guess is that setup.exe is built-in with the card.
Post #35 last edited
Hi LDTate,

Have you figured out anything about the respawning root kit?

Today, I scanned my computer with Norton, and to my surprise Norton acctually found something :P

Here's the log: The original on norwegian

Søkestatistikk:
Søketid: 94
Alternativer for søk:
Mål for søk:
Antall:
Totalt antall elementer gjennomsøkt: 5626
- Filer og kataloger: 2599
- Registeroppføringer 282
- Prosesser og oppstartselementer: 2583
- Nettverk og nettleser-elementer 157
- Andre: 5

Totalt antall sikkerhetsrisikoer oppdaget: 1
Totalt antall løste elementer: 1
Totalt antall elementer som krever gransking: 0

Løste trusler:
Adware.SystemProcess
Virus-ID: 4294906512
Type: Uregelmessighet
Risiko: Høy (Høy Stealth, Høy Fjerning, Høy Ytelse, Middels Personvern)
Kategorier: Reklameprogrammer
Status: Helt løst
———–
58 Registeroppføringer
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - Ingen handling kreves
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - Ingen handling kreves
HKEY_LOCAL_MACHINE\SOFTWARE\System Process - Ingen handling kreves
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Startup - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - Slettet
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - Ingen handling kreves
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List->%windir%\system32\ccapp.exe - Ingen handling kreves
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - Ingen handling kreves
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - Ingen handling kreves
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - Ingen handling kreves
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - Ingen handling kreves
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\->Startup - Ingen handling kreves
2 Filer
C:\WINDOWS\system32\p.dat - Ingen handling kreves
C:\Documents and Settings\Mikael\Lokale innstillinger\Temp\ibho.log - Ingen handling kreves


uLøste trusler:


Transelated to English

Search statistic:
Searchtime: 94
Alternates for search:
Goals for search:
Number/quantity:
Total number of elements searched: 5626
- Files and Catalogs: 2599
- Register entrys 282
- Processes and startup elements: 2583
- Nettwork and internet-browser elements 157
- Others: 5

Total number of security threats discovered: 1
Total number of solved elements: 1
Total number of elements in need of investigation: 0

Solved theatsh:
Adware.SystemProcess
Virus-ID: 4294906512
Type: Uregelmessighet
Risiko: High (High Stealth, High Removal, High Performance, Middels Pricacy Protection)
Categories: Advertisingprograms
Status: Completely solved
———–
58 Registerentrys
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - No action required
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - No action required
HKEY_LOCAL_MACHINE\SOFTWARE\System Process - No action required
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Startup - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\anrdoezrs.net- No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cc-dt.com - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dpbolvw.net - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\jdoqocy.com- No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\kqzyfj.com - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com- No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - Removed
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tkqlhce.com - No action required
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List->%windir%\system32\ccapp.exe - No action required
HKEY_USERS\S-1-5-21-220523388-2147017803-839522115-1005\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - No action required
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - No action required
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - No action required
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\New Windows\Allow->*.system-processes.com - No action required
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\->Startup - No action required
2 Filer
C:\WINDOWS\system32\p.dat - No action required
C:\Documents and Settings\Mikael\Lokale innstillinger\Temp\ibho.log - No action required




unSolved threats:




Log from AVG Anti-Rootkit
filePath: C:\PROGRA~1\FELLES~1\SYMANT~1\VIRUSD~1\20071108.016\NAVENG.SYS Description: Hidden driver filePath: C:\PROGRA~1\FELLES~1\SYMANT~1\VIRUSD~1\20071108.016\NAVEX15.SYS Description: Hidden driver filePath: C:\WINDOWS\System32\Drivers\axvou8g9.SYS Description: Hidden driver file


HijackThis!

Logfile of HijackThis v1.99.1
Scan saved at 19:26:10, on 11.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programfiler\Fellesfiler\Logitech\G-series Software\LGDCore.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDCountdown.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDPOP3.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\WinTV\Ir.exe
C:\Programfiler\Logitech\SetPoint\SetPoint.exe
C:\Programfiler\SpeedFan\speedfan.exe
C:\Programfiler\Fellesfiler\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\Programfiler\Fellesfiler\Logitech\LCD Manager\LCDMon.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\FREE DOWNLOAD MANAGER\IEFDM2.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CTAPR2] "C:\Programfiler\Creative\Sound Blaster X-Fi\Console Launcher\CTAPR2.exe" /r
O4 - HKLM\..\Run: [VolPanel] "C:\Programfiler\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Programfiler\Fellesfiler\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Programfiler\SpeedFan\speedfan.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Programfiler\WinTV\Ir.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programfiler\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED89E036-D0A9-4C67-AFF0-39B776944F20}: NameServer = 130.67.60.68,130.67.15.198,193.213.112.4
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programfiler\Fellesfiler\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FELLES~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Programfiler\Windows Live\installer\WLSetupSvc.exe


EDIT: What's up with The 
[Spoiler] [/Spoiler]
I'm used to spoilers hiding text in small bars, but this tops the cake. Coloring the surroundings black :wacko:
Post #37
Jupp, Symantec acctually updated half an hour ago. I killed the one now, but I fear that next time I restart, it will be there again with another name :(
Post #38
Run the scan again and we'll see if the ones like this are gone which is bad.
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - No action required

BlockChecker/Adclicker-DF alias SystemProcess adware

Post #39
Path: C:\WINDOWS\System32\Drivers\a6tlwe3n.SYS Description: Hidden driver file Search statistic: Searchtime:4699 Alternates for search: Goals for search: Number/quantity: Total number of elements searched: 539927 - Files and Catalogs: 537086 - Register entrys 286 - Processes and startup elements: 2385 - Nettwork and internet-browser elements 165 - Others: 5 Total number of security threats discovered: 0 Total number of solved elements: 0 Total number of elements in need of investigation: 0 Solved threats: unSolved threats: this is all there was
Post #40
Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\System32\Drivers\a6tlwe3n.SYS

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html
Post #42
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.
Post #43

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


I have done so all the times I tried to upload files to jotti, no result :(
Post #44
We can keep trying.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
  • If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    [external image: Posted Image]
    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
Post #45 last edited
Hi LDTate, I guess I should search in normal mode, cus thats when the nasty stuff swarm in memory, right? At least, that's what I tried, and every time I did, it crashed. I came to random percentage all the time, there was no particular file it stopped on as far as I could see. Sometimes it came to 40% and sometimes to 70%, and so on.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI