Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Operating memory - Win32/Olmarik trojan - unable to clean

  1. #1
    Junior Member
    Join Date
    Oct 2009
    Posts
    6

    Default Operating memory - Win32/Olmarik trojan - unable to clean

    I'm running ESET NOD32 Antivirus, V4.0.437.0 and it detects the following:

    "Operating memory - Win32/Olmarik trojan - unable to clean"

    I'm having some intermittent problems with IE windows ads popping up - and I'm not running IE usually.

    Kind regards,
    Peter Olin

    A log from HiJackThis shows the following. Any help is greatly appreciated.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:17:50, on 2009-10-08
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16827)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Bonjour\mDNSResponder.exe
    C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
    C:\Program\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program\iTunes\iTunesHelper.exe
    C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\Free Download Manager\fdm.exe
    C:\Program\Windows Live\Messenger\msnmsgr.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program\Windows Live\Contacts\wlcomm.exe
    C:\Program\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9a157c2d-a9da-4ef1-a759-d824a4812667} - C:\WINDOWS\system32\zaregabi.dll (file missing)
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program\Free Download Manager\iefdmcks.dll
    O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\Program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [egui] "C:\Program\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [prnet] "C:\WINDOWS\system32\prnet.tmp"
    O4 - HKCU\..\Run: [ptidle] "C:\Documents and Settings\Peter\Application Data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
    O4 - HKCU\..\Run: [g[Hn7gQky] C:\Documents and Settings\Peter\Application Data\Microsoft\Windows\cvkkoaj.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
    O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
    O9 - Extra 'Tools' menuitem: &Inställningar i Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O20 - AppInit_DLLs: C:\WINDOWS\system32\polarudu.dll c:\progra~1\ThunMail\testabd.dll c:\windows\system32\miliyepa.dll
    O23 - Service: Apache2 - Apache Software Foundation - C:\Program\Apache Group\Apache2\bin\Apache.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program\Canon\CAL\CALMAIN.exe
    O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Unknown owner - C:\Program\DynDNS Updater\DynDNS.exe (file missing)
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 8700 bytes

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.



    Download GMER here by clicking download exe -button and then saving it your desktop:
    • Double-click .exe that you downloaded
    • Click rootkit-tab and then scan.
    • Don't check
      Show All
      box while scanning in progress!
    • When scanning is ready, click Copy.
    • This copies log to clipboard
    • Post log in your reply.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Oct 2009
    Posts
    6

    Default

    Hi Blade! Thanks for the response and your advise.

    FYI: Between the HiJackThis execution and log posted the other day and now, AdAware has been executed, and a Win32Trojan.Tdss (Malware) has been removed. [Files: C:\WINDOWS\system32\odrkrjmeokwtsivt.dll and opnvyunykfvpysmj.dll] NOD32 Still reports that it is finding "Operating memory - Win32/Olmarik trojan - unable to clean".

    Now back to the requested information:

    Here below is DDS.txt, and attached is Attach.zip (Zipped version of Attach.txt) as requested. I also downloaded GMER, as bfwgfo4y.exe. The results of the execution is at the end of this post.

    I've read the FAQ and tried my best to follow the guidelines supplied - all very clear and reasonable.

    Thanks guys for the great work and service you are providing.

    /Peter

    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Peter at 18:14:04,07 on 2009-10-10
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.194 [GMT 2:00]

    AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    svchost.exe
    C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Bonjour\mDNSResponder.exe
    C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
    C:\Program\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program\iTunes\iTunesHelper.exe
    C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\Free Download Manager\fdm.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program\Java\jre6\bin\jqs.exe
    C:\Program\Mozilla Firefox\firefox.exe
    C:\Program\Lavasoft\Ad-Aware\Ad-Aware.exe
    C:\Program\Apple Software Update\SoftwareUpdate.exe
    C:\Program\emacs-21.3\bin\emacs.exe
    C:\Documents and Settings\Peter\Skrivbord\Downloaded\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Page = hxxp://www.google.com
    uDefault_Page_URL = hxxp://www.euro.dell.com/
    uSearch Bar = hxxp://www.google.com/ie
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot - search & destroy\SDHelper.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
    BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: {9a157c2d-a9da-4ef1-a759-d824a4812667} - c:\windows\system32\zaregabi.dll
    BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
    BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
    EB: DF Bar: {67fcef90-073e-11de-8c30-0800200c9a66} - %SystemRoot%\system32\shdocvw.dll
    uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
    uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
    uRun: [prnet] "c:\windows\system32\prnet.tmp"
    uRun: [ptidle] "c:\documents and settings\peter\application data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
    uRun: [g[Hn7gQky] c:\documents and settings\peter\application data\microsoft\windows\cvkkoaj.exe
    uRun: [SpybotSD TeaTimer] c:\program\spybot - search & destroy\TeaTimer.exe
    mRun: [SigmatelSysTrayApp] stsystra.exe
    mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
    mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
    mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
    mRun: [pdfSaver3]
    mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
    mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
    mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
    mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
    IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
    IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
    IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot - search & destroy\SDHelper.dll
    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    AppInit_DLLs: c:\windows\system32\polarudu.dll c:\progra~1\thunmail\testabd.dll c:\windows\system32\miliyepa.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Authentication Packages = msv1_0 setuid
    LSA: Notification Packages = scecli c:\windows\system32\polarudu.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - prefs.js: browser.startup.homepage - hxxp://google.com
    FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - component: c:\program\mozilla firefox\components\dfff.dll
    FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
    FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}
    FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}

    ---- FIREFOX POLICIES ----
    c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
    c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
    c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
    R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
    S3 eati1ttx;eati1ttx;\??\c:\docume~1\victor\lokala~1\temp\eati1ttx.sys --> c:\docume~1\victor\lokala~1\temp\eati1ttx.sys [?]
    S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys --> c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys [?]
    S3 o1394bul;o1394bul;\??\c:\docume~1\victor\lokala~1\temp\o1394bul.sys --> c:\docume~1\victor\lokala~1\temp\o1394bul.sys [?]
    S3 xintelpp;xintelpp;\??\c:\docume~1\victor\lokala~1\temp\xintelpp.sys --> c:\docume~1\victor\lokala~1\temp\xintelpp.sys [?]

    =============== Created Last 30 ================

    2009-10-10 18:10 256 a---h--- C:\aaw7boot.cmd
    2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
    2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
    2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
    2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
    2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
    2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
    2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
    2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-10-08 01:09 <DIR> --d----- c:\program\ESET

    ==================== Find3M ====================

    2009-10-08 01:26 115 a------- C:\xcrashdump.dat
    2008-01-05 18:50 5,947 a------- c:\program\INSTALL.LOG
    2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
    2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
    2007-02-02 11:51 450,560 a------- c:\program\setup.exe
    2007-02-02 11:51 517 a------- c:\program\layout.bin
    2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
    2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
    2007-02-02 11:48 490 a------- c:\program\setup.ini
    2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
    2007-01-23 17:02 44 a----r-- c:\program\autorun.inf
    2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
    2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
    2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
    2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

    ============= FINISH: 18:14:39,10 ===============


    GMER 1.0.15.15125 - http://www.gmer.net
    Rootkit scan 2009-10-10 18:34:31
    Windows 5.1.2600 Service Pack 3
    Running: bfwgfo4y.exe; Driver: C:\DOCUME~1\Peter\LOKALA~1\Temp\fxtdipow.sys


    ---- System - GMER 1.0.15 ----

    SSDT 8675BCB0 ZwOpenProcess
    SSDT 8675C0D0 ZwOpenThread
    SSDT 8675C6D0 ZwSuspendProcess
    SSDT 8675C4F0 ZwSuspendThread
    SSDT 8675BEE0 ZwTerminateProcess
    SSDT 8675C310 ZwTerminateThread

    Code 86E8B7D8 ZwEnumerateKey
    Code 86EB8390 ZwFlushInstructionCache
    Code 86EA214E IofCallDriver
    Code 86DBC056 IofCompleteRequest

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 86EA2153
    .text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 86DBC05B
    PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 86EB8394
    PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 86E8B7DC

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe[1820] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
    AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
    AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

    Device \Driver\atapi \Device\Ide\IdePort0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
    Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
    Device \Driver\atapi \Device\Ide\IdePort1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

    ---- Threads - GMER 1.0.15 ----

    Thread System [4:344] 8675A930

    ---- EOF - GMER 1.0.15 ----

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hello Peter,

    IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    µTorrent
    Azureus


    I'd like you to read this thread.

    Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).



    After that:


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds.txt log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Oct 2009
    Posts
    6

    Default

    Hi!

    Thanks for the heads up on uTorrent and Azuerus.

    uTorrent - removed with Add/Remove Programs
    Azureus - Add/Remove Programs couldn't do it, and popped up a warning dialog "Couldn't load main class", as did Azureus Uninstall.exe. So I simply removed the whole Azureus folder from my C:\Programs folder. So imagine there is some leftovers around somewhere.

    • I Disabled Azureus.
    • I downloaded ComboFix to the Desktop, read the instructions.
    • I Unpuggled my network cable since my antivir is now disabled, and I'm running this heart surgeon software.
    • I closed all windows.
    • When double clicking on ComboFix.exe on my desktop I received the following Windows error pop up:


    "Windows - Ingen disk" [Translation from Swedish: "Windows - No disk"]
    Exception Processing Message c0000012 Parameters 75b4bf7c 4 75b4bf7c 75b4bf7c
    "Avbryt" "Försök igen" "Fortsätt" [Translation: "Cancel" "Try again" "Continue"]
    • I clicked "Try again", same message popup.
    • So I clicked "Continue", same message popup.
    • So I clicked "Cancel", and "Try Again" and "Cancel", and then...
    • ...finally the ComboFix Disclaimer popped up.

    • A dark blue commandwindow opens up. Tells me that it it creating a restore checkpoint. (Messages are in Swedish)
    • After a few seconds, the same Error dialog as detailed above shows up.
    • I click "Cancel" x 3
    • A progress bar shows up for a while
    • Again, I must click "Cancel" x 4
    • ComboFix wants do download Windows Recovery Console, so I plug in my network cable again.
    • A dialog shows that some rootkits are active . And lists them. I'm attaching a JPGof that dialog if you need it. A handful of random name files are listed.
    • Automatic reboot.
    • Process continues according to instructions.
    • At reboot another dialog that I always see at startup is shown. See attached JPG.


    So, here are the logs. Check attachemnts for dialogs. The one without the rootkit info translates roughly to: "One of the files in the registry had to be restored with the help of a log file or from an alternate version. The restore was performed."

    Thanks,
    Peter


    ComboFix 09-10-10.02 - Peter 2009-10-11 11:24.1.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.650 [GMT 2:00]
    Körs från: c:\documents and settings\Peter\Skrivbord\ComboFix.exe
    AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    * Skapade en ny återställningspunkt
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Peter\Application Data\digifast
    c:\documents and settings\Peter\Application Data\digifast\config.cfg
    c:\documents and settings\Peter\Local Settings\Temporary Internet Files\bestwiner.stt
    c:\documents and settings\Peter\Local Settings\Temporary Internet Files\CPV.stt
    c:\documents and settings\Peter\Local Settings\Temporary Internet Files\Cpvff.stt
    c:\documents and settings\Peter\Local Settings\Temporary Internet Files\fbk.sts
    c:\documents and settings\Peter\Mina dokument\ZbThumbnail.info
    c:\documents and settings\Victor\Start-meny\Program\Autostart\Registration .LNK
    c:\program\\setup.exe
    c:\program\autorun.inf
    c:\program\INSTALL.LOG
    c:\program\Jcore
    c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}
    c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\install.rdf
    c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}
    c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\install.rdf
    c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}
    c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\install.rdf
    c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}
    c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\install.rdf
    c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}
    c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\install.rdf
    c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}
    c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\install.rdf
    c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}
    c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\install.rdf
    c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}
    c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\install.rdf
    c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}
    c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\install.rdf
    c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}
    c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\install.rdf
    c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}
    c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\install.rdf
    c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}
    c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\install.rdf
    c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}
    c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\install.rdf
    c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}
    c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\install.rdf
    c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}
    c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\chrome.manifest
    c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\chrome\content\overlay.xul
    c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\install.rdf
    c:\program\WWShow
    c:\windows\Installer\5e9e98.msi
    c:\windows\Installer\76a0b6.msi
    c:\windows\run.log
    c:\windows\system32\drivers\ovfsthpqxfdgptkltioahfcixjxwdoetsberql.sys
    c:\windows\system32\N8BGALPv.exe.a_a
    c:\windows\system32\ovfsthhsrtqcknlkriabwuqdmmgqarpibgkipe.dat
    c:\windows\system32\ovfsthtfioxtuiwgldcanwodrkrjmeokwtsivt.dll
    c:\windows\system32\ovfsthxaixwobsxlttvdnqopnvyunykfvpysmj.dll
    c:\windows\system32\ovfsthxwbapqpakmpjxjkvnntorrnlqbehppfc.dll
    c:\windows\system32\ovfsthyrgsobkmklitfxiorgqyjskevewtrfvx.dat
    c:\windows\system32\vp_setup.exe.bat
    C:\xcrashdump.dat
    E:\install.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_ovfsthuwmybwvypibmlwvlhylkrvkinethowia


    (((((((((((((((((((((((( Filer Skapade från 2009-09-11 till 2009-10-11 ))))))))))))))))))))))))))))))
    .

    2009-10-10 20:11 . 2009-10-10 21:40 -------- d-----w- c:\program\Squeak
    2009-10-10 16:28 . 2009-10-11 08:42 -------- d-----w- C:\Downloads
    2009-10-09 22:04 . 2009-10-09 22:04 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-10-08 10:30 . 2009-10-08 10:39 -------- d-----w- c:\program\Safer Networking
    2009-10-08 08:30 . 2009-10-08 08:30 -------- d-----w- c:\program\Squeak3.8-current-win-full
    2009-10-08 08:15 . 2009-10-08 08:23 -------- d-----w- c:\program\Spybot - Search & Destroy
    2009-10-08 07:44 . 2009-10-08 07:15 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-10-08 07:15 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2009-10-08 07:11 . 2009-10-08 07:11 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-10-07 23:09 . 2009-10-07 23:11 -------- d-----w- c:\program\ESET

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-11 08:44 . 2005-08-23 01:06 -------- d-----w- c:\documents and settings\Peter\Application Data\Free Download Manager
    2009-10-11 08:23 . 2007-07-15 13:31 -------- d-----w- c:\program\uTorrent
    2009-10-09 22:04 . 2005-07-15 18:31 -------- d-----w- c:\program\Java
    2009-10-08 08:16 . 2005-09-30 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-10-08 07:09 . 2007-03-17 14:13 -------- d-----w- c:\program\Delade filer\Wise Installation Wizard
    2009-10-08 07:08 . 2005-08-04 20:46 -------- d-----w- c:\documents and settings\Peter\Application Data\Apple Computer
    2009-10-07 23:34 . 2009-05-18 20:42 -------- d-----w- c:\documents and settings\Peter\Application Data\Twain
    2009-10-07 23:28 . 2006-11-13 19:12 -------- d-----w- c:\program\NCH Swift Sound
    2009-09-23 19:47 . 2007-07-15 13:31 -------- d-----w- c:\documents and settings\Victor\Application Data\uTorrent
    2009-09-23 16:37 . 2007-12-18 19:13 -------- d-----w- c:\program\Steam
    2007-02-02 09:58 . 2007-02-02 09:58 57016 ----a-w- c:\program\data1.hdr
    2007-02-02 09:51 . 2007-02-02 09:51 517 ----a-w- c:\program\layout.bin
    2007-02-02 09:51 . 2007-02-02 09:51 1036390187 ----a-w- c:\program\data2.cab
    2007-02-02 09:48 . 2007-02-02 09:48 67332864 ----a-w- c:\program\data1.cab
    2007-02-02 09:48 . 2007-02-02 09:48 552214 ----a-w- c:\program\ISSetup.dll
    2007-02-02 09:48 . 2007-02-02 09:48 490 ----a-w- c:\program\setup.ini
    2007-01-23 15:03 . 2007-01-23 15:03 317248 ----a-r- c:\program\dxwebsetup.exe
    2006-08-07 08:09 . 2006-08-07 08:09 164784 ----a-w- c:\program\_Setup.dll
    2003-12-18 09:33 . 2007-02-02 08:01 20102 ----a-w- c:\program\Readme.txt
    2003-09-03 05:46 . 2007-08-31 13:20 10960 ----a-w- c:\program\EULA.txt
    2009-05-18 20:48 . 2009-05-18 20:48 211968 ----a-w- c:\program\mozilla firefox\components\dfff.dll
    .

