Think im infected with some wierd virus

extro · October 16, 2011

Hi,Im from sweden so my english might not be the best and my windows is in swedish. I got Windows Vista home premium 64 bits and im a totall newbie with high tech stuff, so when you ask me to bring fort a ,log or anything like that, please take your time and explain where to find it I appreciate all help. Now to whats happening with my computer.

I get constantly pop-up screens saying my internet explorer is not working and and DEP message comes fort saying it shut down the internet explorer to protect my computer. The problem here is that IM not even trying to run internet explorer, i can watch a movie,be in paint or not even doing anything, and these pop-ups still comes. DEP turns off: Internet Explorer(no-addons) Interner Explorer,Firefox.

The only internet that works is Internet explorer (64 bits).

I also get these type of warnings from Malwarebytes'Anti-Malware 1.51.2.1300(Beta version)

00:31:37 Robin IP-BLOCK 184.73.179.238 (Type: outgoing, Port: 50444, Process: setup_spybhoremover.exe)

00:43:17 Robin MESSAGE IP Protection stopped

01:23:30 Robin MESSAGE Protection started successfully

01:23:34 Robin MESSAGE IP Protection started successfully

03:23:13 Robin MESSAGE Protection started successfully

03:23:17 Robin MESSAGE IP Protection started successfully

03:25:09 Robin IP-BLOCK 194.85.61.78 (Type: outgoing, Port: 49172, Process: iexplore.exe)

10:24:58 Robin MESSAGE Protection started successfully

10:25:02 Robin MESSAGE IP Protection started successfully

So i would guess that iexplore.exe is Infected with something and is trying something that my computer dont like.

Ive run the lastet norton,kaspers,malwarebytes,antispyware and it cant find anything,(only some tracing cookies and they get removed)

So please you experts, take your time and help me=) I would really appriciate it!

Love Extro

Read that i should update MBAM and do a quick scan and post log, also post DDS.txt. So here it is

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7958

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19088

2011-10-16 15:08:43

mbam-log-2011-10-16 (15-08-43).txt

Scan type: Quick scan

Objects scanned: 174365

Time elapsed: 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

HERES THE DDS.TXT

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.6001.19088

Run by Robin at 15:11:55 on 2011-10-16

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.4094.1634 [GMT 2:00]

.

AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

C:\Windows\system32\HidService.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe

C:\Windows\SysWOW64\IoctlSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\taskeng.exe

C:\Windows\SysWOW64\DllHost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\ACER\Preload\Autorun\DRV\Fiji Keyboard\ABoard.exe

C:\Program Files (x86)\Packard Bell\SetupMyPC\SmpSys.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\ACER\Preload\Autorun\DRV\Fiji Keyboard\AOSD.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\conime.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=041d&m=imedia_s3710&r=1v3610112706p0385vq25y4752932n

mDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=041d&m=imedia_s3710&r=1v3610112706p0385vq25y4752932n

mWinlogon: Userinit=userinit.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\coIEPlg.dll

BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\IPS\IPSBHO.DLL

BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\coIEPlg.dll

uRun: [smpcSys] C:\Program Files (x86)\Packard Bell\SetupMyPC\SmpSys.exe

uRun: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

TCP: DhcpNameServer = 83.255.245.11 193.150.193.150

TCP: Interfaces\{62B58842-3A33-46AC-BFA0-951E41C072D3} : DhcpNameServer = 83.255.245.11 193.150.193.150

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}

{6D53EC84-6AAE-4787-AEEE-F4628F01010C}

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

.

============= SERVICES / DRIVERS ===============

.

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1301010.003\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1301010.003\SYMDS64.SYS [?]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1301010.003\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1301010.003\SYMEFA64.SYS [?]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\Definitions\BASHDefs\20110929.001\BHDrvx64.sys [2011-9-29 1152632]

R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\system32\drivers\NISx64\1301010.003\ccSetx64.sys --> C:\Windows\system32\drivers\NISx64\1301010.003\ccSetx64.sys [?]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\Definitions\IPSDefs\20111014.031\IDSviA64.sys [2011-10-14 488568]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1301010.003\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1301010.003\Ironx64.SYS [?]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\system32\drivers\NISx64\1301010.003\SYMTDIV.SYS --> C:\Windows\system32\drivers\NISx64\1301010.003\SYMTDIV.SYS [?]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-12 140672]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-10-15 366152]

R2 NIS;Norton Internet Security.;C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe [2011-10-15 138760]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;C:\Windows\system32\DRIVERS\e1y60x64.sys --> C:\Windows\system32\DRIVERS\e1y60x64.sys [?]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-10-13 136824]

R3 Lycosa;Lycosa Keyboard;C:\Windows\system32\drivers\Lycosa.sys --> C:\Windows\system32\drivers\Lycosa.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 PerfHost;Värd för prestandaräknar-DLL;C:\Windows\SysWOW64\perfhost.exe [2008-1-21 19968]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]

S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2011-10-16 89920]

.

=============== File Associations ===============

.

JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

.

=============== Created Last 30 ================

.

2011-10-16 10:54:17 -------- d-----w- C:\Program Files (x86)\ESET

2011-10-16 09:40:40 -------- d-----w- C:\Users\Robin\AppData\Roaming\SUPERAntiSpyware.com

2011-10-16 09:40:21 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2011-10-16 09:40:21 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2011-10-16 01:14:13 -------- d-----w- C:\Windows\SysWow64\vi-VN

2011-10-16 01:14:13 -------- d-----w- C:\Windows\SysWow64\eu-ES

2011-10-16 01:14:13 -------- d-----w- C:\Windows\SysWow64\ca-ES

2011-10-16 01:14:12 -------- d-----w- C:\Windows\System32\vi-VN

2011-10-16 01:14:12 -------- d-----w- C:\Windows\System32\eu-ES

2011-10-16 01:14:12 -------- d-----w- C:\Windows\System32\ca-ES

2011-10-16 00:54:11 -------- d-----w- C:\Windows\System32\EventProviders

2011-10-16 00:50:59 56320 ----a-w- C:\Windows\System32\compcln.exe

2011-10-16 00:49:59 94720 ----a-w- C:\Windows\System32\drivers\tdx.sys

2011-10-16 00:48:55 247808 ----a-w- C:\Windows\SysWow64\drvstore.dll

2011-10-16 00:48:49 83968 ----a-w- C:\Windows\SysWow64\wbem\wmiutils.dll

2011-10-16 00:48:49 614912 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll

2011-10-16 00:48:49 30208 ----a-w- C:\Windows\SysWow64\wbem\wbemprox.dll

2011-10-16 00:48:49 265728 ----a-w- C:\Windows\SysWow64\wbem\esscli.dll

2011-10-16 00:48:49 189440 ----a-w- C:\Windows\SysWow64\wbem\mofd.dll

2011-10-16 00:46:03 43520 ----a-w- C:\Windows\System32\wbem\wbemprox.dll

2011-10-16 00:46:02 891392 ----a-w- C:\Windows\System32\wbem\fastprox.dll

2011-10-16 00:46:02 1172992 ----a-w- C:\Windows\System32\wbem\wbemcore.dll

2011-10-16 00:45:57 936448 ----a-w- C:\Windows\System32\SmiEngine.dll

2011-10-16 00:45:47 293888 ----a-w- C:\Windows\System32\wdscore.dll

2011-10-16 00:45:47 138752 ----a-w- C:\Windows\System32\PkgMgr.exe

2011-10-16 00:45:17 315904 ----a-w- C:\Windows\System32\drvstore.dll

2011-10-15 23:26:00 -------- d-----w- C:\Users\Robin\AppData\Local\Adobe

2011-10-15 23:23:54 -------- d-----w- C:\Users\Robin\AppData\Local\ATI

2011-10-15 23:21:12 0 ----a-w- C:\Windows\ativpsrm.bin

2011-10-15 22:57:58 -------- d-----w- C:\Program Files (x86)\AMD APP

2011-10-15 22:55:55 -------- d-----w- C:\Program Files (x86)\ATI Technologies

2011-10-15 22:45:31 -------- d-----w- C:\Program Files\ATI Technologies

2011-10-15 22:45:28 -------- d-----w- C:\Program Files\ATI

2011-10-15 22:44:15 -------- d-----w- C:\ATI

2011-10-15 22:07:34 525544 ----a-w- C:\Windows\System32\deployJava1.dll

2011-10-15 21:34:10 -------- d-----w- C:\Users\Robin\AppData\Roaming\Malwarebytes

2011-10-15 21:33:27 -------- d-----w- C:\ProgramData\Malwarebytes

2011-10-15 21:33:23 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-10-15 21:33:23 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-10-15 20:53:19 -------- d-----w- C:\Program Files (x86)\VideoLAN

2011-10-15 15:48:55 -------- d-----w- C:\Users\Robin\AppData\Local\CrashDumps

2011-10-15 15:11:22 729720 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\srtsp64.sys

2011-10-15 15:11:22 451192 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\SymDS64.sys

2011-10-15 15:11:22 445560 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\symtdiv.sys

2011-10-15 15:11:22 401016 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\symnets.sys

2011-10-15 15:11:22 37496 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\srtspx64.sys

2011-10-15 15:11:22 189560 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\Ironx64.sys

2011-10-15 15:11:22 167048 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\ccSetx64.sys

2011-10-15 15:11:22 1084536 ----a-r- C:\Windows\System32\drivers\NISx64\1301010.003\SymEFA64.sys

2011-10-15 15:11:17 -------- d-----w- C:\Windows\System32\drivers\NISx64\1301010.003

2011-10-15 14:59:24 -------- d-----w- C:\ProgramData\Symantec

2011-10-15 12:01:03 442368 ----a-w- C:\Windows\System32\winhttp.dll

2011-10-15 12:01:03 377344 ----a-w- C:\Windows\SysWow64\winhttp.dll

2011-10-15 11:53:07 -------- d-----w- C:\ProgramData\PrevxCSI

2011-10-15 10:57:10 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll

2011-10-15 10:57:10 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll

2011-10-15 10:57:10 48960 ----a-w- C:\Windows\System32\netfxperf.dll

2011-10-15 10:57:10 444752 ----a-w- C:\Windows\System32\mscoree.dll

2011-10-15 10:57:10 320352 ----a-w- C:\Windows\System32\PresentationHost.exe

2011-10-15 10:57:10 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll

2011-10-15 10:57:10 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe

2011-10-15 10:57:10 1942856 ----a-w- C:\Windows\System32\dfshim.dll

2011-10-15 10:57:10 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll

2011-10-15 10:57:10 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll

2011-10-15 10:55:30 -------- d-----w- C:\Users\Robin\AppData\Local\ElevatedDiagnostics

2011-10-15 10:20:16 -------- d-----w- C:\ProgramData\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}

2011-10-15 10:14:20 4240384 ----a-w- C:\Windows\SysWow64\GameUXLegacyGDFs.dll

2011-10-15 10:14:20 4240384 ----a-w- C:\Windows\System32\GameUXLegacyGDFs.dll

2011-10-15 10:14:20 32256 ----a-w- C:\Windows\System32\Apphlpdm.dll

2011-10-15 10:14:20 28672 ----a-w- C:\Windows\SysWow64\Apphlpdm.dll

2011-10-15 09:27:53 7680 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll

2011-10-15 09:27:53 7680 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll

2011-10-15 08:51:52 294912 ----a-w- C:\Windows\System32\browserchoice.exe

2011-10-15 08:50:13 32768 ----a-w- C:\Windows\System32\nshhttp.dll

2011-10-15 08:50:13 24064 ----a-w- C:\Windows\SysWow64\nshhttp.dll

2011-10-15 08:50:11 620032 ----a-w- C:\Windows\System32\drivers\http.sys

2011-10-15 08:50:11 33792 ----a-w- C:\Windows\System32\httpapi.dll

2011-10-15 08:50:11 30720 ----a-w- C:\Windows\SysWow64\httpapi.dll

2011-10-15 08:45:56 201184 ----a-w- C:\Windows\SysWow64\winrm.vbs

2011-10-15 08:40:52 1915904 ----a-w- C:\Windows\System32\ole32.dll

2011-10-15 08:39:28 1486848 ----a-w- C:\Program Files\Windows Media Player\setup_wm.exe

