Malwarebytes’ Anti-Malware 1.46
http://www.malwarebytes.org

Database version: 4534

Windows 6.1.7100
Internet Explorer 8.0.7100.0

03-09-2010 12:21:31
mbam-log-2010-09-03 (12-21-31).txt

Skanningstype: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 249253
Tid gået: 22 minut(ter), 31 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 2
Registreringsdatabaseværdier Inficeret: 2
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 4

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

Registreringsdatabaseværdier Inficeret:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wqnlsgpt (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mediafix70700en02.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
C:\Users\Win7\AppData\Local\mlxjhwkcm\ldkxbngshdw.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Local\Temp\lnudls.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Local\Temp\sxcfgslr.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Roaming\0A5A26F3EC641E14C5410D5BC10C1F21\mediafix70700en02.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

jeg er på den “syge computer” nu.. jeg “snyder” den, ved at åbne joblisten, nyt job også skrive “C:\Program Files\Internet Explorer\iexplore.exe” . så kan jeg være på nettet, men jeg kan ikke lave andet - skrivebordet dukker ikke op.. For helved jeg hader virus :s

!!!!!!!!!!!DETTE ER DEN FØRSTE SKAN. ovenstående er nr. 2, beklager rækkefølgen!!!!!!!!!!!

Malwarebytes’ Anti-Malware 1.46
http://www.malwarebytes.org

Database version: 4419

Windows 6.1.7100
Internet Explorer 8.0.7100.0

03-09-2010 10:15:58
mbam-log-2010-09-03 (10-15-58).txt

Skanningstype: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 249164
Tid gået: 23 minut(ter), 56 sekund(er)

Hukommelses Processorer Inficeret: 1
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 2
Registreringsdatabaseværdier Inficeret: 1
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 9

Hukommelses Processorer Inficeret:
C:\Users\Win7\.COMMgr\complmgr.exe (Trojan.Agent) -> Unloaded process successfully.

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

Registreringsdatabaseværdier Inficeret:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\com+ manager (Trojan.Agent) -> Quarantined and deleted successfully.

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
C:\Poker\Poker at bet365\_SetupPoker_3f8b[1].exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Local\ciergtwys\vfdjaostssd.exe (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.
C:\Users\Win7\Local Settings\Application Data\Windows Server\admin.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Win7\Desktop\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\Win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\Win7\.COMMgr\complmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Win7\Templates\memory.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Prøv lige om det her virker ->

Hent Rkill fra et af nedenstånde links, og gem den på skrivebordet

Rkill.exe - http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill.com - http://download.bleepingcomputer.com/grinler/rkill.com
Rkill.scr - http://download.bleepingcomputer.com/grinler/rkill.scr
Rkill.pif - http://download.bleepingcomputer.com/grinler/rkill.pif

Nogen infektioner skjuler Windows-skrivebordet, derfor er vi nødt til at åbne et vindue op, som giver os mulighed for at se ikonerne.

Hvis du er i Windows Vista eller Windows 7 udføre følgende trin.
Klik på Start-knappen og skriv %userprofile%\skrivebord i feltet Søg nederst i startmenuen. Tryk derefter på Enter på tastaturet.
Så popper der et vindue op, der viser alle dine desktop ikoner, herunder rkill.com programmet. Nu skal du dobbeltklikke på rkill.com, der automatisk at forsøge at stoppe enhver processer i forbindelse med Security Tool og andre Rogue programmer. Vær tålmodig mens programmet tjekker for forskellige malware-programmer og sletter dem. Når den er færdig, lukker det sorte vindue automatisk, og du kan fortsætte med næste trin. Hvis du får en besked om, at rkill er en infektion, skal du ikke blive forskrækket. Denne besked er blot en falsk advarsel.

Computeren må IKKE genstartes efter at have kørt rkill da malware-programmer vil starte igen.

Hent og installer denne scanner:
SUPERAntiSpyware
Start superantispyware, klik på Check for updates.
Klik på Scan your Computer, sæt flueben i de drev der skal scannes.
(Fixed disk betyder harddisk)
Flyt prikken til Perform complete scan og klik på Næste, så kører scanningen.
Når den er færdig kommer der et vindue med en opsummering, klik på OK, klik så på næste og så på Udfør.
Der kommer et vindue med Quarantine and removal Complete, klik på OK, klik på Udfør.
Luk programmet, genstart normalt.
———————————————————-
Start SuperAntiSpyware igen, klik på Preferences, skift til fanebladet Statistics/Logs, i vinduet dobbeltklikker du på SUPERAntiSpyware Scan Log, og sender den herind sammen med rkill loggen.

når jeg henter rkill - så langt er jeg med.. Men jeg kan jo ikke trylle “start” frem? jeg kan som sagt ikke se skrivebord eller linial…

Hvordan tryllede du start frem?:)

Gem Rkill helt ude i roden.
Åbn så jobliste->Nyt job C:\rkill. (hvilken en du nu har)

den her log kommer fra rkill

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Win7 on 03-09-2010 at 15:29:28.

Processes terminated by Rkill or while it was running:

C:\Users\Win7\Desktop\rkill.exe

Rkill completed on 03-09-2010 at 15:29:30.

skal jeg bare følge anvisningerne fra Mr. Magic?

jeg prøver at hente SuperANTIprogrammet, men, får denne forhindring

“Dette program er blokeret pga. kompatibilitetsproblemer….” og så siger den at det ikke passer til denne version af windows.. hmmmm

hva så..

Hent DDS og gem programmet på dit Skrivebord:

http://download.bleepingcomputer.com/sUBs/dds.scr (scr)
http://www.forospyware.com/sUBs/dds (pif)

Dobbeltklik på DDS.com/DDS.scr/DDS.pif og tillad programmet at køre. Når programmet er færdig vil det åbne to logs/tekst-filer. Gem begge filer på dit Skrivebord og kopier indholdet af DDS.txt herind i dit næste indlæg.
Vi er indledningsvist IKKE interesseret i at se nr. 2 log (Attach.txt).

Bliver programmet blokeret af et beskyttelsesprogram, så deaktiver dette.

DDS (Ver_10-03-17.01) - NTFSX64
Run by Win7 at 17:49:11,09 on 03-09-2010
Internet Explorer: 8.0.7100.0
Microsoft Windows 7 Ultimate   6.1.7100.0.1252.45.1033.18.6135.5084 [GMT 2:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\SysWOW64\PnkBstrB.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\SysWOW64\nvSCPAPISvr.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Win7\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

mStart Page = hxxp://www.foozir.com/
mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyServer = http=127.0.0.1:6092
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files (x86)\windows live\toolbar\wltcore.dll
TB: &Windows; Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files (x86)\windows live\toolbar\wltcore.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files (x86)\daemon tools toolbar\DTToolbar.dll
uRun: [VOIPlay] “d:\programmer\voiplay\voiplay.exe”
uRun: [Steam] “d:\programmer\steam\installeret steam\steam.exe” -silent
uRun: [Sidebar] c:\program files (x86)\windows sidebar\sidebar.exe /autoRun
uRun: [msnmsgr] “c:\program files (x86)\windows live\messenger\msnmsgr.exe” /background
uRun: [DAEMON Tools Lite] “c:\program files (x86)\daemon tools lite\DTLite.exe” -autorun
mRun: [ncrowexmas.exe] “c:\users\win7\appdata\local\temp\ncrowexmas.exe”
mRun: [Malwarebytes Anti-Malware (reboot)] “d:\programmer\malwarebytes’ anti-malware\mbam.exe” /runcleanupscript
mRunOnce: [Malwarebytes’ Anti-Malware] d:\programmer\malwarebytes’ anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\users\win7\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files (x86)\openoffice.org 3\program\quickstart.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Free YouTube to Mp3 Converter - c:\users\win7\appdata\roaming\dvdvideosoftiehelpers\youtubetomp3.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
TCP: {6116C6BE-6E71-4BCE-9590-FDBA1AA49E5D} = 208.67.222.222,208.67.220.220
TCP: {E8E42C1E-6CBF-431A-8FC8-2B0B7609BE54} = 208.67.222.222,208.67.220.220
{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}
{32099AAC-C132-4136-9E9A-4E364A424E17}
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

============= SERVICES / DRIVERS ===============

R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x64.sys [2009-12-17 19432]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\syswow64\nvSCPAPISvr.exe [2009-6-10 232960]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x64.sys [2009-3-28 389120]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-5-1 61280]
S3 fsssvc;Windows Live Family Safety Service;c:\program files (x86)\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 GarenaPEngine;GarenaPEngine;c:\users\win7\appdata\local\temp\IGO9507.tmp [2009-8-9 17864]

=============== Created Last 30 ================

2010-09-03 11:23:27   0   d——-w-  c:\windows\pss
2010-09-03 07:41:59   0   d-sh—w-  c:\users\win7\.COMMgr
2010-09-03 07:41:23   0   d——-w-  c:\users\win7\appdata\roaming\0A5A26F3EC641E14C5410D5BC10C1F21
2010-08-27 10:49:54   0   d——-w-  c:\users\win7\appdata\roaming\DVDVideoSoftIEHelpers
2010-08-27 10:49:47   0   d——-w-  c:\program files (x86)\DVDVideoSoft
2010-08-27 10:49:43   0   d——-w-  c:\program files (x86)\common files\DVDVideoSoft
2010-08-17 22:15:28   16   —-ha-w-  c:\users\win7\vaext
2010-08-17 22:15:28   16   —-ha-w-  c:\users\win7\.vsysd
2010-08-12 18:48:43   0   d——-w-  c:\users\win7\appdata\roaming\VOIPlay
2010-08-12 18:48:43   0   d——-w-  c:\programdata\VOIPlay
2010-08-12 12:59:55   60841   ——a-w-  c:\windows\War3Unin.dat
2010-08-12 12:59:54   2829   ——a-w-  c:\windows\War3Unin.pif
2010-08-12 12:59:54   139264   ——a-w-  c:\windows\War3Unin.exe
2010-08-12 12:54:25   0   d——-w-  c:\program files (x86)\DAEMON Tools Lite
2010-08-12 12:49:26   0   d——-w-  c:\program files (x86)\DAEMON Tools Toolbar
2010-08-12 12:48:49   0   d——-w-  c:\programdata\DAEMON Tools Lite
2010-08-12 12:43:57   834544   ——a-w-  c:\windows\system32\drivers\sptd.sys
2010-08-12 12:43:41   0   d——-w-  c:\users\win7\appdata\roaming\DAEMON Tools Lite
2010-08-12 12:39:08   0   d——-w-  c:\programdata\DAEMON Tools Net
2010-08-12 12:39:03   0   d——-w-  c:\users\win7\appdata\roaming\DAEMON Tools Net

==================== Find3M ====================

2010-08-27 19:08:22   76482   ——a-w-  c:\windows\system32\perfc006.dat
2010-08-27 19:08:22   460912   ——a-w-  c:\windows\system32\perfh006.dat
2010-07-22 15:43:56   219128   ——a-w-  c:\windows\syswow64\PnkBstrB.exe
2010-07-09 19:04:40   41872   ——a-w-  c:\windows\syswow64\xfcodec.dll
2010-07-09 19:04:40   27536   ——a-w-  c:\windows\system32\xfcodec64.dll
2010-07-07 07:40:46   72080   ——a-w-  c:\users\win7\g2mdlhlpx.exe
2009-06-30 21:08:28   39196   ——a-w-  c:\windows\inf\perflib\0406\perfd.dat
2009-06-30 21:08:28   39196   ——a-w-  c:\windows\inf\perflib\0406\perfc.dat
2009-06-30 21:08:28   306518   ——a-w-  c:\windows\inf\perflib\0406\perfi.dat
2009-06-30 21:08:28   306518   ——a-w-  c:\windows\inf\perflib\0406\perfh.dat
2009-04-22 09:52:01   31548   ——a-w-  c:\windows\inf\perflib\0409\perfd.dat
2009-04-22 09:52:01   31548   ——a-w-  c:\windows\inf\perflib\0409\perfc.dat
2009-04-22 09:52:01   291294   ——a-w-  c:\windows\inf\perflib\0409\perfi.dat
2009-04-22 09:52:01   291294   ——a-w-  c:\windows\inf\perflib\0409\perfh.dat
2009-04-22 09:08:55   174   —sha-w-  c:\program files\desktop.ini
2009-04-22 09:08:55   174   —sha-w-  c:\program files (x86)\desktop.ini
2009-04-22 05:05:25   291294   ——a-w-  c:\windows\inf\perflib\0000\perfi.dat
2009-04-22 05:05:25   291294   ——a-w-  c:\windows\inf\perflib\0000\perfh.dat
2009-04-22 05:05:24   31548   ——a-w-  c:\windows\inf\perflib\0000\perfd.dat
2009-04-22 05:05:24   31548   ——a-w-  c:\windows\inf\perflib\0000\perfc.dat
2009-03-27 04:24:11   9633792   —sha-r-  c:\windows\fonts\StaticCache.dat
2009-11-25 06:43:12   16384   —sha-w-  c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2009-11-25 06:43:12   16384   —sha-w-  c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2009-11-25 06:43:12   32768   —sha-w-  c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2009-06-30 21:28:01   245760   —sha-w-  c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2010-03-07 22:06:07   16384   —sha-w-  c:\windows\temp\cookies\index.dat
2010-03-07 22:06:07   16384   —sha-w-  c:\windows\temp\history\history.ie5\index.dat
2010-03-07 22:06:07   32768   —sha-w-  c:\windows\temp\temporary internet files\content.ie5\index.dat
2009-04-22 05:38:46   398848   —sha-w-  c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7100.0_none_be69c16d5d28757a\WinMail.exe
2009-04-22 05:19:40   396800   —sha-w-  c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7100.0_none_624b25e9a4cb0444\WinMail.exe

============= FINISH: 17:49:44,96 ===============

Hent Combofix, og gem den på dit skrivebord:
ComboFix

Luk alle andre vinduer ned.

Kør så combofix.exe, og følg anvisningerne.

Når du får denne besked:
http://img.photobucket.com/albums/v666/sUBs/RC_update.png

Svarer du enten Ja eller Nej. Det er tilrådeligt at du siger Ja. Uanset hvad du svarer, har det ingen indflydelse på combofix scanningen.

Du må ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C: Combofix txt

Indholdet af denne fil må du gerne lægge herind

Da de er forholdsvis lange, kan du blive nødt til at sende dem i flere indlæg.

NB. Før du sender logfilerne, beder vi dig om at fjerne enhvert P2P/fildelings program, hvis du har nogen, og dette inkluderer Torrent software, før vi renser computeren.

Jeg har afinstalleret p2pprogrammer.. og prøver så at køre combofix men får denne besked “ERROR - win32 only” “Incompatible OS, combofix only works for workstations with windows 2000 and XP”

Jeg har win 7.

Skammeligt, for så skal vi have gang i et par monster log filer  

Hent Oldtimers OTS og gem den på dit skrivebord:
http://oldtimer.geekstogo.com/OTS.exe

Luk alle åbne programmer, og kør OTS. Klik så på “Run Scan”, og vent på at der åbner sig en logfil. Filen OTS.txt vil så åbne sig.

Kopier den herind, da den er forholdsvis stor, er du nok nødt til sende den over flere indlæg


OTS logfile created on: 04-09-2010 10:17:21 - Run 1
OTS by OldTimer - Version 3.1.36.0   Folder = C:\Users\Win7\Desktop
64bit- Ultimate Edition (Version = 6.1.7100) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7100.0)
Locale: 00000406 | Country: Danmark | Language: DAN | Date Format: dd-MM-yyyy

6,00 Gb Total Physical Memory | 5,00 Gb Available Physical Memory | 84,00% Memory free
12,00 Gb Paging File | 11,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 29,91 Gb Total Space | 2,69 Gb Free Space | 8,99% Space Free | Partition Type: NTFS
Drive D: | 901,49 Gb Total Space | 484,73 Gb Free Space | 53,77% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WIN7-PC
Current User Name: Win7
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days

[Processes - Safe List]
ots.exe -> C:\Users\Win7\Desktop\OTS.exe -> [2010-09-04 10:16:30 | 000,641,024 |——| M] (OldTimer Tools)
pnkbstrb.exe -> C:\Windows\SysWOW64\PnkBstrB.exe -> [2010-07-22 17:43:56 | 000,219,128 |——| M] ()
pnkbstra.exe -> C:\Windows\SysWOW64\PnkBstrA.exe -> [2010-01-27 17:31:24 | 000,075,064 |——| M] ()
nvscpapisvr.exe -> C:\Windows\SysWOW64\nvSCPAPISvr.exe -> [2009-06-10 06:33:00 | 000,232,960 |——| M] (NVIDIA Corporation)
nircmd.cfxxe -> C:\32788R22FWJFW\NirCmd.cfxxe -> [2009-04-20 12:56:28 | 000,031,232 |——| M] (NirSoft)
seaport.exe -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -> [2009-01-14 17:53:02 | 000,226,656 |——| M] (Microsoft Corp.)

[Modules - Safe List]
ots.exe -> C:\Users\Win7\Desktop\OTS.exe -> [2010-09-04 10:16:30 | 000,641,024 |——| M] (OldTimer Tools)
comctl32.dll -> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7100.19_none_b6a32c7c247ee542\comctl32.dll -> [2009-05-13 08:15:18 | 001,679,360 |——| M] (Microsoft Corporation)
msscript.ocx -> C:\Windows\SysWOW64\msscript.ocx -> [2009-04-22 07:18:43 | 000,095,232 |——| M] (Microsoft Corporation)

[Win32 Services - Safe List]
64bit-(PnkBstrB)  [Auto | Running] -> C:\Windows\SysNative\PnkBstrB.exe -> File not found
64bit-(PnkBstrA)  [Auto | Running] -> C:\Windows\SysNative\PnkBstrA.exe -> File not found
64bit-(UmRdpService)  [On_Demand | Stopped] -> C:\Windows\SysNative\umrdp.dll -> [2009-04-22 07:41:29 | 000,195,072 |——| M] (Microsoft Corporation)
64bit-(PeerDistSvc)  [On_Demand | Stopped] -> C:\Windows\SysNative\PeerDistSvc.dll -> [2009-04-22 07:40:52 | 001,361,920 |——| M] (Microsoft Corporation)
64bit-(WinDefend)  [Auto | Running] -> C:\Program Files\Windows Defender\mpsvc.dll -> [2009-04-22 07:40:14 | 001,011,200 |——| M] (Microsoft Corporation)
64bit-(CscService)  [Auto | Running] -> C:\Windows\SysNative\cscsvc.dll -> [2009-04-22 07:39:25 | 000,689,152 |——| M] (Microsoft Corporation)
64bit-(AppMgmt)  [On_Demand | Stopped] -> C:\Windows\SysNative\appmgmts.dll -> [2009-04-22 07:38:59 | 000,193,024 |——| M] (Microsoft Corporation)
(PnkBstrB) PnkBstrB [Auto | Running] -> C:\Windows\SysWOW64\PnkBstrB.exe -> [2010-07-22 17:43:56 | 000,219,128 |——| M] ()
(PnkBstrA) PnkBstrA [Auto | Running] -> C:\Windows\SysWOW64\PnkBstrA.exe -> [2010-01-27 17:31:24 | 000,075,064 |——| M] ()
(fsssvc) Windows Live Family Safety Service [On_Demand | Stopped] -> C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe -> [2009-08-05 22:48:42 | 000,704,864 |——| M] (Microsoft Corporation)
(Steam Client Service) Steam Client Service [On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Steam\SteamService.exe -> [2009-07-16 18:04:16 | 000,316,664 |——| M] (Valve Corporation)
(Stereo Service) NVIDIA Stereoscopic 3D Driver Service [Auto | Running] -> C:\Windows\SysWOW64\nvSCPAPISvr.exe -> [2009-06-10 06:33:00 | 000,232,960 |——| M] (NVIDIA Corporation)
(SeaPort) SeaPort [Auto | Running] -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -> [2009-01-14 17:53:02 | 000,226,656 |——| M] (Microsoft Corp.)

[Driver Services - Safe List]
64bit-(sptd) sptd [Kernel | Boot | Running] -> C:\Windows\SysNative\drivers\sptd.sys -> [2010-08-12 14:54:44 | 000,834,544 |——| M] ()
64bit-(fssfltr) FssFltr [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\fssfltr.sys -> [2009-08-05 23:24:16 | 000,061,280 |——| M] (Microsoft Corporation)
64bit-(amdsbs) amdsbs [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\amdsbs.sys -> [2009-04-22 07:53:06 | 000,194,128 |——| M] (AMD Technologies Inc.)
64bit-(amdsata) amdsata [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\amdsata.sys -> [2009-04-22 07:53:04 | 000,105,040 |——| M] (AMD)
64bit-(amdxata) amdxata [Kernel | Boot | Running] -> C:\Windows\SysNative\drivers\amdxata.sys -> [2009-04-22 07:52:53 | 000,028,752 |——| M] (AMD)
64bit-(HpSAMD) HpSAMD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\HpSAMD.sys -> [2009-04-22 07:48:16 | 000,077,904 |——| M] (Hewlett-Packard Company)
64bit-(LSI_SAS2) LSI_SAS2 [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\lsi_sas2.sys -> [2009-04-22 07:48:15 | 000,065,616 |——| M] (LSI Corporation)
64bit-(vmbus) vmbus [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\vmbus.sys -> [2009-04-22 07:45:27 | 000,203,856 |——| M] (Microsoft Corporation)
64bit-(storflt) Disk Virtual Machine Bus Acceleration Filter Driver [Kernel | Boot | Running] -> C:\Windows\SysNative\drivers\vmstorfl.sys -> [2009-04-22 07:45:25 | 000,047,168 |——| M] (Microsoft Corporation)
64bit-(storvsc) storvsc [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\storvsc.sys -> [2009-04-22 07:45:20 | 000,036,944 |——| M] (Microsoft Corporation)
64bit-(stexstor) stexstor [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\stexstor.sys -> [2009-04-22 07:45:20 | 000,024,640 |——| M] (Promise Technology)
64bit-(s3cap) s3cap [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\vms3cap.sys -> [2009-04-22 05:49:33 | 000,006,656 |——| M] (Microsoft Corporation)
64bit-(VMBusHID) VMBusHID [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\VMBusHID.sys -> [2009-04-22 05:49:14 | 000,021,760 |——| M] (Microsoft Corporation)
64bit-(CSC) Driver til offlinefiler [Kernel | System | Running] -> C:\Windows\SysNative\drivers\csc.sys -> [2009-04-22 05:27:28 | 000,514,048 |——| M] (Microsoft Corporation)
64bit-(yukonw7) NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\yk62x64.sys -> [2009-03-28 06:44:58 | 000,389,120 |——| M] (Marvell)
64bit-(cpuz132) cpuz132 [Kernel | Auto | Running] -> C:\Windows\SysNative\drivers\cpuz132_x64.sys -> [2009-03-27 02:23:54 | 000,019,432 |——| M] (Windows (R) Codename Longhorn DDK provider)
64bit-(b06bdrv) Broadcom NetXtreme II VBD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\bxvbda.sys -> [2009-03-17 06:35:14 | 000,468,480 |——| M] (Broadcom Corporation)
64bit-(b57nd60a) Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\b57nd60a.sys -> [2009-03-06 09:43:48 | 000,270,848 |——| M] (Broadcom Corporation)
64bit-(ebdrv) Broadcom NetXtreme II 10 GigE VBD [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\evbda.sys -> [2009-02-06 05:41:49 | 003,286,016 |——| M] (Broadcom Corporation)
64bit-(hcw85cir) Hauppauge Consumer Infrared Receiver [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\hcw85cir.sys -> [2009-01-24 06:08:24 | 000,031,232 |——| M] (Hauppauge Computer Works, Inc.)
64bit-(Ntfs) Ntfs [File_System | On_Demand | Running] -> C:\Windows\SysNative\wbem\ntfs.mof -> [2009-01-08 19:28:16 | 000,000,308 |——| M] ()
64bit-(MTsensor) ATK0110 ACPI UTILITY [Kernel | On_Demand | Running] -> C:\Windows\SysNative\drivers\ASACPI.sys -> [2005-03-29 01:30:38 | 000,008,192 |——| M] ()
(GarenaPEngine) GarenaPEngine [Kernel | On_Demand | Stopped] -> C:\Users\Win7\AppData\Local\Temp\IGO9507.tmp -> [2009-08-09 19:21:13 | 000,017,864 |——| M] ()