    (((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Not* Tomma poster & legitima standardposter visas inte.
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Free Download Manager"="c:\program\Free Download Manager\fdm.exe" [2006-08-15 2089007]
    "MsnMsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
    "SpybotSD TeaTimer"="c:\program\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="c:\program\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE" [2004-08-25 339968]
    "ISUSPM Startup"="c:\program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "DMXLauncher"="c:\program\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
    "VaCtrl"="c:\program\VoiceAge\Common\VaCtrl.exe" [2003-08-28 90112]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-16 127037]
    "DVDLauncher"="c:\program\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
    "StartCCC"="c:\program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
    "iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2008-10-01 289576]
    "egui"="c:\program\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
    "SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-10-09 149280]
    "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\STSYSTRA.EXE [2005-03-22 339968]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 setuid

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program\\Messenger\\msmsgs.exe"=
    "c:\\Program\\SmartFTP\\SmartFTP.exe"=
    "c:\\Program\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program\\Java\\jdk1.5.0_05\\jre\\bin\\java.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\half-life 2\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\half-life 2 deathmatch\\hl2.exe"=
    "c:\\WINDOWS\\system32\\dpnsvr.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\team fortress 2\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\source sdk base\\hl2.exe"=
    "c:\\Program\\Steam\\Steam.exe"=
    "c:\\Program\\Steam\\steamapps\\bigbadfrostwolf\\source sdk base\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\lordkelvin553\\source sdk base\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\lordkelvin553\\team fortress 2\\hl2.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Documents and Settings\\Peter\\Skrivbord\\Downloaded\\utorrent.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\source sdk base 2007\\hl2.exe"=
    "c:\\Program\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\diprip warm up\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\zombie panic! source\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\synergy\\hl2.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\synergy dedicated server\\srcds.exe"=
    "c:\\Program\\Steam\\steamapps\\soffpotatisen\\insurgency\\hl2.exe"=
    "c:\\Program\\iTunes\\iTunes.exe"=
    "c:\\Program\\Spotify\\spotify.exe"=
    "c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    "c:\\Program\\iPod\\bin\\iPodService.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5900:TCP"= 5900:TCP:VNC
    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-08 64160]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-05-14 94360]
    R2 ekrn;ESET Service;c:\program\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\Lavasoft\Ad-Aware\AAWService.exe [2009-07-03 1028432]
    S3 eati1ttx;eati1ttx;\??\c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys --> c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys [?]
    S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys --> c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys [?]
    S3 o1394bul;o1394bul;\??\c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys --> c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys [?]
    S3 xintelpp;xintelpp;\??\c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys --> c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys [?]
    .
    Innehållet i mappen 'Schemalagda aktiviteter':

    2009-10-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 07:15]

    2009-10-10 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]
    .
    .
    ------- Extra genomsökning -------
    .
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE: Download all with Free Download Manager - file://c:\program\Free Download Manager\dlall.htm
    IE: Download selected with Free Download Manager - file://c:\program\Free Download Manager\dlselected.htm
    IE: Download with Free Download Manager - file://c:\program\Free Download Manager\dllink.htm
    FF - ProfilePath - c:\documents and settings\Peter\Application Data\Mozilla\Firefox\Profiles\fvazp8ky.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - prefs.js: browser.startup.homepage - hxxp://google.com
    FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - component: c:\program\Mozilla Firefox\components\dfff.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
    FF - plugin: c:\program\Unity\WebPlayer\loader\npUnity3D32.dll

    ---- FIREFOX POLICY ----
    c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
    .
    - - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

    BHO-{9a157c2d-a9da-4ef1-a759-d824a4812667} - c:\windows\system32\zaregabi.dll
    HKCU-Run-prnet - c:\windows\system32\prnet.tmp
    HKCU-Run-ptidle - c:\documents and settings\Peter\Application Data\ptidle\ptidle.exe
    HKCU-Run-g[Hn7gQky - c:\documents and settings\Peter\Application Data\Microsoft\Windows\cvkkoaj.exe
    HKLM-Run-pdfSaver3 - (no file)
    AddRemove-prnet - c:\windows\system32\prnet.tmp
    AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\UninstFl.exe
    AddRemove-TapSmartKeyLink - c:\program files\TapSmartKeyLink\Uninstall.exe
    AddRemove-digifast - c:\documents and settings\Peter\Application Data\digifast\DFUninstall.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-11 11:43
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\c34nb4c5]
    "ImagePath"="\??\c:\docume~1\Victor\LOKALA~1\Temp\gXfj7"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
    "ImagePath"="\"c:\program\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program\MySQL\MySQL Server 5.0\my.ini\" MySQL"
    .
    --------------------- DLLer som "laddats" under processer som körs ---------------------

    - - - - - - - > 'winlogon.exe'(668)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'lsass.exe'(724)
    c:\windows\system32\setuid.dll

