arcspin
Topic Starter
Hello,
I too have been slammed by the Trojan dropper agent and are now seeking help to remove the little bastard from my computer.
All help are highly appreciated!
I have read a previous post about removal instructions regarding the above virus and have taken the first four steps in Simon.V guidelines.
http://forums.whatthetech.com/Win32_Trojan…ml&p=427286
…here are the logfiles for you to read.
COMBOFIX.TXT
ComboFix 08-01-07.5 - Peter 2008-01-08 16:53:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1053.18.1325 [GMT 1:00]
Running from: F:\Recent Download\ANTIVIRUS\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\mljhebc.dll
C:\WINDOWS\SYSTEM32\nqtwa.ini2
C:\WINDOWS\SYSTEM32\wvvwa.ini2
.
((((((((((((((((((((((((( Files Created from 2007-12-08 to 2008-01-08 )))))))))))))))))))))))))))))))
.
2008-01-08 16:53 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-08 16:49 . 2008-01-08 16:49 d——– C:\Program\CCleaner
2008-01-07 22:31 . 2008-01-07 22:31 37,888 –a—— C:\WINDOWS\SYSTEM32\cbxyabc.dll
2008-01-05 00:54 . 2008-01-05 00:54 d——– C:\Program\Alcohol Soft
2008-01-05 00:51 . 2008-01-05 00:51 685,816 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys
2008-01-01 21:51 . 2008-01-01 21:51 d——– C:\Program\FireTune
2008-01-01 21:51 . 2008-01-01 21:51 737,280 –a—— C:\WINDOWS\iun6002.exe
2007-12-30 21:07 . 2008-01-08 06:11 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-30 21:07 . 2008-01-01 22:36 725,144 –a—— C:\WINDOWS\happy_new_year_pics2008.zip
2007-12-29 16:12 . 2008-01-07 07:42 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-29 16:12 . 2007-12-29 16:12 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-28 12:25 . 2007-12-28 12:25 306,432 –a—— C:\WINDOWS\SYSTEM32\TuneUpDefragService.exe
2007-12-28 12:24 . 2007-12-28 12:26 d——– C:\Program\TuneUp Utilities 2008
2007-12-15 09:27 . 2007-12-15 09:27 d——– C:\Documents and Settings\Peter\Lokala inställningar
2007-12-15 01:51 . 2007-12-15 01:52 d——– C:\Program\SmartFTP Client
2007-12-15 01:50 . 2007-12-15 01:50 d——– C:\Program\SmartFTP Client 2.5 Setup Files
2007-12-14 23:07 . 2007-12-14 23:07 d——– C:\Documents and Settings\Peter\Application Data\Prism
2007-12-14 23:06 . 2007-12-16 13:26 d——– C:\Program\Prism
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-08 15:51 ——— d—–w C:\Documents and Settings\Peter\Application Data\uTorrent
2008-01-08 15:49 ——— d—–w C:\Program\GreatNews
2008-01-08 05:11 ——— d—–w C:\Program\SysMetrix
2008-01-08 05:11 ——— d—–w C:\Program\Serv-U
2008-01-08 05:11 ——— d—–w C:\Documents and Settings\Peter\Application Data\MailWasherPro
2008-01-07 21:36 ——— d—–w C:\Program\Switch Off
2008-01-04 23:16 ——— d—–w C:\Program\DC++
2008-01-03 20:43 ——— d—–w C:\Program\Last.fm
2008-01-01 21:36 ——— d—–w C:\Documents and Settings\Peter\Application Data\AdobeUM
2007-12-30 17:13 724,992 —-a-w C:\WINDOWS\SYSTEM32\NTSpool.exe
2007-12-30 10:45 ——— d—–w C:\Program\Minilyrics
2007-12-28 22:26 ——— d—–w C:\Program\MSECache
2007-12-28 11:29 ——— d—–w C:\Program\TuneUp Utilities 2007
2007-12-28 11:24 ——— d—–w C:\Program\Delade filer\Wise Installation Wizard
2007-12-20 09:41 29,440 —-a-w C:\WINDOWS\SYSTEM32\uxtuneup.dll
2007-12-12 15:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-05 16:34 ——— d—–w C:\Documents and Settings\Peter\Application Data\PCF-VLC
2007-11-30 16:11 ——— d—–w C:\Program\Joost
2007-11-29 16:39 ——— d—–w C:\Documents and Settings\Peter\Application Data\Joost
2007-11-28 15:49 ——— d–h–w C:\Program\InstallShield Installation Information
2007-11-28 15:49 ——— d—–w C:\Program\Google
2007-11-20 21:42 ——— d—–w C:\Program\Chapura
2007-11-20 16:06 ——— d—–w C:\Program\ALEGA
2007-11-13 17:19 ——— d—–w C:\Program\palmOne
2007-11-13 16:30 ——— d—–w C:\Program\Palm
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 00:27 ——— d—–w C:\Documents and Settings\Peter\Application Data\HotSync
2007-11-10 23:45 ——— d—–w C:\Program\Chapura(2)
2007-10-30 23:27 3,590,656 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:45 1,289,728 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:45 1,289,728 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-25 16:44 8,467,968 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-25 08:28 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-25 08:28 222,720 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-10 23:53 824,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-10 23:53 671,232 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-10 23:53 63,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-10-10 23:53 6,065,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-10-10 23:53 52,224 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-10-10 23:53 478,208 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-10 23:53 459,264 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-10-10 23:53 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-10-10 23:53 384,512 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-10-10 23:53 383,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-10-10 23:53 27,648 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-10 23:53 267,776 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-10-10 23:53 232,960 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-10-10 23:53 230,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-10-10 23:53 214,528 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-10 23:53 193,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-10 23:53 153,088 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-10-10 23:53 132,608 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-10 23:53 124,928 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-10-10 23:53 105,984 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-10-10 23:53 102,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-10-10 23:53 1,159,680 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-10 11:04 70,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-10-10 11:04 625,152 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2005-05-13 15:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 09:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-13 19:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2006-06-25 10:12 295,424 –sha-w C:\WINDOWS\SYSTEM32\avisynth.dll
2005-07-14 10:31 27,648 –sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
2005-06-26 13:32 616,448 –sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
2005-06-21 20:37 45,568 –sha-r C:\WINDOWS\SYSTEM32\cygz.dll
2004-01-24 22:00 70,656 –sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