2011-10-15 08:39:27 372736 ----a-w- C:\Windows\System32\unregmp2.exe

2011-10-15 08:39:27 310784 ----a-w- C:\Windows\SysWow64\unregmp2.exe

2011-10-15 08:39:27 1418752 ----a-w- C:\Program Files (x86)\Windows Media Player\setup_wm.exe

2011-10-15 08:36:45 368128 ----a-w- C:\Windows\System32\wmpdxm.dll

2011-10-15 08:36:45 313344 ----a-w- C:\Windows\SysWow64\wmpdxm.dll

2011-10-15 08:36:43 43520 ----a-w- C:\Windows\SysWow64\msdxm.tlb

2011-10-15 08:36:43 43520 ----a-w- C:\Windows\System32\msdxm.tlb

2011-10-15 08:36:43 18432 ----a-w- C:\Windows\SysWow64\amcompat.tlb

2011-10-15 08:36:43 18432 ----a-w- C:\Windows\System32\amcompat.tlb

2011-10-15 08:29:48 4699024 ----a-w- C:\Windows\System32\ntoskrnl.exe

2011-10-15 08:28:52 68096 ----a-w- C:\Program Files\Windows Mail\wabmig.exe

2011-10-15 08:28:52 66048 ----a-w- C:\Program Files (x86)\Windows Mail\wabmig.exe

2011-10-15 08:28:52 516096 ----a-w- C:\Program Files\Windows Mail\wab.exe

2011-10-15 08:28:52 515584 ----a-w- C:\Program Files (x86)\Windows Mail\wab.exe

2011-10-15 08:28:52 35328 ----a-w- C:\Program Files\Windows Mail\wabfind.dll

2011-10-15 08:28:52 33280 ----a-w- C:\Program Files (x86)\Windows Mail\wabfind.dll

2011-10-15 08:28:51 85504 ----a-w- C:\Windows\System32\csrsrv.dll

2011-10-15 08:28:51 451072 ----a-w- C:\Windows\System32\winsrv.dll

2011-10-15 08:28:49 203264 ----a-w- C:\Windows\System32\wkssvc.dll

2011-10-15 08:28:48 1251840 ----a-w- C:\Windows\System32\sdclt.exe

2011-10-15 08:28:47 97792 ----a-w- C:\Windows\System32\drivers\dfsc.sys

2011-10-14 17:44:44 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-14 16:13:55 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

2011-10-14 15:57:38 -------- d-----w- C:\Users\Robin\AppData\Local\Mozilla

2011-10-14 15:28:15 -------- d-----w- C:\Users\Robin\AppData\Local\PackageAware

2011-10-14 15:14:01 -------- d-----w- C:\Users\Robin\AppData\Local\Ahead

2011-10-14 15:11:50 -------- d-----w- C:\ProgramData\Nero

2011-10-14 15:11:50 -------- d-----w- C:\Program Files (x86)\Nero

2011-10-14 15:03:54 174200 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2011-10-14 15:03:54 -------- d-----w- C:\Program Files\Symantec

2011-10-14 15:03:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

2011-10-14 15:01:31 83264 ----a-w- C:\Windows\SysWow64\HidService.exe

2011-10-14 15:01:31 83264 ----a-w- C:\Windows\System32\HidService.exe

2011-10-14 14:59:51 98360 ----a-w- C:\Windows\SysWow64\hcwi2c32.dll

2011-10-14 14:59:51 36921 ----a-w- C:\Windows\SysWow64\hcwutl32_priv.dll

2011-10-14 14:59:51 36921 ----a-w- C:\Windows\SysWow64\hcwutl32.dll

2011-10-14 14:59:51 303160 ----a-w- C:\Windows\SysWow64\hcwpnp32_priv.dll

2011-10-14 14:59:51 262200 ----a-w- C:\Windows\SysWow64\hcwpnp32.dll

2011-10-14 14:56:31 -------- d-----w- C:\Users\Robin\AppData\Local\Google

2011-10-14 14:46:53 218624 ----a-w- C:\Windows\System32\wintrust.dll

2011-10-14 14:46:53 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll

2011-10-14 14:46:52 98304 ----a-w- C:\Windows\SysWow64\cabview.dll

2011-10-14 14:46:52 104960 ----a-w- C:\Windows\System32\cabview.dll

2011-10-14 14:45:49 -------- d-----w- C:\Users\Robin\AppData\Local\Packard Bell

2011-10-14 14:42:42 -------- d-----w- C:\Windows\oem

2011-10-14 14:37:54 -------- d-sh--we C:\ProgramData\Start-meny

2011-10-14 14:37:54 -------- d-sh--we C:\ProgramData\Skrivbord

2011-10-14 14:37:54 -------- d-sh--we C:\ProgramData\Mallar

2011-10-14 14:37:54 -------- d-sh--we C:\ProgramData\Favoriter

2011-10-14 14:37:54 -------- d-sh--we C:\ProgramData\Dokument

2011-10-14 14:37:54 -------- d-sh--we C:\Program Files\Delade filer

2011-10-14 14:37:54 -------- d-sh--we C:\Program

2011-10-14 14:37:54 -------- d-sh--we C:\Documents and Settings

.

==================== Find3M ====================

.

2011-09-14 09:47:42 60416 ----a-w- C:\Windows\System32\OVDecode64.dll

2011-09-14 09:47:40 53760 ----a-w- C:\Windows\SysWow64\OVDecode.dll

2011-09-14 09:47:22 51200 ----a-w- C:\Windows\System32\OpenCL.dll

2011-09-14 09:47:18 43520 ----a-w- C:\Windows\SysWow64\OpenCL.dll

2011-09-14 09:47:10 16652288 ----a-w- C:\Windows\System32\amdocl64.dll

2011-09-14 09:46:58 13625856 ----a-w- C:\Windows\SysWow64\amdocl.dll

2011-09-14 09:38:30 44032 ----a-w- C:\Windows\System32\amdoclcl64.dll

2011-09-14 09:38:28 37376 ----a-w- C:\Windows\SysWow64\amdoclcl.dll

2011-09-08 18:27:22 10203648 ----a-w- C:\Windows\System32\drivers\atikmdag.sys

2011-09-08 17:59:44 24229376 ----a-w- C:\Windows\System32\atio6axx.dll

2011-09-08 17:39:44 18534912 ----a-w- C:\Windows\SysWow64\atioglxx.dll

2011-09-08 17:34:20 151552 ----a-w- C:\Windows\System32\atiapfxx.exe

2011-09-08 17:34:10 732672 ----a-w- C:\Windows\SysWow64\aticfx32.dll

2011-09-08 17:32:58 862720 ----a-w- C:\Windows\System32\aticfx64.dll

2011-09-08 17:30:38 466944 ----a-w- C:\Windows\System32\ATIDEMGX.dll

2011-09-08 17:30:26 486912 ----a-w- C:\Windows\System32\atieclxx.exe

2011-09-08 17:29:56 204288 ----a-w- C:\Windows\System32\atiesrxx.exe

2011-09-08 17:28:54 120320 ----a-w- C:\Windows\System32\atitmm64.dll

2011-09-08 17:28:38 423424 ----a-w- C:\Windows\System32\atipdl64.dll

2011-09-08 17:28:32 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll

2011-09-08 17:28:22 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll

2011-09-08 17:28:18 21504 ----a-w- C:\Windows\System32\atimuixx.dll

2011-09-08 17:28:14 59392 ----a-w- C:\Windows\System32\atiedu64.dll

2011-09-08 17:28:10 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll

2011-09-08 17:24:38 4204032 ----a-w- C:\Windows\SysWow64\atidxx32.dll

2011-09-08 17:18:56 1113088 ----a-w- C:\Windows\System32\atiumd6v.dll

2011-09-08 17:18:22 1828864 ----a-w- C:\Windows\SysWow64\atiumdmv.dll

2011-09-08 17:18:08 3888640 ----a-w- C:\Windows\System32\atiumd6a.dll

2011-09-08 17:16:00 4944896 ----a-w- C:\Windows\System32\atidxx64.dll

2011-09-08 17:09:42 51200 ----a-w- C:\Windows\System32\aticalrt64.dll

2011-09-08 17:09:40 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll

2011-09-08 17:09:30 44544 ----a-w- C:\Windows\System32\aticalcl64.dll

2011-09-08 17:09:28 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll

2011-09-08 17:09:18 8723456 ----a-w- C:\Windows\System32\aticaldd64.dll

2011-09-08 17:08:24 4064768 ----a-w- C:\Windows\SysWow64\atiumdva.dll

2011-09-08 17:05:52 7331840 ----a-w- C:\Windows\SysWow64\aticaldd.dll

2011-09-08 17:05:44 4289024 ----a-w- C:\Windows\SysWow64\atiumdag.dll

2011-09-08 17:00:02 5428736 ----a-w- C:\Windows\System32\atiumd64.dll

2011-09-08 16:59:48 58880 ----a-w- C:\Windows\System32\coinst.dll

2011-09-08 16:53:20 381952 ----a-w- C:\Windows\System32\atiadlxx.dll

2011-09-08 16:53:12 270336 ----a-w- C:\Windows\SysWow64\atiadlxy.dll

2011-09-08 16:52:58 15360 ----a-w- C:\Windows\System32\atig6pxx.dll

2011-09-08 16:52:56 13312 ----a-w- C:\Windows\SysWow64\atiglpxx.dll

2011-09-08 16:52:56 13312 ----a-w- C:\Windows\System32\atiglpxx.dll

2011-09-08 16:52:54 39936 ----a-w- C:\Windows\System32\atig6txx.dll

2011-09-08 16:52:46 32768 ----a-w- C:\Windows\SysWow64\atigktxx.dll

2011-09-08 16:52:40 310784 ----a-w- C:\Windows\System32\drivers\atikmpag.sys

2011-09-08 16:52:00 40960 ----a-w- C:\Windows\System32\atiuxp64.dll

2011-09-08 16:51:54 31744 ----a-w- C:\Windows\SysWow64\atiuxpag.dll

2011-09-08 16:51:50 38912 ----a-w- C:\Windows\System32\atiu9p64.dll

2011-09-08 16:51:44 29184 ----a-w- C:\Windows\SysWow64\atiu9pag.dll

2011-09-08 16:51:28 45056 ----a-w- C:\Windows\System32\atitmp64.dll

2011-09-08 16:51:12 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll

2011-09-08 16:51:02 54784 ----a-w- C:\Windows\System32\atimpc64.dll

2011-09-08 16:51:02 54784 ----a-w- C:\Windows\System32\amdpcom64.dll

2011-09-08 16:50:54 53760 ----a-w- C:\Windows\SysWow64\atimpc32.dll

2011-09-08 16:50:54 53760 ----a-w- C:\Windows\SysWow64\amdpcom32.dll

.

============= FINISH: 15:20:13,11 ===============

screen317 · October 18, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

extro · October 19, 2011

Thank you for your reply! will start on the combofix and dds now

www.malwarebytes.org

Database version: 7982

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

2011-10-19 16:37:38

mbam-log-2011-10-19 (16-37-38).txt

Scan type: Quick scan

Objects scanned: 173044

Time elapsed: 2 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

extro · October 19, 2011

Can't install Combofix,..Ill try and explain what the windows says: ->

Error opening file for writing:

C: \ 32788R22FWJFW \ License \ iexplore.exe

Click abortion to cancel the installation

Try again to write the file or ignore to skip the file

IMAGE OF ERROR

http://tinypic.com/r/2eoi0xz/7

How my C:drive looks after the failed installation

http://tinypic.com/r/29yfprt/7

Adding DDS and attach atleast

DDS.txt

Attach.txt

extro · October 19, 2011

Sorry for all these replys, but i can find any button for edit your post. This was also how it looked while trying to install combofix

The popups are saying iexplore.exe have stopped working and internet explorer have stopped working and NirCmd have stopped working.

http://i53.tinypic.com/2qjlt79.jpg

extro · October 22, 2011

Okay, I somehow managed to get combofix to run, so got no idea if it worked properly, but here it is! combofix with a new DDS log!

ComboFix 11-10-21.06 - Robin 2011-10-21 23:59:56.1.2 - x64

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.4094.2846 [GMT 2:00]

Körs från: c:\users\Robin\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\security\Database\tmp.edb

D:\install.exe

.

(((((((((((((((((((((((( Filer skapade från 2011-09-21 till 2011-10-21 ))))))))))))))))))))))))))))))

.

2011-10-21 23:23 . 2011-10-21 23:23 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-17 17:40 . 2011-10-17 17:40 -------- d-----w- c:\program files (x86)\Nero

2011-10-17 17:39 . 2008-05-02 05:26 1414440 ----a-w- c:\windows\SysWow64\ShellManager310E2D762.dll

2011-10-17 17:12 . 2011-10-17 17:12 -------- d-----w- c:\windows\Sun

2011-10-17 17:01 . 2011-03-12 22:52 1653760 ----a-w- c:\windows\system32\XpsPrint.dll

2011-10-17 17:01 . 2011-03-12 21:55 876032 ----a-w- c:\windows\SysWow64\XpsPrint.dll

2011-10-17 14:20 . 2011-10-17 14:20 -------- d-----w- c:\windows\SysWow64\spool

2011-10-17 14:20 . 2011-10-17 14:20 -------- d-----w- c:\program files (x86)\Windows Portable Devices

2011-10-17 14:20 . 2011-10-17 14:20 -------- d-----w- c:\program files\Windows Portable Devices

2011-10-16 22:35 . 2009-10-01 01:02 30208 ----a-w- c:\windows\SysWow64\WPDShextAutoplay.exe

2011-10-16 22:21 . 2009-09-10 02:00 92672 ----a-w- c:\windows\SysWow64\UIAnimation.dll

2011-10-16 22:21 . 2009-09-10 02:07 3815424 ----a-w- c:\windows\system32\UIRibbon.dll

2011-10-16 22:21 . 2009-09-10 02:06 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2011-10-16 22:21 . 2009-09-10 02:05 103424 ----a-w- c:\windows\system32\UIAnimation.dll

2011-10-16 22:21 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\SysWow64\UIRibbon.dll

2011-10-16 22:21 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\SysWow64\UIRibbonRes.dll

2011-10-16 20:24 . 2011-02-22 14:13 288768 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll

2011-10-16 20:24 . 2011-02-22 14:47 479744 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-10-16 20:24 . 2011-02-22 13:53 1555968 ----a-w- c:\windows\system32\DWrite.dll

2011-10-16 20:24 . 2011-02-22 13:53 1149440 ----a-w- c:\windows\system32\FntCache.dll

2011-10-16 20:24 . 2011-02-22 13:33 1068544 ----a-w- c:\windows\SysWow64\DWrite.dll

2011-10-16 20:24 . 2010-05-04 19:40 316928 ----a-w- c:\windows\system32\msshsq.dll

2011-10-16 20:24 . 2010-05-04 19:13 231424 ----a-w- c:\windows\SysWow64\msshsq.dll

2011-10-16 20:24 . 2011-07-11 13:45 2048 ----a-w- c:\windows\system32\tzres.dll

2011-10-16 20:24 . 2011-07-11 13:25 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2011-10-16 20:22 . 2011-01-20 16:07 258048 ----a-w- c:\windows\SysWow64\winspool.drv

2011-10-16 20:22 . 2011-01-20 14:40 34304 ----a-w- c:\windows\system32\mfpmp.exe

2011-10-16 20:22 . 2011-01-20 16:04 98816 ----a-w- c:\windows\SysWow64\mfps.dll

2011-10-16 20:22 . 2011-08-25 16:20 735744 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-16 20:22 . 2011-08-25 16:19 332288 ----a-w- c:\windows\system32\oleacc.dll

2011-10-16 20:22 . 2011-08-25 16:15 555520 ----a-w- c:\windows\SysWow64\UIAutomationCore.dll

2011-10-16 20:22 . 2011-08-25 16:14 238080 ----a-w- c:\windows\SysWow64\oleacc.dll

2011-10-16 20:22 . 2011-08-25 13:54 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-16 20:22 . 2011-08-25 13:31 4096 ----a-w- c:\windows\SysWow64\oleaccrc.dll

2011-10-16 20:22 . 2011-08-25 16:19 847360 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-16 20:22 . 2011-08-25 16:14 563712 ----a-w- c:\windows\SysWow64\oleaut32.dll

2011-10-16 20:21 . 2011-06-17 20:14 1427344 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-10-16 20:21 . 2011-09-14 10:52 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-10-16 20:21 . 2011-09-14 10:51 2409784 ----a-w- c:\program files (x86)\Windows Mail\OESpamFilter.dat

2011-10-16 20:21 . 2011-08-03 03:00 579072 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-16 20:21 . 2011-07-29 16:01 293376 ----a-w- c:\windows\SysWow64\psisdecd.dll

2011-10-16 20:21 . 2011-07-29 16:01 217088 ----a-w- c:\windows\SysWow64\psisrndr.ax

2011-10-16 20:21 . 2011-07-29 16:00 57856 ----a-w- c:\windows\SysWow64\MSDvbNP.ax

2011-10-16 20:21 . 2011-07-29 16:00 69632 ----a-w- c:\windows\SysWow64\Mpeg2Data.ax

2011-10-16 20:21 . 2011-08-03 03:00 125952 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-16 20:21 . 2011-08-03 02:58 188416 ----a-w- c:\windows\system32\MSNP.ax

2011-10-16 20:21 . 2011-08-03 02:58 73216 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-16 20:21 . 2011-08-03 02:58 100352 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\SysWow64\ca-ES

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\SysWow64\eu-ES

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\SysWow64\vi-VN

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\system32\ca-ES

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\system32\eu-ES

2011-10-16 01:14 . 2011-10-16 01:14 -------- d-----w- c:\windows\system32\vi-VN

2011-10-16 00:54 . 2011-10-16 00:54 -------- d-----w- c:\windows\system32\EventProviders

2011-10-16 00:50 . 2009-04-11 07:11 1081856 ----a-w- c:\windows\system32\qmgr.dll

2011-10-16 00:49 . 2009-04-11 07:11 690688 ----a-w- c:\windows\system32\wpcao.dll

2011-10-16 00:48 . 2009-04-11 06:28 247808 ----a-w- c:\windows\SysWow64\drvstore.dll

2011-10-16 00:48 . 2009-04-11 06:28 83968 ----a-w- c:\windows\SysWow64\wbem\wmiutils.dll

2011-10-16 00:48 . 2009-04-11 06:28 30208 ----a-w- c:\windows\SysWow64\wbem\wbemprox.dll

2011-10-16 00:48 . 2009-04-11 06:28 189440 ----a-w- c:\windows\SysWow64\wbem\mofd.dll

2011-10-16 00:48 . 2009-04-11 06:28 614912 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll

2011-10-16 00:48 . 2009-04-11 06:28 265728 ----a-w- c:\windows\SysWow64\wbem\esscli.dll

2011-10-16 00:46 . 2009-04-11 07:11 43520 ----a-w- c:\windows\system32\wbem\wbemprox.dll

2011-10-16 00:46 . 2009-04-11 07:11 1172992 ----a-w- c:\windows\system32\wbem\wbemcore.dll

2011-10-16 00:46 . 2009-04-11 07:11 891392 ----a-w- c:\windows\system32\wbem\fastprox.dll

2011-10-16 00:45 . 2009-04-11 07:11 936448 ----a-w- c:\windows\system32\SmiEngine.dll

2011-10-16 00:45 . 2009-04-11 07:11 293888 ----a-w- c:\windows\system32\wdscore.dll

2011-10-16 00:45 . 2009-04-11 07:10 138752 ----a-w- c:\windows\system32\PkgMgr.exe

2011-10-16 00:45 . 2009-04-11 07:11 315904 ----a-w- c:\windows\system32\drvstore.dll

2011-10-15 23:21 . 2011-10-15 23:21 0 ----a-w- c:\windows\ativpsrm.bin

2011-10-15 22:57 . 2011-10-15 22:57 -------- d-----w- c:\program files (x86)\AMD APP

2011-10-15 22:55 . 2011-10-15 22:55 -------- d-----w- c:\program files (x86)\ATI Technologies

2011-10-15 22:45 . 2011-10-15 22:57 -------- d-----w- c:\program files\ATI Technologies

2011-10-15 22:45 . 2011-10-15 22:45 -------- d-----w- c:\program files\ATI

2011-10-15 22:44 . 2011-10-15 22:44 -------- d-----w- C:\ATI

2011-10-15 22:07 . 2011-10-15 22:07 525544 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-15 22:06 . 2011-10-15 22:06 -------- d-----w- c:\program files\Java

2011-10-15 21:33 . 2011-10-15 21:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-10-15 21:33 . 2011-08-31 15:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-15 20:53 . 2011-10-15 20:53 -------- d-----w- c:\program files (x86)\VideoLAN

2011-10-15 15:11 . 2011-10-15 16:20 -------- d-----w- c:\windows\system32\drivers\NISx64\1301010.003

2011-10-15 12:01 . 2009-08-24 11:47 442368 ----a-w- c:\windows\system32\winhttp.dll

2011-10-15 12:01 . 2009-08-24 11:36 377344 ----a-w- c:\windows\SysWow64\winhttp.dll

2011-10-15 12:00 . 2009-11-04 04:49 31232 ----a-w- c:\windows\system32\drivers\sv-SE\http.sys.mui

2011-10-15 12:00 . 2010-09-06 18:28 179712 ----a-w- c:\windows\system32\srvsvc.dll

2011-10-15 12:00 . 2010-09-06 18:28 12288 ----a-w- c:\windows\system32\sscore.dll

2011-10-15 12:00 . 2010-09-06 18:27 17920 ----a-w- c:\windows\system32\netevent.dll

2011-10-15 12:00 . 2010-09-06 16:20 9728 ----a-w- c:\windows\SysWow64\sscore.dll

2011-10-15 12:00 . 2010-09-06 16:19 17920 ----a-w- c:\windows\SysWow64\netevent.dll

2011-10-15 10:57 . 2009-11-08 08:55 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll

2011-10-15 10:57 . 2009-11-08 08:55 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll

2011-10-15 10:57 . 2009-11-08 08:55 48960 ----a-w- c:\windows\system32\netfxperf.dll

2011-10-15 10:57 . 2009-11-08 08:55 444752 ----a-w- c:\windows\system32\mscoree.dll

2011-10-15 10:57 . 2009-11-08 08:55 320352 ----a-w- c:\windows\system32\PresentationHost.exe

2011-10-15 10:57 . 2009-11-08 08:55 297808 ----a-w- c:\windows\SysWow64\mscoree.dll

2011-10-15 10:57 . 2009-11-08 08:55 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe

2011-10-15 10:57 . 2009-11-08 08:55 1942856 ----a-w- c:\windows\system32\dfshim.dll

2011-10-15 10:57 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll

2011-10-15 10:57 . 2009-11-08 08:55 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2011-10-15 10:14 . 2011-03-03 15:59 32256 ----a-w- c:\windows\system32\Apphlpdm.dll

2011-10-15 10:14 . 2011-03-03 15:40 28672 ----a-w- c:\windows\SysWow64\Apphlpdm.dll

2011-10-15 10:14 . 2011-03-03 14:00 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2011-10-15 10:14 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\SysWow64\GameUXLegacyGDFs.dll

2011-10-15 09:27 . 2010-10-19 04:56 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll

2011-10-15 09:27 . 2010-10-19 04:27 7680 ----a-w- c:\program files (x86)\Internet Explorer\iecompat.dll

2011-10-15 09:24 . 2009-01-08 01:20 537088 ----a-w- c:\program files\Internet Explorer\pdm.dll

2011-10-15 09:24 . 2009-01-08 01:20 358904 ----a-w- c:\program files\Internet Explorer\msdbg2.dll

2011-10-15 09:24 . 2009-01-08 01:20 355832 ----a-w- c:\program files (x86)\Internet Explorer\pdm.dll

2011-10-15 09:24 . 2009-01-08 01:20 265720 ----a-w- c:\program files (x86)\Internet Explorer\msdbg2.dll

2011-10-15 08:51 . 2010-02-24 09:28 294912 ----a-w- c:\windows\system32\browserchoice.exe

2011-10-15 08:50 . 2010-02-20 23:15 32768 ----a-w- c:\windows\system32\nshhttp.dll

2011-10-15 08:50 . 2010-02-20 23:06 24064 ----a-w- c:\windows\SysWow64\nshhttp.dll

2011-10-15 08:50 . 2010-02-20 23:14 33792 ----a-w- c:\windows\system32\httpapi.dll

2011-10-15 08:50 . 2010-02-20 23:05 30720 ----a-w- c:\windows\SysWow64\httpapi.dll

2011-10-15 08:50 . 2010-02-20 21:30 620032 ----a-w- c:\windows\system32\drivers\http.sys

2011-10-15 08:45 . 2009-08-01 06:27 201184 ----a-w- c:\windows\SysWow64\winrm.vbs

2011-10-15 08:40 . 2010-06-28 17:21 1915904 ----a-w- c:\windows\system32\ole32.dll

2011-10-15 08:39 . 2009-09-10 15:27 1486848 ----a-w- c:\program files\Windows Media Player\setup_wm.exe

2011-10-15 08:39 . 2009-09-10 15:27 372736 ----a-w- c:\windows\system32\unregmp2.exe

2011-10-15 08:39 . 2009-09-10 14:58 1418752 ----a-w- c:\program files (x86)\Windows Media Player\setup_wm.exe

2011-10-15 08:39 . 2009-09-10 14:58 310784 ----a-w- c:\windows\SysWow64\unregmp2.exe

2011-10-15 08:36 . 2009-07-15 14:47 368128 ----a-w- c:\windows\system32\wmpdxm.dll

2011-10-15 08:36 . 2009-07-15 12:39 313344 ----a-w- c:\windows\SysWow64\wmpdxm.dll

2011-10-15 08:36 . 2009-07-15 10:23 43520 ----a-w- c:\windows\system32\msdxm.tlb

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-14 09:47 . 2011-09-14 09:47 60416 ----a-w- c:\windows\system32\OVDecode64.dll

2011-09-14 09:47 . 2011-09-14 09:47 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll

2011-09-14 09:47 . 2011-09-14 09:47 51200 ----a-w- c:\windows\system32\OpenCL.dll

2011-09-14 09:47 . 2011-09-14 09:47 43520 ----a-w- c:\windows\SysWow64\OpenCL.dll

2011-09-14 09:47 . 2011-09-14 09:47 16652288 ----a-w- c:\windows\system32\amdocl64.dll

2011-09-14 09:46 . 2011-09-14 09:46 13625856 ----a-w- c:\windows\SysWow64\amdocl.dll

2011-09-14 09:38 . 2011-09-14 09:38 44032 ----a-w- c:\windows\system32\amdoclcl64.dll

2011-09-14 09:38 . 2011-09-14 09:38 37376 ----a-w- c:\windows\SysWow64\amdoclcl.dll

2011-09-08 18:27 . 2011-09-08 18:27 10203648 ----a-w- c:\windows\system32\drivers\atikmdag.sys

2011-09-08 17:59 . 2011-09-08 17:59 24229376 ----a-w- c:\windows\system32\atio6axx.dll

2011-09-08 17:39 . 2011-09-08 17:39 18534912 ----a-w- c:\windows\SysWow64\atioglxx.dll

2011-09-08 17:34 . 2011-09-08 17:34 151552 ----a-w- c:\windows\system32\atiapfxx.exe

2011-09-08 17:34 . 2011-09-08 17:34 732672 ----a-w- c:\windows\SysWow64\aticfx32.dll

2011-09-08 17:32 . 2011-09-08 17:32 862720 ----a-w- c:\windows\system32\aticfx64.dll

2011-09-08 17:30 . 2011-09-08 17:30 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll

2011-09-08 17:30 . 2011-09-08 17:30 486912 ----a-w- c:\windows\system32\atieclxx.exe

2011-09-08 17:29 . 2011-09-08 17:29 204288 ----a-w- c:\windows\system32\atiesrxx.exe

2011-09-08 17:28 . 2011-09-08 17:28 120320 ----a-w- c:\windows\system32\atitmm64.dll

2011-09-08 17:28 . 2011-09-08 17:28 423424 ----a-w- c:\windows\system32\atipdl64.dll

2011-09-08 17:28 . 2011-09-08 17:28 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll

2011-09-08 17:28 . 2011-09-08 17:28 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll

2011-09-08 17:28 . 2011-09-08 17:28 21504 ----a-w- c:\windows\system32\atimuixx.dll

2011-09-08 17:28 . 2011-09-08 17:28 59392 ----a-w- c:\windows\system32\atiedu64.dll

2011-09-08 17:28 . 2011-09-08 17:28 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll

2011-09-08 17:24 . 2011-09-08 17:24 4204032 ----a-w- c:\windows\SysWow64\atidxx32.dll

2011-09-08 17:18 . 2011-09-08 17:18 1113088 ----a-w- c:\windows\system32\atiumd6v.dll

2011-09-08 17:18 . 2011-09-08 17:18 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll

2011-09-08 17:18 . 2011-09-08 17:18 3888640 ----a-w- c:\windows\system32\atiumd6a.dll

2011-09-08 17:16 . 2011-09-08 17:16 4944896 ----a-w- c:\windows\system32\atidxx64.dll

2011-09-08 17:09 . 2011-09-08 17:09 51200 ----a-w- c:\windows\system32\aticalrt64.dll

2011-09-08 17:09 . 2011-09-08 17:09 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll

2011-09-08 17:09 . 2011-09-08 17:09 44544 ----a-w- c:\windows\system32\aticalcl64.dll

2011-09-08 17:09 . 2011-09-08 17:09 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll

2011-09-08 17:09 . 2011-09-08 17:09 8723456 ----a-w- c:\windows\system32\aticaldd64.dll

2011-09-08 17:08 . 2011-09-08 17:08 4064768 ----a-w- c:\windows\SysWow64\atiumdva.dll

2011-09-08 17:05 . 2011-09-08 17:05 7331840 ----a-w- c:\windows\SysWow64\aticaldd.dll

2011-09-08 17:05 . 2011-09-08 17:05 4289024 ----a-w- c:\windows\SysWow64\atiumdag.dll

2011-09-08 17:00 . 2011-09-08 17:00 5428736 ----a-w- c:\windows\system32\atiumd64.dll

2011-09-08 16:59 . 2011-09-08 16:59 58880 ----a-w- c:\windows\system32\coinst.dll

2011-09-08 16:53 . 2011-09-08 16:53 381952 ----a-w- c:\windows\system32\atiadlxx.dll

2011-09-08 16:53 . 2011-09-08 16:53 270336 ----a-w- c:\windows\SysWow64\atiadlxy.dll

2011-09-08 16:52 . 2011-09-08 16:52 15360 ----a-w- c:\windows\system32\atig6pxx.dll

2011-09-08 16:52 . 2011-09-08 16:52 13312 ----a-w- c:\windows\SysWow64\atiglpxx.dll

2011-09-08 16:52 . 2011-09-08 16:52 13312 ----a-w- c:\windows\system32\atiglpxx.dll

2011-09-08 16:52 . 2011-09-08 16:52 39936 ----a-w- c:\windows\system32\atig6txx.dll

2011-09-08 16:52 . 2011-09-08 16:52 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll

2011-09-08 16:52 . 2011-09-08 16:52 310784 ----a-w- c:\windows\system32\drivers\atikmpag.sys

2011-09-08 16:52 . 2011-09-08 16:52 40960 ----a-w- c:\windows\system32\atiuxp64.dll

2011-09-08 16:51 . 2011-09-08 16:51 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll

2011-09-08 16:51 . 2011-09-08 16:51 38912 ----a-w- c:\windows\system32\atiu9p64.dll

2011-09-08 16:51 . 2011-09-08 16:51 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll

2011-09-08 16:51 . 2011-09-08 16:51 45056 ----a-w- c:\windows\system32\atitmp64.dll

2011-09-08 16:51 . 2011-09-08 16:51 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2011-09-08 16:51 . 2011-09-08 16:51 54784 ----a-w- c:\windows\system32\atimpc64.dll

2011-09-08 16:51 . 2011-09-08 16:51 54784 ----a-w- c:\windows\system32\amdpcom64.dll

2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll

2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* tomma poster & legitima standardposter visas inte.

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmpcSys"="c:\program files (x86)\Packard Bell\SetupMyPC\SmpSys.exe" [2009-03-18 1160736]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2009-03-25 1840424]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 343168]

"NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\NISx64\1008000.029\SYMNDISV.SYS [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1301010.003\SYMDS64.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1301010.003\SYMEFA64.SYS [x]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\Definitions\BASHDefs\20111014.001\BHDrvx64.sys [2011-10-14 1155704]

S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1301010.003\ccSetx64.sys [x]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\Definitions\IPSDefs\20111020.030\IDSvia64.sys [2011-10-14 488568]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1301010.003\Ironx64.SYS [x]

S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NISx64\1301010.003\SYMTDIV.SYS [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

S2 NIS;Norton Internet Security.;c:\program files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe [2011-08-10 138760]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [x]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-10-13 136824]

S3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

.

Innehåll i mappen 'Schemalagda aktiviteter':

.

2011-10-21 c:\windows\Tasks\Packard Bell Customer Registration - Robin.job

- c:\program files (x86)\Packard Bell\Packard Bell Customer Registration\PBCReg.exe [2009-03-30 12:23]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-09-12 182808]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-03-10 7212576]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-03-10 1833504]

"FijiKeyboard"="c:\acer\Preload\Autorun\DRV\FIJI Keyboard\ABoard.exe" [2008-09-18 79416]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Extra genomsökning -------

.

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=041d&m=imedia_s3710&r=1v3610112706p0385vq25y4752932n

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 83.255.245.11 193.150.193.150

CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

.

HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.1.1.3\diMaster.dll\" /prefetch:1"

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

@Denied: (A 2) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

@="Shockwave Flash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

@Denied: (A 2) (Everyone)

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

@="FlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]

"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

------------------------ Andra processer som körs ------------------------

.

c:\program files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

c:\windows\system32\HidService.exe

c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\SysWOW64\IoctlSvc.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\acer\Preload\Autorun\DRV\Fiji Keyboard\AOSD.exe

c:\program files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

.

**************************************************************************

.

Sluttid: 2011-10-22 01:46:39 - datorn startades om.

ComboFix-quarantined-files.txt 2011-10-21 23:46

.

Före genomsökningen: 395 945 365 504 byte ledigt

Efter genomsökningen: 397 942 063 104 byte ledigt

.

- - End Of File - - 73863223F743CF1B144685730FA922F6

DDS!

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Robin at 1:51:09 on 2011-10-22

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.4094.2616 [GMT 2:00]

.

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

C:\Windows\system32\HidService.exe

C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe

C:\Windows\SysWOW64\IoctlSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Norton Internet Security\Engine\19.1.1.3\ccSvcHst.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\conime.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\ACER\Preload\Autorun\DRV\Fiji Keyboard\ABoard.exe

C:\Program Files (x86)\Packard Bell\SetupMyPC\SmpSys.exe

C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\ACER\Preload\Autorun\DRV\Fiji Keyboard\AOSD.exe

C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\REGSVR32.exe