Well, lately my internet has been running very slow and sometimes it won't even work and from time to time a window pops up telling me to install some antivirus program to clean the computer but im pretty sure it's a virus, this hasnt happened before. The point is my internet is not working, it will sometimes but most of the time it's too slow to be able to use it. Im guessing this is because of a virus. After this happened i installed Lavasoft Ad-aware and did a scan, found about 80 infected files which was removed. Then i installed COMODO firewall pro and did a scan there, found a few viruses that was removed aswell. And after that i installed Windows defender, which also found some infected files. But my internet is still not working properly. Have i forgot to do something? And one more thing, for some reason i can't install windows updates. At the bottom of the screen theres a red shield with a cross in it and i double click it and it says automatic updates are disabled. When i press "activate automatic updates" i get an error message telling me to enable them manually through the configuration panel but it says its already activated. I heard something about a program called hijackthis. Is that something i need?
Hi felix100 HijackThis is precisely what you need. However, let's do some cleanup first. First, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. After that, please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file. Rename HijackThis(.exe) to scanner(.exe). Next, run scanner(.exe). A window will pop up. • Click on the button which says Main Menu, then Do a system scan and save a logfile. • Please wait for the scan to be completed. • After the scan has completed, a text window will pop up. Please post the contents of this window here. This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved. NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer. Best Regards
Heres the combofix log: ComboFix 08-09-16.03 - Malmberg 2008-09-17 10:57:44.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.1453 [GMT 2:00] Running from: C:\Documents and Settings\Malmberg\Skrivbord\ComboFix.exe * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program\Delade filer\{A8470~1 C:\Program\RichVideoCodec C:\WINDOWS\BMab743e51.txt C:\WINDOWS\BMab743e51.xml C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\afxugkmm.dll C:\WINDOWS\system32\dao350.dll C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\fPXIRXbc.ini C:\WINDOWS\system32\fPXIRXbc.ini2 C:\WINDOWS\system32\fthbhilp.ini C:\WINDOWS\system32\hckvtpan.dll C:\WINDOWS\system32\lolmvflr.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\ofmicogp.dll C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\plihbhtf.dll C:\WINDOWS\system32\qkxjjvwy.ini C:\WINDOWS\system32\qrapbsle.ini C:\WINDOWS\system32\qslyhtuw.ini C:\WINDOWS\system32\tmp34.tmp C:\WINDOWS\system32\uodiec.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_XPROTECTOR -------\Service_NPF -------\Service_XPROTECTOR ((((((((((((((((((((((((( Files Created from 2008-08-17 to 2008-09-17 ))))))))))))))))))))))))))))))) . 2008-09-16 11:31 . 2008-09-16 11:32 <KAT> d-------- C:\Program\Privoxy 2008-09-15 22:33 . 2008-09-15 22:33 <KAT> d-------- C:\Program\Windows Defender 2008-09-15 19:24 . 2008-09-15 19:24 2,367,664 ---hs---- C:\WINDOWS\system32\ppiycfrf.tmp 2008-09-15 19:01 . 2008-09-15 19:02 <KAT> d-------- C:\Program\CCleaner 2008-09-15 15:36 . 2008-09-15 15:36 <KAT> d-------- C:\Program\AskSBar 2008-09-15 15:36 . 2008-09-15 15:36 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll 2008-09-15 15:35 . 2008-09-15 15:36 <KAT> d-------- C:\Program\COMODO 2008-09-15 15:35 . 2008-09-15 15:35 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\Comodo 2008-09-15 15:35 . 2008-09-15 15:55 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\comodo 2008-09-15 15:35 . 2008-09-15 15:35 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-09-15 15:35 . 2008-09-15 15:35 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-09-15 15:35 . 2008-09-15 15:35 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-09-15 15:31 . 2008-09-15 15:31 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-09-15 15:31 . 2008-09-15 15:31 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-09-15 15:30 . 2008-09-15 16:58 <KAT> d-------- C:\WINDOWS\system32\ZoneLabs 2008-09-15 15:30 . 2008-09-15 16:58 <KAT> d-------- C:\WINDOWS\Internet Logs 2008-09-15 12:36 . 2008-09-15 12:36 <KAT> d-------- C:\Program\Lavasoft 2008-09-15 12:36 . 2008-09-15 12:36 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-09-15 12:32 . 2008-09-15 12:32 <KAT> d-------- C:\Program\Panda Security 2008-09-15 12:32 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-09-14 19:32 . 2008-09-14 19:32 111,616 --a------ C:\WINDOWS\system32\svvjga.dll 2008-09-14 19:32 . 