2006-04-27 08:24 2,945,024 –sha-r C:\WINDOWS\SYSTEM32\Smab.dll
2005-02-28 11:16 240,128 –sha-r C:\WINDOWS\SYSTEM32\x.264.exe
2004-01-24 22:00 70,656 –sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"Switch Off"="C:\Program\Switch Off\swoff.exe" [2006-11-18 08:23 19456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 11:23 135168]
"SysMetrix"="C:\Program\SysMetrix\SysMetrix.exe" [2006-02-25 21:09 2637824]
"nod32kui"="C:\Program\Eset\nod32kui.exe" [2005-08-12 05:56 917504]
"DiskeeperSystray"="C:\Program\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 16:38 221184]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-10-26 21:10 344064]
"GBMPro8Agent"="C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe" [2007-08-18 13:19 208896]
"Acrobat Assistant 7.0"="C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
"Picasa Media Detector"="C:\Program\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]
C:\Documents and Settings\Peter\Start-meny\Program\Autostart\
GreatNews.lnk - C:\Program\GreatNews\GreatNews.exe [2007-07-13 20:00:24]
Last.fm Helper.lnk - C:\Program\Last.fm\LastFMHelper.exe [2007-10-25 16:58:13]
MailWasherPro.lnk - C:\Program\FireTrust\MailWasher Pro\MailWasher.exe [2005-07-26 15:48:45]
Miranda IM.lnk - C:\Program\Miranda IM\miranda32.exe [2007-03-13 16:25:30]
No-IP DUC.lnk - C:\Program\No-IP\DUC20.exe [2005-05-06 00:18:42]
On a clearday wo frame.lnk - C:\Program\Stardock\DesktopX\Widgets\On a clearday wo frame.exe [2005-08-14 20:44:46]
QNPlus.lnk - C:\Program\Conceptworld\QNPlus\QNPlus.exe [2005-10-21 15:25:35]
Rainlendar.lnk - C:\Program\Rainlendar\Rainlendar.exe [2005-05-06 00:30:20]
Stardock ObjectDock.lnk - C:\Program\Stardock\ObjectDock\ObjectDock.exe [2005-05-06 15:20:27]
utorrent.lnk - C:\Program\uTorrent\utorrent.exe [2007-02-15 21:17:12]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1044-F000-7760-000000000002}\SC_Acrobat.exe [2006-07-10 13:04:37]
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
HOTSYNCSHORTCUTNAME.lnk - C:\Program\palmOne\HOTSYNC.EXE [2004-06-09 14:27:34]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"= NTSpool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
C:\Program\DELADE~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\Program\DELADE~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program\Stardock\OBJECT~2\WINDOW~1\wbsrv.dll 2005-12-06 20:16 176128 C:\Program\Stardock\OBJECT~2\WINDOW~1\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Acrobat Speed Launcher.lnk]
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^DataViz Inc Messenger.lnk]
backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start-meny^Program^Autostart^AutoStart IR.lnk]
backup=C:\WINDOWS\pss\AutoStart IR.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start-meny^Program^Autostart^Stardock ObjectDock.lnk]
path=C:\Documents and Settings\Peter\Start-meny\Program\Autostart\Stardock ObjectDock.lnk
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
–a—— 2006-01-12 20:52 483328 C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
–a—— 2003-06-18 01:00 45056 C:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2004-03-11 09:50 28672 C:\WINDOWS\SYSTEM32\CTHELPER.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
–a—— 2004-08-22 16:05 81920 C:\Program\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
–a—— 2005-01-27 01:02 86016 C:\Program\Dell\Media Experience\DMXLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
–a—— 2003-09-03 20:12 221184 C:\Program\Intel\Modem Event Monitor\IntelMEM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPlusAgent]
–a—— 2005-06-07 09:20 225280 C:\Program\iriver\iriver plus\iAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QNPlus]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2005-12-07 21:57 30208 C:\Program\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RepliGo Assistant]
–a—— 2005-11-07 20:41 172032 C:\Program\Cerience\RepliGo\RepliGoMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-04-13 02:48 36975 C:\Program\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TvOnTimeDaemon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
——— 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"GBMPro8Agent"=C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=C:\Program\Java\jre1.5.0_06\bin\jusched.exe
"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Elements 4.0\apdproxy.exe"
"Acrobat Assistant 7.0"="C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
"FinePrint Dispatcher v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"CTSysVol"=C:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
"UserFaultCheck"=%systemroot%\system32\dumprep 0 -u
"LanguageShortcut"=C:\Program\CyberLink\PowerDVD\Language\Language.exe
"RemoteControl"=C:\Program\CyberLink\PowerDVD\PDVDServ.exe
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"pdfFactory Pro Dispatcher v2"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" /source=HKLM
R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2005-07-04 11:58]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2006-02-23 17:17]
R2 gearsec;gearsec;C:\WINDOWS\system32\gearsec.exe [2003-12-02 07:49]
R2 PSTRIP;PSTRIP;C:\WINDOWS\system32\drivers\PSTRIP.sys [2001-07-24 00:31]
R2 Serv-U;Serv-U FTP Server;C:\Program\Serv-U\ServUDaemon.exe [2002-02-03 12:37]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 12:00]
R3 iComp;Hauppauge WinTV PVR2 USB2 Encoder;C:\WINDOWS\system32\DRIVERS\HCWUSB2.sys [2006-01-23 15:46]
R3 stusb2ir;USB 2.0 IrDA Bridge;C:\WINDOWS\system32\DRIVERS\stusb2ir.sys [2006-09-22 10:09]
S3 PolarUSB;Polar USB Interface;C:\WINDOWS\system32\DRIVERS\PolarUSB.sys [2001-07-12 14:49]
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\H10USB.sys [2004-06-24 05:52]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2007-12-28 12:25]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf465135-6d09-11dc-a22c-001111bff3cb}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:02:06 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program\TuneUp Utilities 2008\OneClick.exe
"2008-01-08 03:00:56 C:\WINDOWS\Tasks\GBM - Mina dokument-Full.job"
- C:\Program\Genie-Soft\GBMPro8\GBM8.exe
"2008-01-08 04:02:49 C:\WINDOWS\Tasks\GBM - Mina program-Full.job"
- C:\Program\Genie-Soft\GBMPro8\GBM8.exe
"2008-01-08 12:27:25 C:\WINDOWS\Tasks\User_Feed_Synchronization-{29498F0B-EF41-47A4-987E-3F9540466333}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-08 16:57:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-08 16:57:55
ComboFix-quarantined-files.txt 2008-01-08 15:57:53
.
2007-12-12 05:03:43 — E O F —
AND THE CCleaner Uninstall List (install.txt)
µTorrent
2007 Microsoft Office Suite Service Pack 1 (SP1)
Ad-Aware SE Personal
Adobe Acrobat 7.0 Professional - Norsk, Suomi, Svenska
Adobe Acrobat 7.0.9 Professional - Norsk, Suomi, Svenska
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Help Center 2.0
Adobe Photoshop Elements 4.0
Adobe Reader 7.0.9 - Svenska
Adobe SVG Viewer 3.0
Advanced Archive Password Recovery (remove only)
Advanced JPEG Compressor 4.5
Agendus for Windows Palm Desktop Edition
AM-DeadLink 2.8.1
AnyDVD
ATI Control Panel
ATI Display Driver
Audio Tag Editor
AvantGo Client
Avira AntiVir PersonalEdition Classic
AviSynth 2.5
Azureus
Backpacker 3
BitComet 0.60
Broadcom Advanced Control Suite 2
Camtasia Studio 4
CCleaner (remove only)
CDex extraction audio
ClearType Tuning Control Panel Applet
Creative MediaSource
CursorXP
DAEMON Tools
DC++ 0.689
Dell Driver Reset Tool
Dell Media Experience
Dell System Restore
Detailed Song Info Panel 1.21
DirectVobSub (remove only)
Diskeeper Professional Premier Edition
Documents To Go
DVD Decrypter (Remove Only)
DVD Shrink 3.2
EasyH10
EverNote
EverNote Universal Clipper [removed]
FairUse Wizard 2
FastMount
FastStone Image Viewer 2.22
FastStone Photo Resizer 2.4
FinePrint
FireTune
Flickr Uploadr 2.3
floAt's Mobile Agent 2
Foxit Reader
fulDC
Genie Backup Manager Pro 8.0
GNU Aspell 0.50-3
Google Earth Pro
Gordian Knot Rip Pack 0.28.8
GreatNews 1.0 (Build 383)
Hauppauge English Help Files and Resources
Hauppauge WinTV Infrared Remote
Hauppauge WinTV Radio
Hauppauge WinTV Scheduler
Hauppauge WinTV Upgrade Beta 6.0.25113
Hauppauge WinTV2000
Hauppauge WinTV-PVR2 USB2 Drivers
HijackThis 2.0.2
hkSFV (remove only)
HmmXP 3 Theme Pack
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
IconPackager
Intel Application Accelerator
Intel® 537EP V9x DF PCI Modem
InterVideo FilterSDK for Hauppauge
Ipswitch WS_FTP Pro
iriver Music Manager
iriver plus (remove only)
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
JAlbum
JAlbum 7.2
Java 2 Runtime Environment, SE v1.4.2_03
Joost ™ Beta 1.0
Language pack for Ad-Aware SE
Last.fm 1.4.2.58376
LiveReg (Symantec Corporation)
M3 Movies Music Mobile
Macro Express 3
Macromedia Dreamweaver MX
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Shockwave Player
Magic MP3 Tagger 2.2.4b
MailWasher Pro
MediaMonkey 2.5
MediaMonkey Script - Backup 3.5
MediaMonkey Script - BatchArtFinder 1.7
MediaMonkey Script - BrowseByArt 4.7
MediaMonkey Script - Clear Now Playing 2.0
MediaMonkey Script - MonkeyRok 1.0
MediaMonkey Script - Previewer 2.2
MediaMonkey Script: MiniLyrics Embedder v1.2
MediaMonkey Script: PrettyPictures v0.421
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Swedish Language Pack
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (Swedish) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Swedish) 2007
Microsoft Office FrontPage 2003
Microsoft Office Groove MUI (Swedish) 2007
Microsoft Office InfoPath MUI (Swedish) 2007
Microsoft Office OneNote MUI (Swedish) 2007
Microsoft Office Outlook MUI (Swedish) 2007
Microsoft Office PowerPoint MUI (Swedish) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (Finnish) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Swedish) 2007
Microsoft Office Proofing (Swedish) 2007
Microsoft Office Publisher MUI (Swedish) 2007
Microsoft Office Shared MUI (Swedish) 2007
Microsoft Office Word MUI (Swedish) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Software Update for Web Folders (Swedish) 12
Microsoft Speech SDK 5.1
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
Microsoft XML Parser
Microsoft-tillägget Spara som PDF för Microsoft Office 2007-program
Minilyrics(remove only)
Miranda IM 0.6.8
Miro
MixMeister Fusion Demo
MixMeister Pro 6
Modem Event Monitor
Modem Helper
Modem On Hold
Movavi Video Converter 5
Movavi VideoSuite 4.4
Movie Splitter
Mozilla Firefox (2.0.0.11)
Mp3 Tag Tools v1.2
Mp3tag v2.39
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MyPhoneExplorer
nanoPEG-Editor 2.2 Hauppauge Edition
Nero 7 Premium
NOD32 antivirus system
Norton AntiSpam
Norton Internet Security
ObjectDock Plus
Opera 9.24
Orb
Palm Desktop
PalmSource Package Installer 1.5
PartitionMagic
pdfFactory Pro
PeerGuardian 2.0
Personal 4.2.5
Picasa 2
PocketMirror (Standard Edition) 4.3.0
Polar Precision Performance SW 3.0
Polar ProTrainer
Power MP3 Cutter Joiner 1.11
PowerDVD
PowerDVD Copy 1.0
PowerQuest PartitionMagic 8.0
PowerStrip 3 (remove only)
Prism 0.8
Quick News Conduit
Quick Notes Plus 5.0
QuickTime Alternative 1.50
Real Alternative 1.41
Recorder
Registry Mechanic 5.2
RepliGo Desktop (remove only)
RepliGo Viewer (remove only)
RightClick
Security Update for CAPICOM (KB931906)
Security Update för Microsoft .NET Framework 2.0 (kB928365)
SmartFTP Client
SmartFTP Client 2.5 Setup Files (remove only)
SmartFTP Client Swedish Language Addon (remove only)
Snabbkorrigering för Windows Media Player 11 (KB939683)
Snabbkorrigering för Windows XP (KB914440)
SnagIt 8
SoulSeek Client 156c
Sound Blaster Audigy 2 ZS
SplashID
SplashPhoto
SUPER © Version 2006.19 (FIX)
Switch Off
SysMetrix 3.41
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB928090)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB931768)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB933566)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB937143)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB938127)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB939653)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB942615)
Säkerhetsuppdatering för Windows Media Player 11 (KB936782)
Säkerhetsuppdatering för Windows Media Player 6.4 (KB925398)
Säkerhetsuppdatering för Windows XP (KB911280)
Säkerhetsuppdatering för Windows XP (KB913580)
Säkerhetsuppdatering för Windows XP (KB914388)
Säkerhetsuppdatering för Windows XP (KB914389)
Säkerhetsuppdatering för Windows XP (KB917159)
Säkerhetsuppdatering för Windows XP (KB917422)
Säkerhetsuppdatering för Windows XP (KB917953)
Säkerhetsuppdatering för Windows XP (KB918118)
Säkerhetsuppdatering för Windows XP (KB918439)
Säkerhetsuppdatering för Windows XP (KB919007)
Säkerhetsuppdatering för Windows XP (KB920213)
Säkerhetsuppdatering för Windows XP (KB920214)
Säkerhetsuppdatering för Windows XP (KB920670)
Säkerhetsuppdatering för Windows XP (KB920683)