    - - - - - - - > 'explorer.exe'(2648)
    c:\windows\system32\WPDShServiceObj.dll
    c:\program\SmartFTP\smarthook.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Andra processer som körs ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program\Bonjour\mDNSResponder.exe
    c:\program\Java\jre6\bin\jqs.exe
    c:\windows\system32\PnkBstrA.exe
    c:\program\Canon\CAL\CALMAIN.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\system32\wscntfy.exe
    c:\program\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    c:\program\iPod\bin\iPodService.exe
    c:\program\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    c:\program\Windows Live\Contacts\wlcomm.exe
    .
    **************************************************************************
    .
    Sluttid: 2009-10-11 11:50 - datorn startades om.
    ComboFix-quarantined-files.txt 2009-10-11 09:50

    Före genomsökningen: 37*019*582*464 byte ledigt
    Efter genomsökningen: 42*063*831*040 byte ledigt

    WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Peter" /noexecute=optin /fastdetect
    signature(c014c601)disk(1)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Victor" /noexecute=optin /fastdetect

    302 --- E O F --- 2009-05-16 13:01





    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Peter at 12:31:57,10 on 2009-10-11
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.379 [GMT 2:00]

    AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Bonjour\mDNSResponder.exe
    C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\stsystra.exe
    C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program\iTunes\iTunesHelper.exe
    C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program\Java\jre6\bin\jusched.exe
    C:\Program\Free Download Manager\fdm.exe
    C:\Program\Windows Live\Messenger\msnmsgr.exe
    C:\Program\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\explorer.exe
    C:\Program\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Peter\Skrivbord\Downloaded\dds.scr

    ============== Pseudo HJT Report ===============

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot - search & destroy\SDHelper.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
    BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
    BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
    uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
    uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
    uRun: [SpybotSD TeaTimer] c:\program\spybot - search & destroy\TeaTimer.exe
    mRun: [SigmatelSysTrayApp] stsystra.exe
    mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
    mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
    mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
    mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
    mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
    mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
    mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
    mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
    IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
    IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
    IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot - search & destroy\SDHelper.dll
    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Authentication Packages = msv1_0 setuid

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - prefs.js: browser.startup.homepage - hxxp://google.com
    FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - component: c:\program\mozilla firefox\components\dfff.dll
    FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
    FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
    c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
    c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
    R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
    S3 eati1ttx;eati1ttx;\??\c:\docume~1\victor\lokala~1\temp\eati1ttx.sys --> c:\docume~1\victor\lokala~1\temp\eati1ttx.sys [?]
    S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys --> c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys [?]
    S3 o1394bul;o1394bul;\??\c:\docume~1\victor\lokala~1\temp\o1394bul.sys --> c:\docume~1\victor\lokala~1\temp\o1394bul.sys [?]
    S3 xintelpp;xintelpp;\??\c:\docume~1\victor\lokala~1\temp\xintelpp.sys --> c:\docume~1\victor\lokala~1\temp\xintelpp.sys [?]

    =============== Created Last 30 ================

    2009-10-11 10:55 <DIR> a-dshr-- C:\cmdcons
    2009-10-11 10:52 229,888 a------- c:\windows\PEV.exe
    2009-10-11 10:52 161,792 a------- c:\windows\SWREG.exe
    2009-10-11 10:52 98,816 a------- c:\windows\sed.exe
    2009-10-10 22:11 <DIR> --d----- c:\program\Squeak
    2009-10-10 18:28 <DIR> --d----- C:\Downloads
    2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
    2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
    2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
    2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
    2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
    2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
    2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
    2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-10-08 01:09 <DIR> --d----- c:\program\ESET

    ==================== Find3M ====================

    2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
    2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
    2007-02-02 11:51 517 a------- c:\program\layout.bin
    2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
    2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
    2007-02-02 11:48 490 a------- c:\program\setup.ini
    2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
    2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
    2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
    2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
    2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

    ============= FINISH: 12:32:27,73 ===============

  6. #6
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again,

    Upload following file to http://www.virustotal.com and post back a link to the results:
    c:\windows\system32\setuid.dll


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Driver::
    eati1ttx
    gnwlnknb
    o1394bul
    xintelpp
    c34nb4c5
    File::
    c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys
    c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys
    c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys
    c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys
    c:\docume~1\Victor\LOKALA~1\Temp\gXfj7
    Folder::
    c:\program\uTorrent
    c:\documents and settings\Victor\Application Data\uTorrent
    DDS::
    TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000000

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Uninstall old Adobe Reader versions and get the latest one (9.1 and updates 9.1.2 & 9.1.3) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


    Uninstall your current Macromedia Shockwave Player and get the fresh one here if needed.

    Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.


    Uninstall these vulnerable Javas:
    J2SE Development Kit 5.0 Update 5
    J2SE Runtime Environment 5.0 Update 5



    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    * Go here to run an online scanner from ESET.
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
    • Click Scan
    • Wait for the scan to finish
    • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
    • Copy and paste that log as a reply to this topic, along with a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Junior Member
    Join Date
    Oct 2009
    Posts
    6

    Default

    Hi again, thanks for your service and patience.

    Now we're getting into the dirty underwear of this family computer.


    /Peter

    ESETSmartInstaller@High as downloader log:
    all ok
    # version=6
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6050
    # api_version=3.0.2
    # EOSSerial=60e7671558b70345a15643f912cb90df
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2009-10-11 08:45:05
    # local_time=2009-10-11 10:45:05 (+0100, Västeuropa, sommartid)
    # country="Sweden"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 3
    # compatibility_mode=769 62 0 32 585149176562500
    # compatibility_mode=8199 37 100 100 78312656250
    # scanned=202731
    # found=5
    # cleaned=0
    # scan_time=4801
    # nod_component=V3 Build:0x30000000
    C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\In.mbx.001 JS/TrojanDownloader.gen trojan 00000000000000000000000000000000 I
    C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\In.mbx.002 probably a variant of VBS/TrojanDropper.Zerolin trojan 00000000000000000000000000000000 I
    C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\[K9Spam].mbx multiple threats 00000000000000000000000000000000 I
    C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP832\A0269411.dll Win32/Olmarik.HJ trojan 00000000000000000000000000000000 I
    C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP832\A0269412.dll Win32/Olmarik.HJ trojan 00000000000000000000000000000000 I

  8. #8
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Please post a fresh dds.txt log too and let me know how's the system running
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  9. #9
    Junior Member
    Join Date
    Oct 2009
    Posts
    6

    Default

    Blade, thanks a lot. I really appreciate your help, and I'm on my way to the "Donate" button.

    ESET removed and no longer reports about the Olmarik Trojan.

    The system "feels" fine, but I haven't spent much time at the computer, except for running scans ,tools and whatnot the last couple of days. :-)

    And here's a fresh dds.txt log.

    Again, thanks!

    /Peter



    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Peter at 22:07:11,10 on 2009-10-13
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.522 [GMT 2:00]

    AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program\Bonjour\mDNSResponder.exe
    C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\stsystra.exe
    C:\Program\Canon\CAL\CALMAIN.exe
    C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
    C:\Program\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program\iTunes\iTunesHelper.exe
    C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program\Java\jre6\bin\jusched.exe
    C:\Program\Free Download Manager\fdm.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Documents and Settings\Peter\Skrivbord\dds.scr

    ============== Pseudo HJT Report ===============

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot~1\SDHelper.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
    BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
    BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
    uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
    uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [SigmatelSysTrayApp] stsystra.exe
    mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
    mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
    mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
    mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
    mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
    mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
    mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
    mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [SunJavaUpdateSched] c:\program\java\jre6\bin\jusched.exe
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
    IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
    IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} - c:\program\java\jre6\bin\npjpi160_15.dll
    IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot~1\SDHelper.dll
    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Authentication Packages = msv1_0 setuid

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - prefs.js: browser.startup.homepage - hxxp://google.com
    FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
    FF - component: c:\program\mozilla firefox\components\dfff.dll
    FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
    FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
    c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
    c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
    R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]

    =============== Created Last 30 ================

    2009-10-11 19:10 1,089,883 -------- c:\windows\system32\dllcache\ntprint.cat
    2009-10-11 18:14 <DIR> --d----- c:\windows\system32\XPSViewer
    2009-10-11 18:09 117,760 -------- c:\windows\system32\prntvpt.dll
    2009-10-11 18:09 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-10-11 18:09 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-10-11 18:09 575,488 -------- c:\windows\system32\xpsshhdr.dll
    2009-10-11 18:09 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-10-11 18:09 1,676,288 -------- c:\windows\system32\xpssvcs.dll
    2009-10-11 18:09 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll
    2009-10-11 18:08 <DIR> --d----- c:\windows\SxsCaPendDel
    2009-10-11 11:55 153,088 -------- c:\windows\system32\dllcache\triedit.dll
    2009-10-11 11:55 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
    2009-10-11 11:49 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
    2009-10-11 10:55 <DIR> a-dshr-- C:\cmdcons
    2009-10-11 10:52 229,888 a------- c:\windows\PEV.exe
    2009-10-11 10:52 161,792 a------- c:\windows\SWREG.exe
    2009-10-11 10:52 98,816 a------- c:\windows\sed.exe
    2009-10-10 22:11 <DIR> --d----- c:\program\Squeak
    2009-10-10 18:28 <DIR> --d----- C:\Downloads
    2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
    2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
    2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
    2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
    2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
    2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
    2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
    2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-10-08 01:09 <DIR> --d----- c:\program\ESET