2008-09-14 19:32 111,616 --a------ C:\WINDOWS\system32\fslxffbb.dll 2008-09-14 11:27 . 2008-09-14 11:27 <KAT> d-------- C:\Program\Personal 2008-09-14 11:25 . 2008-09-14 11:25 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\TiFiC 2008-09-14 11:24 . 2008-09-14 11:24 <KAT> d-------- C:\Program\TiFiC 2008-09-14 11:24 . 2008-09-14 11:25 <KAT> d-------- C:\Program\Delade filer\TiFiC 2008-09-13 16:23 . 2008-02-26 14:01 294,912 --------- C:\WINDOWS\system32\dllcache\msctf.dll 2008-09-13 16:08 . 2008-09-13 16:08 <KAT> d-------- C:\WINDOWS\system32\sv-se 2008-09-12 19:23 . 2008-09-12 19:23 112,640 --a------ C:\WINDOWS\system32\lpxqphog.dll 2008-09-12 19:23 . 2008-09-12 19:23 112,640 --a------ C:\WINDOWS\system32\amzotq.dll 2008-09-10 20:44 . 2008-09-15 12:21 <KAT> d-------- C:\Documents and Settings\Malmberg\.housecall6.6 2008-09-10 13:00 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\system32\XAudio2_1.dll 2008-09-10 13:00 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\system32\XAPOFX1_0.dll 2008-09-10 09:52 . 2008-09-10 09:52 155,648 --a------ C:\WINDOWS\system32\CodecBHO.dll 2008-09-03 15:54 . 2008-09-03 15:55 <KAT> d-------- C:\Documents and Settings\Malmberg\Application Data\SPORE . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-17 09:05 --------- d-----w C:\Program\Lx_cats 2008-09-17 09:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-16 16:51 --------- d-----w C:\Program\Steam 2008-09-15 14:49 --------- d--h--w C:\Program\InstallShield Installation Information 2008-09-15 10:35 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard 2008-09-12 10:35 --------- d-----w C:\Program\Java 2008-09-10 11:23 --------- d-----w C:\Documents and Settings\Malmberg\Application Data\Azureus 2008-09-08 20:21 --------- d-----w C:\Program\ModMan 2008-08-07 17:27 --------- d-----w C:\Program\Delade filer\Adobe 2008-08-07 17:25 --------- d-----w C:\Program\NVIDIA Corporation 2008-08-02 00:59 0 ----a-w C:\Documents and Settings\Malmberg\jagex_runescape_preferences.dat 2008-04-10 10:23 22,328 ----a-w C:\Documents and Settings\Malmberg\Application Data\PnkBstrK.sys 2007-02-19 17:06 46 ----a-w C:\Documents and Settings\Malmberg\test.bat 2007-06-13 13:23 933,888 --sh--r C:\WINDOWS\system32\sdchost.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 1694208] "swg"="C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 68856] "DAEMON Tools Pro Agent"="C:\Program\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 133576] "ISUSPM"="C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" [2006-09-10 218032] "Start WingMan Profiler"="C:\Program\Logitech\Profiler\lwemon.exe" [2006-07-05 60416] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "WMPNSCFG"="C:\Program\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264] "IntelMeM"="C:\Program\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184] "DVDLauncher"="C:\Program\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "DMXLauncher"="C:\Program\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016] "ISUSPM Startup"="C:\Program\DELADE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-09-10 218032] "ISUSScheduler"="C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" [2006-09-10 86960] "lxcdmon.exe"="C:\Program\Lexmark 6300 Series\lxcdmon.exe" [2005-06-24 200704] "EzPrint"="C:\Program\Lexmark 6300 Series\ezprint.exe" [2005-07-05 94208] "FaxCenterServer"="C:\Program\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 299008] "Windows Media Connect 2"="C:\Program\Windows Media Connect 2\WMCCFG.exe" [2006-10-18 8704] "QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-01-25 77824] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008] "PWRISOVM.EXE"="C:\Program\PowerISO\PWRISOVM.EXE" [2006-07-29 188416] "DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 157592] "nod32kui"="C:\Program\Eset\nod32kui.exe" [2007-05-16 949376] "SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112] "COMODO SafeSurf"="C:\Program\COMODO\SafeSurf\cssurf.exe" [2008-09-15 278264] "COMODO Firewall Pro"="C:\Program\COMODO\Firewall\cfp.exe" [2008-09-15 1655552] "LXCDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll" [2005-07-11 69632] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl] "nwiz"="nwiz.exe" [2007-10-04 C:\WINDOWS\system32\nwiz.exe] "CTHelper"="CTHELPER.EXE" [2004-03-11 C:\WINDOWS\system32\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 C:\WINDOWS\system32\CTXFIHLP.EXE] "Download Manager"="sdchost.exe" [2007-06-13 C:\WINDOWS\system32\sdchost.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "Download Manager"="sdchost.exe" [2007-06-13 C:\WINDOWS\system32\sdchost.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\Malmberg\Start-meny\Program\Autostart\ Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] Privoxy.lnk - C:\Program\Privoxy\privoxy.exe [2008-08-17 301056] Registration Lock On [2007-04-20 0] C:\Documents and Settings\All Users\Start-meny\Program\Autostart\ Adobe Gamma Loader.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] Certificate Mover.lnk - C:\Program\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe [2005-11-25 126976] Personal.lnk - C:\Program\Personal\bin\Personal.exe [2008-09-14 910864] Service Manager.lnk - C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308] ZDWLan Utility.lnk - C:\Program\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2006-08-23 475136] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\lxcdcoms.exe"= "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcdPSWX.EXE"= "C:\\Program\\GameSpy Arcade\\Aphex.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Program\\BitLord\\BitLord.exe"= "C:\\Program\\Messenger\\msmsgs.exe"= "C:\\Program\\Azureus\\Azureus.exe"= "C:\\Spel\\Lock on\\LockOn.exe"= "C:\\Program\\DAP\\DAP.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\day of defeat source\\hl2.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\counter-strike source\\hl2.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\half-life 2 deathmatch\\hl2.exe"= "C:\\Program\\MSN Messenger\\msnmsgr.exe"= "C:\\Program\\MSN Messenger\\livecall.exe"= "C:\\Program\\Steam\\Steam.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\source sdk base\\hl2.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\half-life 2\\hl2.exe"= "C:\\Spel\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= "C:\\Program\\NetMeeting\\conf.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= "C:\\Spel\\Live For Speed\\LFS.exe"= "C:\\Program\\DC++\\DCPlusPlus.exe"= "C:\\Documents and Settings\\Malmberg\\Skrivbord\\LfsRevLimiter.0.3.exe"= "C:\\Documents and Settings\\Malmberg\\Skrivbord\\LfsRevLimiter.0.9.exe"= "C:\\Program\\Steam\\SteamApps\\fmalmberg\\source sdk base 2007\\hl2.exe"= "C:\\Program\\Steam\\SteamApps\\SourceMods\\Condition Zero\\hl.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 "12888:TCP"= 12888:TCP:12888 "6889:TCP"= 6889:TCP:6889 "43594:TCP"= 43594:TCP:43594 "33627:TCP"= 33627:TCP:33627 "33627:UDP"= 33627:UDP:33627 "10308:TCP"= 10308:TCP:10308 "63392:UDP"= 63392:UDP:LFS? "63392:TCP"= 63392:TCP:63392 "29332:UDP"= 29332:UDP:29332 "29332:TCP"= 29332:TCP:29332 TCP R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 35328] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-09-15 87056] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-09-15 24208] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-07-08 33952] R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 98304] R2 MSSQL$INVENTORCONTENT;MSSQL$INVENTORCONTENT;C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe [2002-12-17 7520337] R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-20 118784] R3 chdrvr01;CH Control Manager Driver 1;C:\WINDOWS\system32\DRIVERS\chdrvr01.sys [2004-09-14 198880] R3 chdrvr02;CH Control Manager Driver 2;C:\WINDOWS\system32\DRIVERS\chdrvr02.sys [2001-10-30 3712] R3 chdrvr03;CH Control Manager Driver 3;C:\WINDOWS\system32\DRIVERS\chdrvr03.sys [2001-10-30 7584] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 20608] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2006-04-23 29184] S3 NPF;Netgroup Packet Filter;C:\WINDOWS\system32\drivers\npf.sys [ ] S3 NPUSB;NPUSB;C:\WINDOWS\system32\DRIVERS\npusb.sys [2007-03-23 22816] S3 PAP(ZyDas);PAP Blue USB Driver (ZyDas);C:\WINDOWS\system32\DRIVERS\PAPBlue.sys [2005-10-28 402432] S3 SQLAgent$INVENTORCONTENT;SQLAgent$INVENTORCONTENT;C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE [2002-12-17 311872] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-08-17 330240] . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - BHO-{0dccb97f-924a-45b4-9f2f-49cbeea03a54} - C:\WINDOWS\system32\uodiec.dll BHO-{286BD0FE-2946-46E5-BA43-ECBD3D6DFF5F} - C:\WINDOWS\system32\cbXRIXPf.dll BHO-{88BF540D-0CFD-453A-8FFE-A352132EEEBE} - C:\Documents and Settings\Malmberg\Lokala inställningar\Temporary Internet Files\Content.IE5\YZE0A0SZ\silent.dll[1].bak BHO-{DABB1C43-1596-49C4-9E4D-51AE7A1518BB} - C:\WINDOWS\system32\ssqQkHAS.dll BHO-{E37B713E-B4BE-4DA8-864A-2F385F6EA724} - C:\Documents and Settings\Malmberg\Lokala inställningar\Temporary Internet Files\Content.IE5\YZE0A0SZ\silent.dll[1].bak HKLM-Run-a8470dcd - C:\WINDOWS\system32\plihbhtf.dll HKLM-Run-NWEReboot - (no file) HKLM-Run-NaturalPoint - (no file) ShellExecuteHooks-{DABB1C43-1596-49C4-9E4D-51AE7A1518BB} - C:\WINDOWS\system32\ssqQkHAS.dll Notify-ssqQkHAS - ssqQkHAS.dll . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Malmberg\Application Data\Mozilla\Firefox\Profiles\ycp98e9v.default\ FF -: plugin - C:\Program\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - C:\Program\Mozilla Firefox\plugins\NPAskSBr.dll FF -: plugin - C:\Program\Personal\bin\np_prsnl.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-17 11:04:32 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCDCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program\Windows Defender\MsMpEng.exe C:\Program\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\rundll32.exe C:\Program\COMODO\Firewall\cmdagent.exe C:\Program\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program\ESET\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\SmartScaps.exe C:\Program\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\lxcdcoms.exe . ************************************************************************** . Completion time: 2008-09-17 11:11:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-17 09:11:41 Pre-Run: 124,528,541,696 byte ledigt Post-Run: 133,441,019,904 byte ledigt 294 --- E O F --- 2008-08-14 23:46:37
Hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:23:27, on 2008-09-17 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program\CyberLink\PowerDVD\DVDLauncher.exe C:\Program\Dell\Media Experience\DMXLauncher.exe C:\Program\Lexmark 6300 Series\lxcdmon.exe C:\Program\PowerISO\PWRISOVM.EXE C:\Program\DAEMON Tools\daemon.exe C:\Program\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\sdchost.exe C:\Program\Messenger\msmsgs.exe C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe C:\Program\Logitech\Profiler\lwemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\Windows Media Player\WMPNSCFG.exe C:\Program\COMODO\Firewall\cmdagent.exe C:\WINDOWS\System32\svchost.exe C:\Program\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe C:\Program\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe C:\Program\Eset\nod32krn.exe C:\Program\Personal\bin\Personal.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program\Privoxy\privoxy.exe C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\Smartscaps.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\lxcdcoms.exe C:\WINDOWS\explorer.exe C:\Program\internet explorer\iexplore.exe C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Malmberg\Skrivbord\scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar2.dll O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program\AskSBar\bar\1.bin\ASKSBAR.DLL O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\Program\DELADE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [lxcdmon.exe] "C:\Program\Lexmark 6300 Series\lxcdmon.exe" O4 - HKLM\..\Run: [EzPrint] "C:\Program\Lexmark 6300 Series\ezprint.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program\Windows Media Connect 2\WMCCFG.exe" /StartQuiet O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Download Manager] sdchost.exe O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program\COMODO\SafeSurf\cssurf.exe" -s O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [LXCDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCDtime.dll,_RunDLLEntry@16 O4 - HKLM\..\RunServices: [Download Manager] sdchost.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ISUSPM] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program\Logitech\Profiler\lwemon.exe" /noui O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Privoxy.lnk = C:\Program\Privoxy\privoxy.exe O4 - Startup: Registration Lock On O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Certificate Mover.lnk = ? O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe O4 - Global Startup: Service Manager.lnk = C:\Program\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: &Clean Traces - C:\Program\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program\DAP\dapextie2.htm O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program\Sony\Image Converter 2\menu.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O15 - Trusted Zone: *.handelsbanken.se O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712...com/downloads/player/Install2.5/Installer.exe O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program\Delade filer\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program\COMODO\Firewall\cmdagent.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: lxcd_device - Unknown owner - C:\WINDOWS\system32\lxcdcoms.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe -- End of file - 13500 bytes
Hey felix100 Malware still lurks there. Let's try to clean it with a separate scanner. Please download Superantispyware Free and install it. Follow the prompts and reboot if required. Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware... Configuring SuperAntispyware • Click on Preferences. • In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run. • Navigate to the tab Scanning Control. • Make sure only these boxes are checked: Code: Close browsers before scanning Scan for tracking cookies Terminate memory threats before quarantining Scan Alternate Data Streams Use Kernel Direct File Access (recommended) Use Kernel Direct Registry Access (recommended) Use Direct Disk Access (recommended) • Click on Close. Updating SuperAntispyware • At the main window, click on Check for Updates.... • Wait for SuperAntispyware to be fully updated. Scanning Time • Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode. • Launch SuperAntispyware. • At the main window, click on Scan your Computer.... • Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next. • Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items. • Reboot your computer. Post A Log • Launch SuperAntispyware • Click on Preferences • Navigate to the tab Statistics/Logs. • Choose the latest scan log, and the click on View Log.... • Copy and paste the contents of the log here in your next post. Best Regards
Here's the SUPERAntiSpyware log (the scan was run in safe mode): SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 09/17/2008 at 05:47 PM Application Version : 4.21.1004 Core Rules Database Version : 3570 Trace Rules Database Version: 1558 Scan type : Complete Scan Total Scan Time : 02:42:54 Memory items scanned : 164 Memory threats detected : 0 Registry items scanned : 7499 Registry threats detected : 29 File items scanned : 292673 File threats detected : 19 Unclassified.Oreans32 HKLM\System\ControlSet001\Services\oreans32 C:\WINDOWS\SYSTEM32\DRIVERS\OREANS32.SYS HKLM\System\ControlSet001\Enum\Root\LEGACY_oreans32 HKLM\System\ControlSet003\Services\oreans32 HKLM\System\ControlSet003\Enum\Root\LEGACY_oreans32 HKLM\System\CurrentControlSet\Services\oreans32 HKLM\System\CurrentControlSet\Enum\Root\LEGACY_oreans32 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32#NextInstance HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Service HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Legacy HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ConfigFlags HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Class HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ClassGUID HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#DeviceDesc HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Capabilities HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Driver HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\LogConf HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Type HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Start HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ErrorControl HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ImagePath HKLM\SYSTEM\CurrentControlSet\Services\oreans32#DisplayName HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security#Security HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#0 HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#Count HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#NextInstance Adware.Tracking Cookie C:\Documents and Settings\Malmberg\Cookies\malmberg@msnportal.112.2o7[2].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@track.adform[2].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[4].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[2].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@atdmt[3].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@gomyhit[3].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@doubleclick[3].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@serving-sys[2].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@tradedoubler[1].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@bs.serving-sys[1].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@ad.adtoma[2].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@spyguardpro[1].txt C:\Documents and Settings\Malmberg\Cookies\malmberg@imrworldwide[3].txt Trojan.Downloader-CREW C:\SYSTEM VOLUME INFORMATION\_RESTORE{619781AC-CF96-4B2F-8E58-2353903809FC}\RP1250\A0294332.DLL Adware.Vundo Variant C:\SYSTEM VOLUME INFORMATION\_RESTORE{619781AC-CF96-4B2F-8E58-2353903809FC}\RP1250\A0294664.DLL C:\WINDOWS\SYSTEM32\FSLXFFBB.DLL C:\WINDOWS\SYSTEM32\SVVJGA.DLL Trojan.ZLob/CodecBHO C:\WINDOWS\SYSTEM32\CODECBHO.DLL
Hey felix100 Yes, there is more for you to do. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. Open Notepad and copy/paste the text in the code box below into it: Code: File:: C:\WINDOWS\system32\ppiycfrf.tmp C:\WINDOWS\system32\lpxqphog.dll C:\WINDOWS\system32\amzotq.dll C:\WINDOWS\system32\sdchost.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "Download Manager"=- Save this as CFScript.txt in the same folder as ComboFix. Then drag the CFScript.txt into Combo-Fix.exe. This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt). Do not click on the ComoboFix window, as it may cause it to stall. After that, post a new HijackThis log, and tell me what problems you have left. Best Regards