Säkerhetsuppdatering för Windows XP (KB920685)
Säkerhetsuppdatering för Windows XP (KB921398)
Säkerhetsuppdatering för Windows XP (KB921503)
Säkerhetsuppdatering för Windows XP (KB921883)
Säkerhetsuppdatering för Windows XP (KB922616)
Säkerhetsuppdatering för Windows XP (KB922819)
Säkerhetsuppdatering för Windows XP (KB923191)
Säkerhetsuppdatering för Windows XP (KB923414)
Säkerhetsuppdatering för Windows XP (KB923689)
Säkerhetsuppdatering för Windows XP (KB923694)
Säkerhetsuppdatering för Windows XP (KB923980)
Säkerhetsuppdatering för Windows XP (KB924191)
Säkerhetsuppdatering för Windows XP (KB924270)
Säkerhetsuppdatering för Windows XP (KB924667)
Säkerhetsuppdatering för Windows XP (KB925902)
Säkerhetsuppdatering för Windows XP (KB926255)
Säkerhetsuppdatering för Windows XP (KB926436)
Säkerhetsuppdatering för Windows XP (KB927779)
Säkerhetsuppdatering för Windows XP (KB927802)
Säkerhetsuppdatering för Windows XP (KB928255)
Säkerhetsuppdatering för Windows XP (KB928843)
Säkerhetsuppdatering för Windows XP (KB929123)
Säkerhetsuppdatering för Windows XP (KB930178)
Säkerhetsuppdatering för Windows XP (KB931261)
Säkerhetsuppdatering för Windows XP (KB931784)
Säkerhetsuppdatering för Windows XP (KB932168)
Säkerhetsuppdatering för Windows XP (KB933729)
Säkerhetsuppdatering för Windows XP (KB935839)
Säkerhetsuppdatering för Windows XP (KB935840)
Säkerhetsuppdatering för Windows XP (KB936021)
Säkerhetsuppdatering för Windows XP (KB937894)
Säkerhetsuppdatering för Windows XP (KB938829)
Säkerhetsuppdatering för Windows XP (KB941202)
Säkerhetsuppdatering för Windows XP (KB941568)
Säkerhetsuppdatering för Windows XP (KB941569)
Säkerhetsuppdatering för Windows XP (KB943460)
Säkerhetsuppdatering för Windows XP (KB944653)
Torrent Episode Downloader
TuneUp Utilities 2006
TuneUp Utilities 2007
TuneUp Utilities 2008
Tweak UI
Ulead DVD MovieFactory 5
Unlocker 1.8.5
Update for Outlook 2007 Junk Email Filter (kb943597)
Uppdatering för Windows XP (KB904942)
Uppdatering för Windows XP (KB916595)
Uppdatering för Windows XP (KB920872)
Uppdatering för Windows XP (KB922582)
Uppdatering för Windows XP (KB927891)
Uppdatering för Windows XP (KB929338)
Uppdatering för Windows XP (KB930916)
Uppdatering för Windows XP (KB931836)
Uppdatering för Windows XP (KB933360)
Uppdatering för Windows XP (KB936357)
Uppdatering för Windows XP (KB938828)
Uppdatering för Windows XP (KB942763)
Web Sources Tagger for MediaMonkey (some alpha version)
WebFldrs XP
Winamp (remove only)
WindowBlinds
Windows Defender Signatures
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
VobSub v2.23 (Remove Only)
XP Codec Pack
xp-AntiSpy 3.95
XviD MPEG-4 Video Codec
AND a new HijackThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:51, on 2008-01-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\DELADE~1\Stardock\SDMCP.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program\SysMetrix\SysMetrix.exe
C:\Program\Eset\nod32kui.exe
C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Switch Off\swoff.exe
C:\Program\palmOne\HOTSYNC.EXE
C:\Program\GreatNews\GreatNews.exe
C:\Program\Last.fm\LastFMHelper.exe
C:\Program\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program\Miranda IM\miranda32.exe
C:\Program\No-IP\DUC20.exe
C:\Program\Conceptworld\QNPlus\QNPlus.exe
C:\Program\Rainlendar\Rainlendar.exe
C:\Program\Stardock\ObjectDock\ObjectDock.exe
C:\Program\uTorrent\utorrent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\DOCUME~1\Peter\LOKALA~1\Temp\{DA7659BB-F46E-48B2-AD95-2DDCD2F7DFA1}\On a clearday wo frame.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Eset\nod32krn.exe
C:\Program\CyberLink\Shared Files\RichVideo.exe
C:\Program\Serv-U\ServUDaemon.exe
C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program\Winamp\winamp.exe
C:\Program\Last.fm\LastFM.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
F:\Recent Download\ANTIVIRUS\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com/?personalized=true
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SysMetrix] C:\Program\SysMetrix\SysMetrix.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GBMPro8Agent] C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Switch Off] C:\Program\Switch Off\swoff.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GreatNews.lnk = C:\Program\GreatNews\GreatNews.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program\Last.fm\LastFMHelper.exe
O4 - Startup: MailWasherPro.lnk = C:\Program\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Miranda IM.lnk = C:\Program\Miranda IM\miranda32.exe
O4 - Startup: No-IP DUC.lnk = C:\Program\No-IP\DUC20.exe
O4 - Startup: On a clearday wo frame.lnk = C:\Program\Stardock\DesktopX\Widgets\On a clearday wo frame.exe
O4 - Startup: QNPlus.lnk = C:\Program\Conceptworld\QNPlus\QNPlus.exe
O4 - Startup: Rainlendar.lnk = C:\Program\Rainlendar\Rainlendar.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: utorrent.lnk = C:\Program\uTorrent\utorrent.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: Add to EverNote - res://C:\Program\EverNote\EverNote\enbar.dll/2000
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Konvertera länkmål till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera länkmål till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera markering till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera markering till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera valda länkar till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Konvertera valda länkar till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program\EverNote\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program\EverNote\EverNote\enbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://spray.king.com/ctl/kingcomie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1123438278983
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: GB-PVR Recording Service - Unknown owner - C:\Program\devnz\gbpvr\GBPVRRecordingService.exe (file missing)
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Serv-U FTP Server (Serv-U) - Unknown owner - C:\Program\Serv-U\ServUDaemon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe
–
End of file - 11431 bytes
I too have been slammed by the Trojan dropper agent and are now seeking help to remove the little bastard from my computer.
All help are highly appreciated!
I have read a previous post about removal instructions regarding the above virus and have taken the first four steps in Simon.V guidelines.
http://forums.whatthetech.com/Win32_Trojan…ml&p=427286
…here are the logfiles for you to read.
COMBOFIX.TXT
ComboFix 08-01-07.5 - Peter 2008-01-08 16:53:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1053.18.1325 [GMT 1:00]
Running from: F:\Recent Download\ANTIVIRUS\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\mljhebc.dll
C:\WINDOWS\SYSTEM32\nqtwa.ini2
C:\WINDOWS\SYSTEM32\wvvwa.ini2
.
((((((((((((((((((((((((( Files Created from 2007-12-08 to 2008-01-08 )))))))))))))))))))))))))))))))
.
2008-01-08 16:53 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-08 16:49 . 2008-01-08 16:49 d——– C:\Program\CCleaner
2008-01-07 22:31 . 2008-01-07 22:31 37,888 –a—— C:\WINDOWS\SYSTEM32\cbxyabc.dll
2008-01-05 00:54 . 2008-01-05 00:54 d——– C:\Program\Alcohol Soft
2008-01-05 00:51 . 2008-01-05 00:51 685,816 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys
2008-01-01 21:51 . 2008-01-01 21:51 d——– C:\Program\FireTune
2008-01-01 21:51 . 2008-01-01 21:51 737,280 –a—— C:\WINDOWS\iun6002.exe
2007-12-30 21:07 . 2008-01-08 06:11 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-30 21:07 . 2008-01-01 22:36 725,144 –a—— C:\WINDOWS\happy_new_year_pics2008.zip
2007-12-29 16:12 . 2008-01-07 07:42 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-29 16:12 . 2007-12-29 16:12 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-28 12:25 . 2007-12-28 12:25 306,432 –a—— C:\WINDOWS\SYSTEM32\TuneUpDefragService.exe
2007-12-28 12:24 . 2007-12-28 12:26 d——– C:\Program\TuneUp Utilities 2008
2007-12-15 09:27 . 2007-12-15 09:27 d——– C:\Documents and Settings\Peter\Lokala inställningar
2007-12-15 01:51 . 2007-12-15 01:52 d——– C:\Program\SmartFTP Client
2007-12-15 01:50 . 2007-12-15 01:50 d——– C:\Program\SmartFTP Client 2.5 Setup Files
2007-12-14 23:07 . 2007-12-14 23:07 d——– C:\Documents and Settings\Peter\Application Data\Prism
2007-12-14 23:06 . 2007-12-16 13:26 d——– C:\Program\Prism
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-08 15:51 ——— d—–w C:\Documents and Settings\Peter\Application Data\uTorrent
2008-01-08 15:49 ——— d—–w C:\Program\GreatNews
2008-01-08 05:11 ——— d—–w C:\Program\SysMetrix
2008-01-08 05:11 ——— d—–w C:\Program\Serv-U
2008-01-08 05:11 ——— d—–w C:\Documents and Settings\Peter\Application Data\MailWasherPro
2008-01-07 21:36 ——— d—–w C:\Program\Switch Off
2008-01-04 23:16 ——— d—–w C:\Program\DC++
2008-01-03 20:43 ——— d—–w C:\Program\Last.fm
2008-01-01 21:36 ——— d—–w C:\Documents and Settings\Peter\Application Data\AdobeUM
2007-12-30 17:13 724,992 —-a-w C:\WINDOWS\SYSTEM32\NTSpool.exe
2007-12-30 10:45 ——— d—–w C:\Program\Minilyrics
2007-12-28 22:26 ——— d—–w C:\Program\MSECache
2007-12-28 11:29 ——— d—–w C:\Program\TuneUp Utilities 2007
2007-12-28 11:24 ——— d—–w C:\Program\Delade filer\Wise Installation Wizard
2007-12-20 09:41 29,440 —-a-w C:\WINDOWS\SYSTEM32\uxtuneup.dll
2007-12-12 15:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-05 16:34 ——— d—–w C:\Documents and Settings\Peter\Application Data\PCF-VLC
2007-11-30 16:11 ——— d—–w C:\Program\Joost
2007-11-29 16:39 ——— d—–w C:\Documents and Settings\Peter\Application Data\Joost
2007-11-28 15:49 ——— d–h–w C:\Program\InstallShield Installation Information
2007-11-28 15:49 ——— d—–w C:\Program\Google
2007-11-20 21:42 ——— d—–w C:\Program\Chapura
2007-11-20 16:06 ——— d—–w C:\Program\ALEGA
2007-11-13 17:19 ——— d—–w C:\Program\palmOne
2007-11-13 16:30 ——— d—–w C:\Program\Palm
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 00:27 ——— d—–w C:\Documents and Settings\Peter\Application Data\HotSync
2007-11-10 23:45 ——— d—–w C:\Program\Chapura(2)
2007-10-30 23:27 3,590,656 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:45 1,289,728 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:45 1,289,728 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-25 16:44 8,467,968 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-25 08:28 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-25 08:28 222,720 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-10 23:53 824,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-10-10 23:53 671,232 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-10-10 23:53 63,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-10-10 23:53 6,065,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-10-10 23:53 52,224 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-10-10 23:53 478,208 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-10-10 23:53 459,264 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-10-10 23:53 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-10-10 23:53 384,512 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-10-10 23:53 383,488 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-10-10 23:53 27,648 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-10-10 23:53 267,776 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-10-10 23:53 232,960 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-10-10 23:53 230,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-10-10 23:53 214,528 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-10-10 23:53 193,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-10-10 23:53 153,088 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-10-10 23:53 132,608 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-10-10 23:53 124,928 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-10-10 23:53 105,984 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-10-10 23:53 102,400 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-10-10 23:53 1,159,680 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-10-10 11:04 70,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-10-10 11:04 625,152 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2005-05-13 15:12 217,073 –sha-r C:\WINDOWS\meta4.exe
2005-10-24 09:13 66,560 –sha-r C:\WINDOWS\MOTA113.exe
2005-10-13 19:27 422,400 –sha-r C:\WINDOWS\x2.64.exe
2006-06-25 10:12 295,424 –sha-w C:\WINDOWS\SYSTEM32\avisynth.dll
2005-07-14 10:31 27,648 –sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll
2005-06-26 13:32 616,448 –sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll
2005-06-21 20:37 45,568 –sha-r C:\WINDOWS\SYSTEM32\cygz.dll
2004-01-24 22:00 70,656 –sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll
2006-04-27 08:24 2,945,024 –sha-r C:\WINDOWS\SYSTEM32\Smab.dll
2005-02-28 11:16 240,128 –sha-r C:\WINDOWS\SYSTEM32\x.264.exe
2004-01-24 22:00 70,656 –sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"Switch Off"="C:\Program\Switch Off\swoff.exe" [2006-11-18 08:23 19456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 11:23 135168]
"SysMetrix"="C:\Program\SysMetrix\SysMetrix.exe" [2006-02-25 21:09 2637824]
"nod32kui"="C:\Program\Eset\nod32kui.exe" [2005-08-12 05:56 917504]
"DiskeeperSystray"="C:\Program\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 16:38 221184]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-10-26 21:10 344064]
"GBMPro8Agent"="C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe" [2007-08-18 13:19 208896]
"Acrobat Assistant 7.0"="C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
"Picasa Media Detector"="C:\Program\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]
C:\Documents and Settings\Peter\Start-meny\Program\Autostart\
GreatNews.lnk - C:\Program\GreatNews\GreatNews.exe [2007-07-13 20:00:24]
Last.fm Helper.lnk - C:\Program\Last.fm\LastFMHelper.exe [2007-10-25 16:58:13]
MailWasherPro.lnk - C:\Program\FireTrust\MailWasher Pro\MailWasher.exe [2005-07-26 15:48:45]
Miranda IM.lnk - C:\Program\Miranda IM\miranda32.exe [2007-03-13 16:25:30]
No-IP DUC.lnk - C:\Program\No-IP\DUC20.exe [2005-05-06 00:18:42]
On a clearday wo frame.lnk - C:\Program\Stardock\DesktopX\Widgets\On a clearday wo frame.exe [2005-08-14 20:44:46]
QNPlus.lnk - C:\Program\Conceptworld\QNPlus\QNPlus.exe [2005-10-21 15:25:35]
Rainlendar.lnk - C:\Program\Rainlendar\Rainlendar.exe [2005-05-06 00:30:20]
Stardock ObjectDock.lnk - C:\Program\Stardock\ObjectDock\ObjectDock.exe [2005-05-06 15:20:27]
utorrent.lnk - C:\Program\uTorrent\utorrent.exe [2007-02-15 21:17:12]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1044-F000-7760-000000000002}\SC_Acrobat.exe [2006-07-10 13:04:37]
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
HOTSYNCSHORTCUTNAME.lnk - C:\Program\palmOne\HOTSYNC.EXE [2004-06-09 14:27:34]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"= NTSpool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
C:\Program\DELADE~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\Program\DELADE~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program\Stardock\OBJECT~2\WINDOW~1\wbsrv.dll 2005-12-06 20:16 176128 C:\Program\Stardock\OBJECT~2\WINDOW~1\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Acrobat Speed Launcher.lnk]
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^DataViz Inc Messenger.lnk]
backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start-meny^Program^Autostart^AutoStart IR.lnk]
backup=C:\WINDOWS\pss\AutoStart IR.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start-meny^Program^Autostart^Stardock ObjectDock.lnk]
path=C:\Documents and Settings\Peter\Start-meny\Program\Autostart\Stardock ObjectDock.lnk
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
–a—— 2006-01-12 20:52 483328 C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
–a—— 2003-06-18 01:00 45056 C:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2004-03-11 09:50 28672 C:\WINDOWS\SYSTEM32\CTHELPER.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
–a—— 2004-08-22 16:05 81920 C:\Program\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
–a—— 2005-01-27 01:02 86016 C:\Program\Dell\Media Experience\DMXLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
–a—— 2003-09-03 20:12 221184 C:\Program\Intel\Modem Event Monitor\IntelMEM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPlusAgent]
–a—— 2005-06-07 09:20 225280 C:\Program\iriver\iriver plus\iAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QNPlus]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2005-12-07 21:57 30208 C:\Program\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RepliGo Assistant]
–a—— 2005-11-07 20:41 172032 C:\Program\Cerience\RepliGo\RepliGoMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-04-13 02:48 36975 C:\Program\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TvOnTimeDaemon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
——— 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"GBMPro8Agent"=C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=C:\Program\Java\jre1.5.0_06\bin\jusched.exe
"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Elements 4.0\apdproxy.exe"
"Acrobat Assistant 7.0"="C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
"FinePrint Dispatcher v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"CTSysVol"=C:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
"UserFaultCheck"=%systemroot%\system32\dumprep 0 -u
"LanguageShortcut"=C:\Program\CyberLink\PowerDVD\Language\Language.exe
"RemoteControl"=C:\Program\CyberLink\PowerDVD\PDVDServ.exe
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"pdfFactory Pro Dispatcher v2"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" /source=HKLM
R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2005-07-04 11:58]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2006-02-23 17:17]
R2 gearsec;gearsec;C:\WINDOWS\system32\gearsec.exe [2003-12-02 07:49]
R2 PSTRIP;PSTRIP;C:\WINDOWS\system32\drivers\PSTRIP.sys [2001-07-24 00:31]
R2 Serv-U;Serv-U FTP Server;C:\Program\Serv-U\ServUDaemon.exe [2002-02-03 12:37]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 12:00]
R3 iComp;Hauppauge WinTV PVR2 USB2 Encoder;C:\WINDOWS\system32\DRIVERS\HCWUSB2.sys [2006-01-23 15:46]
R3 stusb2ir;USB 2.0 IrDA Bridge;C:\WINDOWS\system32\DRIVERS\stusb2ir.sys [2006-09-22 10:09]
S3 PolarUSB;Polar USB Interface;C:\WINDOWS\system32\DRIVERS\PolarUSB.sys [2001-07-12 14:49]
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\H10USB.sys [2004-06-24 05:52]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2007-12-28 12:25]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf465135-6d09-11dc-a22c-001111bff3cb}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 04:02:06 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program\TuneUp Utilities 2008\OneClick.exe
"2008-01-08 03:00:56 C:\WINDOWS\Tasks\GBM - Mina dokument-Full.job"
- C:\Program\Genie-Soft\GBMPro8\GBM8.exe
"2008-01-08 04:02:49 C:\WINDOWS\Tasks\GBM - Mina program-Full.job"
- C:\Program\Genie-Soft\GBMPro8\GBM8.exe
"2008-01-08 12:27:25 C:\WINDOWS\Tasks\User_Feed_Synchronization-{29498F0B-EF41-47A4-987E-3F9540466333}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-08 16:57:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-08 16:57:55
ComboFix-quarantined-files.txt 2008-01-08 15:57:53
.
2007-12-12 05:03:43 — E O F —
AND THE CCleaner Uninstall List (install.txt)
µTorrent
2007 Microsoft Office Suite Service Pack 1 (SP1)
Ad-Aware SE Personal
Adobe Acrobat 7.0 Professional - Norsk, Suomi, Svenska
Adobe Acrobat 7.0.9 Professional - Norsk, Suomi, Svenska
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Help Center 2.0
Adobe Photoshop Elements 4.0
Adobe Reader 7.0.9 - Svenska
Adobe SVG Viewer 3.0
Advanced Archive Password Recovery (remove only)
Advanced JPEG Compressor 4.5
Agendus for Windows Palm Desktop Edition
AM-DeadLink 2.8.1
AnyDVD
ATI Control Panel
ATI Display Driver
Audio Tag Editor
AvantGo Client
Avira AntiVir PersonalEdition Classic
AviSynth 2.5
Azureus
Backpacker 3
BitComet 0.60
Broadcom Advanced Control Suite 2
Camtasia Studio 4
CCleaner (remove only)
CDex extraction audio
ClearType Tuning Control Panel Applet
Creative MediaSource
CursorXP
DAEMON Tools
DC++ 0.689
Dell Driver Reset Tool
Dell Media Experience
Dell System Restore
Detailed Song Info Panel 1.21
DirectVobSub (remove only)
Diskeeper Professional Premier Edition
Documents To Go
DVD Decrypter (Remove Only)
DVD Shrink 3.2
EasyH10
EverNote
EverNote Universal Clipper [removed]
FairUse Wizard 2
FastMount
FastStone Image Viewer 2.22
FastStone Photo Resizer 2.4
FinePrint
FireTune
Flickr Uploadr 2.3
floAt's Mobile Agent 2
Foxit Reader
fulDC
Genie Backup Manager Pro 8.0
GNU Aspell 0.50-3
Google Earth Pro
Gordian Knot Rip Pack 0.28.8
GreatNews 1.0 (Build 383)
Hauppauge English Help Files and Resources
Hauppauge WinTV Infrared Remote
Hauppauge WinTV Radio
Hauppauge WinTV Scheduler
Hauppauge WinTV Upgrade Beta 6.0.25113
Hauppauge WinTV2000
Hauppauge WinTV-PVR2 USB2 Drivers
HijackThis 2.0.2
hkSFV (remove only)
HmmXP 3 Theme Pack
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
IconPackager
Intel Application Accelerator
Intel® 537EP V9x DF PCI Modem
InterVideo FilterSDK for Hauppauge
Ipswitch WS_FTP Pro
iriver Music Manager
iriver plus (remove only)
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
JAlbum
JAlbum 7.2
Java 2 Runtime Environment, SE v1.4.2_03
Joost ™ Beta 1.0
Language pack for Ad-Aware SE
Last.fm 1.4.2.58376
LiveReg (Symantec Corporation)
M3 Movies Music Mobile
Macro Express 3
Macromedia Dreamweaver MX
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Shockwave Player
Magic MP3 Tagger 2.2.4b
MailWasher Pro
MediaMonkey 2.5
MediaMonkey Script - Backup 3.5
MediaMonkey Script - BatchArtFinder 1.7
MediaMonkey Script - BrowseByArt 4.7
MediaMonkey Script - Clear Now Playing 2.0
MediaMonkey Script - MonkeyRok 1.0
MediaMonkey Script - Previewer 2.2
MediaMonkey Script: MiniLyrics Embedder v1.2
MediaMonkey Script: PrettyPictures v0.421
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Swedish Language Pack
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (Swedish) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Swedish) 2007
Microsoft Office FrontPage 2003
Microsoft Office Groove MUI (Swedish) 2007
Microsoft Office InfoPath MUI (Swedish) 2007
Microsoft Office OneNote MUI (Swedish) 2007
Microsoft Office Outlook MUI (Swedish) 2007
Microsoft Office PowerPoint MUI (Swedish) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (Finnish) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Swedish) 2007
Microsoft Office Proofing (Swedish) 2007
Microsoft Office Publisher MUI (Swedish) 2007
Microsoft Office Shared MUI (Swedish) 2007
Microsoft Office Word MUI (Swedish) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Software Update for Web Folders (Swedish) 12
Microsoft Speech SDK 5.1
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
Microsoft XML Parser
Microsoft-tillägget Spara som PDF för Microsoft Office 2007-program
Minilyrics(remove only)
Miranda IM 0.6.8
Miro
MixMeister Fusion Demo
MixMeister Pro 6
Modem Event Monitor
Modem Helper
Modem On Hold
Movavi Video Converter 5
Movavi VideoSuite 4.4
Movie Splitter
Mozilla Firefox (2.0.0.11)
Mp3 Tag Tools v1.2
Mp3tag v2.39
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MyPhoneExplorer
nanoPEG-Editor 2.2 Hauppauge Edition
Nero 7 Premium
NOD32 antivirus system
Norton AntiSpam
Norton Internet Security
ObjectDock Plus
Opera 9.24
Orb
Palm Desktop
PalmSource Package Installer 1.5
PartitionMagic
pdfFactory Pro
PeerGuardian 2.0
Personal 4.2.5
Picasa 2
PocketMirror (Standard Edition) 4.3.0
Polar Precision Performance SW 3.0
Polar ProTrainer
Power MP3 Cutter Joiner 1.11
PowerDVD
PowerDVD Copy 1.0
PowerQuest PartitionMagic 8.0
PowerStrip 3 (remove only)
Prism 0.8
Quick News Conduit
Quick Notes Plus 5.0
QuickTime Alternative 1.50
Real Alternative 1.41
Recorder
Registry Mechanic 5.2
RepliGo Desktop (remove only)
RepliGo Viewer (remove only)
RightClick
Security Update for CAPICOM (KB931906)
Security Update för Microsoft .NET Framework 2.0 (kB928365)
SmartFTP Client
SmartFTP Client 2.5 Setup Files (remove only)
SmartFTP Client Swedish Language Addon (remove only)
Snabbkorrigering för Windows Media Player 11 (KB939683)
Snabbkorrigering för Windows XP (KB914440)
SnagIt 8
SoulSeek Client 156c
Sound Blaster Audigy 2 ZS
SplashID
SplashPhoto
SUPER © Version 2006.19 (FIX)
Switch Off
SysMetrix 3.41
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB928090)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB931768)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB933566)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB937143)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB938127)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB939653)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB942615)
Säkerhetsuppdatering för Windows Media Player 11 (KB936782)
Säkerhetsuppdatering för Windows Media Player 6.4 (KB925398)
Säkerhetsuppdatering för Windows XP (KB911280)
Säkerhetsuppdatering för Windows XP (KB913580)
Säkerhetsuppdatering för Windows XP (KB914388)
Säkerhetsuppdatering för Windows XP (KB914389)
Säkerhetsuppdatering för Windows XP (KB917159)
Säkerhetsuppdatering för Windows XP (KB917422)
Säkerhetsuppdatering för Windows XP (KB917953)
Säkerhetsuppdatering för Windows XP (KB918118)
Säkerhetsuppdatering för Windows XP (KB918439)
Säkerhetsuppdatering för Windows XP (KB919007)
Säkerhetsuppdatering för Windows XP (KB920213)
Säkerhetsuppdatering för Windows XP (KB920214)
Säkerhetsuppdatering för Windows XP (KB920670)
Säkerhetsuppdatering för Windows XP (KB920683)
Säkerhetsuppdatering för Windows XP (KB920685)
Säkerhetsuppdatering för Windows XP (KB921398)
Säkerhetsuppdatering för Windows XP (KB921503)
Säkerhetsuppdatering för Windows XP (KB921883)
Säkerhetsuppdatering för Windows XP (KB922616)
Säkerhetsuppdatering för Windows XP (KB922819)
Säkerhetsuppdatering för Windows XP (KB923191)
Säkerhetsuppdatering för Windows XP (KB923414)
Säkerhetsuppdatering för Windows XP (KB923689)
Säkerhetsuppdatering för Windows XP (KB923694)
Säkerhetsuppdatering för Windows XP (KB923980)
Säkerhetsuppdatering för Windows XP (KB924191)
Säkerhetsuppdatering för Windows XP (KB924270)
Säkerhetsuppdatering för Windows XP (KB924667)
Säkerhetsuppdatering för Windows XP (KB925902)
Säkerhetsuppdatering för Windows XP (KB926255)
Säkerhetsuppdatering för Windows XP (KB926436)
Säkerhetsuppdatering för Windows XP (KB927779)
Säkerhetsuppdatering för Windows XP (KB927802)
Säkerhetsuppdatering för Windows XP (KB928255)
Säkerhetsuppdatering för Windows XP (KB928843)
Säkerhetsuppdatering för Windows XP (KB929123)
Säkerhetsuppdatering för Windows XP (KB930178)
Säkerhetsuppdatering för Windows XP (KB931261)
Säkerhetsuppdatering för Windows XP (KB931784)
Säkerhetsuppdatering för Windows XP (KB932168)
Säkerhetsuppdatering för Windows XP (KB933729)
Säkerhetsuppdatering för Windows XP (KB935839)
Säkerhetsuppdatering för Windows XP (KB935840)
Säkerhetsuppdatering för Windows XP (KB936021)
Säkerhetsuppdatering för Windows XP (KB937894)
Säkerhetsuppdatering för Windows XP (KB938829)
Säkerhetsuppdatering för Windows XP (KB941202)
Säkerhetsuppdatering för Windows XP (KB941568)
Säkerhetsuppdatering för Windows XP (KB941569)
Säkerhetsuppdatering för Windows XP (KB943460)
Säkerhetsuppdatering för Windows XP (KB944653)
Torrent Episode Downloader
TuneUp Utilities 2006
TuneUp Utilities 2007
TuneUp Utilities 2008
Tweak UI
Ulead DVD MovieFactory 5
Unlocker 1.8.5
Update for Outlook 2007 Junk Email Filter (kb943597)
Uppdatering för Windows XP (KB904942)
Uppdatering för Windows XP (KB916595)
Uppdatering för Windows XP (KB920872)
Uppdatering för Windows XP (KB922582)
Uppdatering för Windows XP (KB927891)
Uppdatering för Windows XP (KB929338)
Uppdatering för Windows XP (KB930916)
Uppdatering för Windows XP (KB931836)
Uppdatering för Windows XP (KB933360)
Uppdatering för Windows XP (KB936357)
Uppdatering för Windows XP (KB938828)
Uppdatering för Windows XP (KB942763)
Web Sources Tagger for MediaMonkey (some alpha version)
WebFldrs XP
Winamp (remove only)
WindowBlinds
Windows Defender Signatures
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
VobSub v2.23 (Remove Only)
XP Codec Pack
xp-AntiSpy 3.95
XviD MPEG-4 Video Codec
AND a new HijackThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:51, on 2008-01-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\DELADE~1\Stardock\SDMCP.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program\SysMetrix\SysMetrix.exe
C:\Program\Eset\nod32kui.exe
C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Switch Off\swoff.exe
C:\Program\palmOne\HOTSYNC.EXE
C:\Program\GreatNews\GreatNews.exe
C:\Program\Last.fm\LastFMHelper.exe
C:\Program\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program\Miranda IM\miranda32.exe
C:\Program\No-IP\DUC20.exe
C:\Program\Conceptworld\QNPlus\QNPlus.exe
C:\Program\Rainlendar\Rainlendar.exe
C:\Program\Stardock\ObjectDock\ObjectDock.exe
C:\Program\uTorrent\utorrent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\DOCUME~1\Peter\LOKALA~1\Temp\{DA7659BB-F46E-48B2-AD95-2DDCD2F7DFA1}\On a clearday wo frame.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Eset\nod32krn.exe
C:\Program\CyberLink\Shared Files\RichVideo.exe
C:\Program\Serv-U\ServUDaemon.exe
C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program\Winamp\winamp.exe
C:\Program\Last.fm\LastFM.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
F:\Recent Download\ANTIVIRUS\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com/?personalized=true
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SysMetrix] C:\Program\SysMetrix\SysMetrix.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [GBMPro8Agent] C:\Program\Genie-Soft\GBMPro8\GBMAgent.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Switch Off] C:\Program\Switch Off\swoff.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GreatNews.lnk = C:\Program\GreatNews\GreatNews.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program\Last.fm\LastFMHelper.exe
O4 - Startup: MailWasherPro.lnk = C:\Program\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Miranda IM.lnk = C:\Program\Miranda IM\miranda32.exe
O4 - Startup: No-IP DUC.lnk = C:\Program\No-IP\DUC20.exe
O4 - Startup: On a clearday wo frame.lnk = C:\Program\Stardock\DesktopX\Widgets\On a clearday wo frame.exe
O4 - Startup: QNPlus.lnk = C:\Program\Conceptworld\QNPlus\QNPlus.exe
O4 - Startup: Rainlendar.lnk = C:\Program\Rainlendar\Rainlendar.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: utorrent.lnk = C:\Program\uTorrent\utorrent.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: Add to EverNote - res://C:\Program\EverNote\EverNote\enbar.dll/2000
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Konvertera länkmål till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera länkmål till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera markering till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera markering till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konvertera till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konvertera valda länkar till Adobe PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Konvertera valda länkar till befintlig PDF - res://C:\Program\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program\EverNote\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program\EverNote\EverNote\enbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://spray.king.com/ctl/kingcomie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1123438278983
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - L:\USB-Program\Anitivirus-program\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: GB-PVR Recording Service - Unknown owner - C:\Program\devnz\gbpvr\GBPVRRecordingService.exe (file missing)
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Serv-U FTP Server (Serv-U) - Unknown owner - C:\Program\Serv-U\ServUDaemon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe
–
End of file - 11431 bytes