    ==================== Find3M ====================

    2009-10-11 18:21 444,322 a------- c:\windows\system32\perfh01D.dat
    2009-10-11 18:21 83,620 a------- c:\windows\system32\perfc01D.dat
    2009-08-13 17:24 512,000 -------- c:\windows\system32\dllcache\jscript.dll
    2009-08-05 11:01 205,312 a------- c:\windows\system32\mswebdvd.dll
    2009-08-05 11:01 205,312 -------- c:\windows\system32\dllcache\mswebdvd.dll
    2009-07-29 06:37 119,808 a------- c:\windows\system32\t2embed.dll
    2009-07-29 06:37 81,920 a------- c:\windows\system32\fontsub.dll
    2009-07-29 06:37 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
    2009-07-29 06:37 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
    2009-07-19 15:32 3,597,824 -------- c:\windows\system32\dllcache\mshtml.dll
    2009-07-19 15:32 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll
    2009-07-17 21:04 58,880 a------- c:\windows\system32\atl.dll
    2009-07-17 21:04 58,880 -------- c:\windows\system32\dllcache\atl.dll
    2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
    2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
    2007-02-02 11:51 517 a------- c:\program\layout.bin
    2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
    2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
    2007-02-02 11:48 490 a------- c:\program\setup.ini
    2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
    2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
    2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
    2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
    2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

    ============= FINISH: 22:07:47,57 ===============

  10. #10
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Unless something shows up, here's a list of recommended final steps

    THESE STEPS ARE VERY IMPORTANT

    Let's reset system restore
    Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

    1. Turn off System Restore.
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply, and then click OK.

    2. Reboot.

    3. Turn ON System Restore.
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    UN-Check *Turn off System Restore*.
    Click Apply, and then click OK.
    NOTE: only do this ONCE,NOT on a regular basis



    Now lets uninstall ComboFix:
    • Click START then RUN
    • Now copy-paste Combofix /u in the runbox and click OK



    Please download OTC and save it to desktop.
    • Double-click OTC.exe.
    • Click the CleanUp! button.
    • Select Yes when the
      Begin cleanup Process?
      prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes, if not delete it by yourself.


    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.


    UPDATING WINDOWS AND INTERNET EXPLORER

    IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

    If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


    Make your Internet Explorer more secure

    This can be done by following these simple instructions:
    From within Internet Explorer click on the Tools menu and then click on Options.
    Click once on the Security tab
    Click once on the Internet icon so it becomes highlighted.
    Click once on the Custom Level button.
    Change the Download signed ActiveX controls to Prompt
    Change the Download unsigned ActiveX controls to Disable
    Change the Initialize and script ActiveX controls not marked as safe to Disable
    Change the Installation of desktop items to Prompt
    Change the Launching programs and files in an IFRAME to Prompt
    Change the Navigate sub-frames across different domains to Prompt
    When all these settings have been made, click on the OK button.
    If it prompts you as to whether or not you want to save the settings, press the Yes button.
    Next press the Apply button and then the OK to exit the Internet Properties page.



    The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

    • hosts file:
      • Every version of windows has a hosts file as part of them.
      • In a very basic sense, they are used to locate webpages.
      • We can customize a hosts file so that it blocks certain webpages.
      • However, it can slow down certain computers.
      • This is why using a hosts file is optional!!

      Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
      If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
      1. Click the start button (at the lower left hand corner of your screen)
      2. Click run
      3. In the dialog box, type services.msc
      4. hit enter, then locate dns client
      5. Highlight it, then double-click it.
      6. On the dropdown box, change the setting from automatic to manual.
      7. Click ok
    • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
      If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.



    Just a final reminder for you. I am trying to stress these two points.
    UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
    Make sure all of your security programs are up to date.
    Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



    Once again, please post and tell me how things are going with your system... problems etc.

    Have a great day,
    Blade
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •