Guide: Hur man blir av med "Polisen har blockerat din dator!"

3 4 5 6 7 8 9 10

Skriv svar

2013-08-19 12:07

Permalänk

Tymatt

Medlem

Registrerad: Sep 2003

●

Skrivet av CeciliaB:

Eset kanske har ändrat gränssnittet igen då, fast det syns en "länk" Advanced settings på bilden på Eset-sidan.

Kopiera FRST/FRST64-programmet från USB-minnet till skrivbordet.
Starta Anteckningar.
Kopiera alla rader i rutan:

C:\Users\Tessan\AppData\Local\Temp\C6B8.tmp
C:\Users\Tessan\AppData\Local\Temp\jar_cache4717998477342028350.tmp
C:\Users\Tessan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\31bb0695-6fab87b5
C:\Users\Tessan\AppData\Roaming\icq.dat
C:\Users\Tessan\Desktop\eaoc.tmp

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.
Spara filen på skrivbordet med namnet fixlist.txt.
Det är viktigt att både FRST/FRST64 och fixlist.txt finns på skrivbordet.

Starta FRST (32-bitars Windows) resp. FRST64 (64-bitars Windows) genom att dubbelklicka på programmet.
Klicka på knappen Fix.
Vänta tills programmet är klart.

Programmet skapar en logg Fixlog.txt på skrivbordet.
Klistra in innehållet i den i ditt svar.

Hur fungerar datorn numera?

Gå till inlägget

Det är stor skillnad! Den tar inte år på sig och starta och det lilla jag hållt på med den så känns den mycket snabbare. Får se vad ägaren till den tycker när hon får tillbaka den. Men det känns som en stor skillnad. Tack ännu en gång för all hjälp!

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-08-2013
Ran by Tessan at 2013-08-19 11:49:30 Run:2
Running from C:\Users\Tessan\Desktop
Boot Mode: Normal

==============================================

C:\Users\Tessan\AppData\Local\Temp\C6B8.tmp => Moved successfully.
C:\Users\Tessan\AppData\Local\Temp\jar_cache4717998477342028350.tmp => Moved successfully.
C:\Users\Tessan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\31bb0695-6fab87b5 => Moved successfully.
C:\Users\Tessan\AppData\Roaming\icq.dat => Moved successfully.
C:\Users\Tessan\Desktop\eaoc.tmp => Moved successfully.

==== End of Fixlog ====

Dold text

Rapportera Redigera

Citera flera Citera

2013-08-19 13:49

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Vad bra!
Då är det dags att avinstallera specialprogrammen.

1. Ladda ner avinstallationsprogrammet OTC till Skrivbordet.
http://oldtimer.geekstogo.com/OTC.exe
Dubbelklicka på filen för att starta programmet.
Tryck på knappen CleanUp! och DDS m.fl. rensningsprogram kommer att avinstalleras efter en omstart av datorn. Om något sådant program är kvar efter det så fråga hur du ska ta bort det. Ta bort eventuella loggar.

2. Förbättra skyddet i datorn, se mina Råd för en säkrare dator: http://ceciliasec.wordpress.com/rad/
Det är mycket viktigt att hålla alla småprogram i datorn uppdaterade, gamla versioner av t ex Flash, Java och Adobe Reader innehåller kända säkerhetshål, vilka kan användas av en webbsida för att infektera datorn. Jag tycker att Secunias program (länk på min webbsida) är en bra hjälp för att kontrollera hur det står till med säkerhetshål i datorn och ange vad som behöver åtgärdas.

3. Se till att få ordning på antivirusprogrammet om du inte redan fixat ett nytt.

Rapportera Redigera

Citera flera Citera

2013-08-23 23:20

Permalänk

bam777bam

Medlem

Registrerad: Aug 2013

●

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2013 01
Ran by SYSTEM on 23-08-2013 23:01:57
Running from I:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-13] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-10-12] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-11-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [322104 2009-08-20] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKU\lilla\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-10-16] (Hewlett-Packard Company)
HKU\lilla\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3674320 2013-01-08] (DT Soft Ltd)
HKU\lilla\...\Run: [Facebook Update] - C:\Users\lilla\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-07-16] (Facebook Inc.)
HKU\lilla\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876968 2013-06-20] (Skype Technologies S.A.)
HKU\lilla\...\Run: [Browser Infrastructure Helper] - C:\Users\lilla\AppData\Local\Smartbar\Application\SnapDo.exe [21024 2013-08-04] (Smartbar)
HKU\lilla\...\Winlogon: [Shell] explorer.exe,C:\Users\lilla\AppData\Roaming\AltShell.dat [34816 2013-07-08] () <==== ATTENTION
AppInit_DLLs-x32: c:\progra~2\bandoo\bndhook.dll [68088 2013-06-30] (Discordia Limited)
Lsa: [Notification Packages] scecli DPPWDFLT

==================== Services (Whitelisted) =================

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S2 Bandoo Coordinator; C:\Program Files (x86)\Bandoo\Bandoo.exe [1944056 2013-06-30] (Bandoo Media Inc.)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [126400 2011-08-03] (Symantec Corporation)
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\STacSV64.exe [240640 2009-10-12] (IDT, Inc.)
S2 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-07-10] (Wajam)
S2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
S1 ccHP; C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [593544 2011-08-03] (Symantec Corporation)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-24] (DT Soft Ltd)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-02-22] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-02-22] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-02-22] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130804.001\IDSvia64.sys [513184 2013-02-21] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130804.001\IDSvia64.sys [513184 2013-02-21] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130806.002\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130806.002\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130806.002\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130806.002\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS [505392 2010-04-21] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS [32304 2010-04-21] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [221304 2011-08-21] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2013-02-22] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [150064 2010-04-28] (Symantec Corporation)
S1 SYMTDIv; C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [451704 2011-08-21] (Symantec Corporation)
S3 RTSTOR; system32\drivers\RTSTOR.SYS [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-08-21 10:13 - 2013-08-23 12:49 - 00000004 _____ C:\Users\lilla\AppData\Roaming\AltShell.ini
2013-08-21 04:36 - 2013-08-21 04:36 - 05502496 _____ C:\Users\lilla\Downloads\freedownloadmanager.exe
2013-08-21 01:46 - 2013-08-21 01:46 - 00086535 _____ C:\Windows\unins000.dat
2013-08-21 01:46 - 2013-08-21 01:46 - 00002003 _____ C:\Users\lilla\Desktop\Video Downloader.lnk
2013-08-21 01:46 - 2013-08-21 01:46 - 00000000 ____D C:\Program Files (x86)\vGrabber-software
2013-08-21 01:46 - 2013-08-21 01:44 - 01169609 _____ C:\Windows\unins000.exe
2013-08-21 01:45 - 2013-08-21 01:45 - 00002349 _____ C:\Users\lilla\Desktop\Search.lnk
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Users\lilla\AppData\Local\Wajam
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Users\lilla\AppData\Local\Smartbar
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-08-18 02:05 - 2013-08-18 02:42 - 00000000 ____D C:\Users\lilla\Desktop\CANGREJADA
2013-08-18 01:57 - 2013-08-18 02:11 - 00000000 ____D C:\Users\lilla\Desktop\FIESTA -KRÄFTOR
2013-08-18 00:27 - 2013-08-18 00:46 - 00000000 ____D C:\Users\lilla\Desktop\103___06
2013-08-14 16:35 - 2013-07-25 21:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-14 16:35 - 2013-07-25 21:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-14 16:35 - 2013-07-25 21:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-14 16:35 - 2013-07-25 21:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-14 16:35 - 2013-07-25 21:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-14 16:35 - 2013-07-25 19:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-14 16:35 - 2013-07-25 19:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 16:35 - 2013-07-25 19:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 16:35 - 2013-07-25 19:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 16:35 - 2013-07-25 19:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 16:35 - 2013-07-25 19:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 16:35 - 2013-07-25 18:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 16:35 - 2013-07-25 18:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-14 16:35 - 2013-07-25 17:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 14:17 - 2013-07-18 17:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-14 14:17 - 2013-07-18 17:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 14:17 - 2013-07-08 21:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-14 14:17 - 2013-07-08 21:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-14 14:17 - 2013-07-08 21:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-14 14:17 - 2013-07-08 21:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-14 14:17 - 2013-07-08 20:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 14:17 - 2013-07-08 20:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 14:17 - 2013-07-08 20:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 14:17 - 2013-07-08 20:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 14:16 - 2013-07-25 01:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-14 14:16 - 2013-07-25 00:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 14:16 - 2013-07-08 22:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-14 14:16 - 2013-07-08 21:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-14 14:16 - 2013-07-08 21:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-08-14 14:16 - 2013-07-08 21:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-14 14:16 - 2013-07-08 21:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 14:16 - 2013-07-08 21:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 14:16 - 2013-07-08 20:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 14:16 - 2013-07-08 20:53 - 00034816 _____ C:\Users\lilla\AppData\Roaming\AltShell.dat
2013-08-14 14:16 - 2013-07-08 20:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 14:16 - 2013-07-08 20:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 14:16 - 2013-07-08 18:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 14:16 - 2013-07-08 18:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 14:16 - 2013-07-08 18:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 14:16 - 2013-07-08 18:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 14:16 - 2013-07-05 22:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-14 14:16 - 2013-06-14 20:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-10 08:15 - 2013-08-14 16:30 - 00000000 ____D C:\Windows\System32\MRT
2013-08-01 03:01 - 2013-08-01 03:32 - 00000000 ____D C:\Users\lilla\AppData\Roaming\Google
2013-08-01 03:01 - 2013-08-01 03:01 - 00000000 ____D C:\ProgramData\Google
2013-08-01 03:01 - 2013-08-01 03:01 - 00000000 ____D C:\Program Files\Google
2013-08-01 03:00 - 2013-08-21 13:00 - 00000868 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-01 03:00 - 2013-08-21 03:00 - 00003806 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-26 11:32 - 2013-07-26 11:32 - 01201560 _____ (Bandoo Media Inc) C:\Users\lilla\Downloads\BandooV8 (1).exe

==================== One Month Modified Files and Folders =======

2013-08-23 22:57 - 2013-08-23 22:57 - 00000000 ____D C:\FRST
2013-08-23 12:49 - 2013-08-21 10:13 - 00000004 _____ C:\Users\lilla\AppData\Roaming\AltShell.ini
2013-08-23 12:48 - 2010-01-24 11:20 - 02073257 _____ C:\Windows\WindowsUpdate.log
2013-08-23 12:45 - 2013-02-18 14:50 - 00000988 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-23 12:44 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-23 12:44 - 2009-07-13 20:51 - 00112689 _____ C:\Windows\setupact.log
2013-08-23 12:34 - 2013-02-24 11:54 - 00000000 ____D C:\Users\lilla\AppData\Roaming\Skype
2013-08-21 21:46 - 2013-02-24 12:50 - 00000000 ____D C:\Users\lilla\AppData\Local\CrashDumps
2013-08-21 13:06 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-21 13:06 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-21 13:00 - 2013-08-01 03:00 - 00000868 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-21 10:38 - 2013-02-18 14:50 - 00000992 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-21 10:09 - 2013-07-16 13:04 - 00000928 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3485792563-3203956468-4112226100-1000UA.job
2013-08-21 04:36 - 2013-08-21 04:36 - 05502496 _____ C:\Users\lilla\Downloads\freedownloadmanager.exe
2013-08-21 03:00 - 2013-08-01 03:00 - 00003806 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-21 03:00 - 2013-02-18 22:31 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 03:00 - 2013-02-18 22:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 01:46 - 2013-08-21 01:46 - 00086535 _____ C:\Windows\unins000.dat
2013-08-21 01:46 - 2013-08-21 01:46 - 00002003 _____ C:\Users\lilla\Desktop\Video Downloader.lnk
2013-08-21 01:46 - 2013-08-21 01:46 - 00000000 ____D C:\Program Files (x86)\vGrabber-software
2013-08-21 01:45 - 2013-08-21 01:45 - 00002349 _____ C:\Users\lilla\Desktop\Search.lnk
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Users\lilla\AppData\Local\Wajam
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Users\lilla\AppData\Local\Smartbar
2013-08-21 01:45 - 2013-08-21 01:45 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-08-21 01:45 - 2013-02-18 14:50 - 00000000 ____D C:\Users\lilla\AppData\Local\Google
2013-08-21 01:44 - 2013-08-21 01:46 - 01169609 _____ C:\Windows\unins000.exe
2013-08-20 13:09 - 2013-07-16 13:04 - 00000906 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3485792563-3203956468-4112226100-1000Core.job
2013-08-20 07:39 - 2013-02-18 12:06 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleForlilla.job
2013-08-20 02:02 - 2013-02-18 12:06 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleForlilla
2013-08-20 02:02 - 2013-02-18 12:04 - 00008477 _____ C:\Windows\SysWOW64\hpasset.xml
2013-08-18 02:42 - 2013-08-18 02:05 - 00000000 ____D C:\Users\lilla\Desktop\CANGREJADA
2013-08-18 02:11 - 2013-08-18 01:57 - 00000000 ____D C:\Users\lilla\Desktop\FIESTA -KRÄFTOR
2013-08-18 02:05 - 2013-06-14 11:12 - 00000000 ____D C:\Users\lilla\Desktop\blanca marg-
2013-08-18 02:00 - 2013-07-23 09:53 - 00000000 ____D C:\Users\lilla\Desktop\huerto
2013-08-18 00:46 - 2013-08-18 00:27 - 00000000 ____D C:\Users\lilla\Desktop\103___06
2013-08-17 01:12 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-08-16 05:02 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-08-14 16:32 - 2009-12-08 20:08 - 00625826 _____ C:\Windows\System32\perfh01D.dat
2013-08-14 16:32 - 2009-12-08 20:08 - 00123948 _____ C:\Windows\System32\perfc01D.dat
2013-08-14 16:32 - 2009-07-13 21:13 - 01486214 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-14 16:30 - 2013-08-10 08:15 - 00000000 ____D C:\Windows\System32\MRT
2013-08-14 16:30 - 2009-12-08 20:03 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 16:28 - 2013-02-18 13:52 - 78161360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-12 22:16 - 2013-02-18 23:17 - 00008477 _____ C:\Windows\SysWOW64\hpasset.xml.bkp
2013-08-11 22:16 - 2013-07-19 00:33 - 00000000 ____D C:\Program Files (x86)\Bandoo
2013-08-08 10:07 - 2009-07-13 21:08 - 00032514 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-01 08:22 - 2013-06-14 12:39 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-01 03:32 - 2013-08-01 03:01 - 00000000 ____D C:\Users\lilla\AppData\Roaming\Google
2013-08-01 03:08 - 2010-01-24 11:30 - 00015680 _____ C:\Windows\PFRO.log
2013-08-01 03:01 - 2013-08-01 03:01 - 00000000 ____D C:\ProgramData\Google
2013-08-01 03:01 - 2013-08-01 03:01 - 00000000 ____D C:\Program Files\Google
2013-08-01 03:01 - 2013-06-13 12:28 - 00000000 ____D C:\Users\lilla\AppData\Local\Adobe
2013-08-01 03:01 - 2013-02-18 14:50 - 00000000 ____D C:\Program Files (x86)\Google
2013-07-28 13:16 - 2013-07-23 09:53 - 00000000 ____D C:\Users\lilla\Desktop\fiesta luci
2013-07-26 11:32 - 2013-07-26 11:32 - 01201560 _____ (Bandoo Media Inc) C:\Users\lilla\Downloads\BandooV8 (1).exe
2013-07-25 21:13 - 2013-08-14 16:35 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-25 21:13 - 2013-08-14 16:35 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-25 21:13 - 2013-08-14 16:35 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-25 21:12 - 2013-08-14 16:35 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-25 21:12 - 2013-08-14 16:35 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-25 19:35 - 2013-08-14 16:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-25 19:13 - 2013-08-14 16:35 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-25 19:13 - 2013-08-14 16:35 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-25 19:12 - 2013-08-14 16:35 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-25 19:11 - 2013-08-14 16:35 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-25 19:11 - 2013-08-14 16:35 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-25 18:49 - 2013-08-14 16:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-25 18:39 - 2013-08-14 16:35 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-25 17:59 - 2013-08-14 16:35 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 01:25 - 2013-08-14 14:16 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-25 00:57 - 2013-08-14 14:16 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

Files to move or delete:
====================
C:\Users\lilla\AppData\Roaming\AltShell.dat
C:\Users\lilla\AppData\Roaming\AltShell.ini

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-07-01 15:34:08
Restore point made on: 2013-07-02 11:17:47
Restore point made on: 2013-07-10 09:03:18
Restore point made on: 2013-07-10 11:22:39
Restore point made on: 2013-08-10 08:11:53
Restore point made on: 2013-08-14 16:28:13

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3894.84 MB
Available physical RAM: 3165.76 MB
Total Pagefile: 3892.99 MB
Available Pagefile: 3168.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:273.85 GB) (Free:205.44 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (RECOVERY) (Fixed) (Total:23.95 GB) (Free:3.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
Drive i: (PENDRIVE) (Removable) (Total:3.72 GB) (Free:0.23 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: () (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 2BB00FA2)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=274 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=24 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

========================================================
Disk: 2 (Size: 4 GB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=4 GB) - (Type=0C)

LastRegBack: 2013-08-11 22:35

==================== End Of Log ============================

Dold text

Senast redigerat 2013-08-24 01:32

Rapportera Redigera

Citera flera Citera

2013-08-24 00:12

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av bam777bam:

Hej.. min mormor har fått samma problem. Snälla Cecilia hjälp.
har följt anvisningarna.
Ganska roligt när mormor frågade mig vad det var. läste genom med lite rädsla, och när det kom till porr.. vart hon lite ledsen...
fan vad de är dumma..

Gå till inlägget

Hej!

Starta Anteckningar.
Kopiera alla rader i rutan:

HKU\lilla\...\Winlogon: [Shell] explorer.exe,C:\Users\lilla\AppData\Roaming\AltShell.dat [34816 2013-07-08] () <==== ATTENTION
C:\Users\lilla\AppData\Roaming\AltShell.dat
C:\Users\lilla\AppData\Roaming\AltShell.ini

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.
Spara filen på USB-minnet med namnet fixlist.txt.

På den infekterade datorn från "System Recovery Options"
Starta FRST (32-bitars Windows) resp. FRST64 (64-bitars Windows) på samma sätt som sist.
Klicka på knappen Fix.
Vänta tills programmet är klart.

Programmet skapar en logg Fixlog.txt på USB-minnet.
Klistra in innehållet i den i ditt svar.

Se om datorn nu går att starta på vanligt sätt.
Om det går följ anvisningarna i tråden Till dig med virus eller andra skadliga program i datorn så gott det går för fortsatt rensning (vilket behövs). Använd gärna Spoiler-knappen när du klistrar in långa loggar.
Om inte får FRST ta bort lite mer.

Rapportera Redigera

Citera flera Citera

2013-08-24 01:50

Permalänk

bam777bam

Medlem

Registrerad: Aug 2013

●

Datorn Startade:)
Tack så mycket.
Läste vidare genom din länk, postar dds-logen och bifogar zipen längs ner.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16660
Run by lilla at 1:41:23 on 2013-08-24
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.46.1053.18.3895.2444 [GMT 2:00]
.
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\AESTSr64.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Users\lilla\AppData\Local\Smartbar\Application\SnapDo.exe
C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe
C:\Program Files (x86)\Bandoo\Bandoo.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearch Bar = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearch Page = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Snap.DoEngine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} -
BHO: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll
BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live inloggningshjälpen: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Wajam: {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: BandooIEPlugin Class: {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Program Files (x86)\Bandoo\Plugins\IE\ieplugin.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Snap.Do: {ae07101b-46d4-4a98-af68-0333ea26e113} -
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [Browser Infrastructure Helper] C:\Users\lilla\AppData\Local\Smartbar\Application\SnapDo.exe startup
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect121....
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i5...
DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i5...
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i5...
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{A2C2D383-78CB-47BF-975C-417B40459310} : DHCPNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
AppInit_DLLs= c:\progra~2\bandoo\bndhook.dll
SSODL: WebCheck - <orphaned>
SEH: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll
LSA: Notification Packages = scecli DPPWDFLT
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Snap.DoEngine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} -
x64-BHO: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: Snap.Do: {ae07101b-46d4-4a98-af68-0333ea26e113} -
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i5...
x64-DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i5...
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i5...
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/sw...
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: !HIDDEN! 2010-01-24 21:17; otis@digitalpersona.com; C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1109000.00C\symds64.sys [2013-2-25 433200]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1109000.00C\symefa64.sys [2013-2-25 221304]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [2013-7-17 1393240]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NISx64\1109000.00C\cchpx64.sys [2013-2-25 593544]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-2-24 283200]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130804.001\IDSviA64.sys [2013-8-6 513184]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1109000.00C\ironx64.sys [2013-2-25 150064]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\NISx64\1109000.00C\symtdiv.sys [2013-2-25 451704]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\AESTSr64.exe [2010-1-24 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-11-12 202752]
R2 ezSharedSvc;Easybits Shared Services for Windows;C:\Windows\System32\svchost.exe -k netsvcs [2009-7-14 27136]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-13 30520]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccsvchst.exe [2013-2-25 126400]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-1-24 2320920]
R2 WajamUpdater;WajamUpdater;C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [2013-7-10 109064]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2009-7-13 1924400]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-12-9 228408]
R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-6-29 70656]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-2-24 138912]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2009-10-13 151040]
R3 intelkmd;intelkmd;C:\Windows\System32\drivers\igdpmd64.sys [2009-11-12 7770048]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-21 162408]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-2-19 19456]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2010-1-24 200736]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-24 232480]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-14 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-14 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-14 740864]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-2-19 57856]
S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-2-18 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
.
=============== Created Last 30 ================
.
2013-08-24 06:57:46 -------- d-----w- C:\FRST
2013-08-23 21:26:05 -------- d-----w- C:\Users\lilla\AppData\Local\NPE
2013-08-21 09:46:17 1169609 ----a-w- C:\Windows\unins000.exe
2013-08-21 09:46:12 -------- d-----w- C:\Program Files (x86)\vGrabber-software
2013-08-21 09:45:53 -------- d-----w- C:\Users\lilla\AppData\Local\Wajam
2013-08-21 09:45:51 -------- d-----w- C:\Program Files (x86)\Wajam
2013-08-21 09:45:12 -------- d-----w- C:\Users\lilla\AppData\Local\Smartbar
2013-08-21 09:44:25 -------- d-----w- C:\Users\lilla\AppData\Local\Programs
2013-08-14 22:17:12 224256 ----a-w- C:\Windows\System32\wintrust.dll
2013-08-14 22:17:12 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-08-14 22:17:12 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
2013-08-14 22:17:12 1472512 ----a-w- C:\Windows\System32\crypt32.dll
2013-08-14 22:17:12 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-08-14 22:17:12 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-08-14 22:17:12 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-08-14 22:17:12 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-08-14 22:17:04 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2013-08-14 22:17:04 2048 ----a-w- C:\Windows\System32\tzres.dll
2013-08-10 16:15:22 -------- d-----w- C:\Windows\System32\MRT
.
==================== Find3M ====================
.
2013-08-21 11:00:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-21 11:00:12 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-07-26 05:13:37 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-07-26 05:12:08 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-07-26 05:12:04 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-07-26 05:12:03 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-07-26 03:35:08 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-07-26 03:13:24 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-07-26 03:12:04 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-07-26 03:12:00 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-07-26 03:12:00 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-07-26 02:49:14 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-07-26 02:39:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-26 01:59:38 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll
2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll
2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll
2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe
2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2013-06-15 04:32:16 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys
2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll
2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
.
============= FINISH: 1:41:37,22 ===============

Dold text

Attachen i zip.

https://dl.dropboxusercontent.com/u/47476817/attach.zip

Rapportera Redigera

Citera flera Citera

2013-08-24 02:02

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av bam777bam:

Datorn Startade:)
Tack så mycket.
Läste vidare genom din länk, postar dds-logen och bifogar zipen längs ner.

Attachen i zip.

https://dl.dropboxusercontent.com/u/47476817/attach.zip

Gå till inlägget

Vad bra!
Bara trevligt att hjälpa till

1. Vad ska det vara för antivirusprogram i fortsättning?
För nu är det ju ett gammalt Norton som inte skyddar mot dagens skadliga program.

2. Avinstallera:
Bandoo pga http://www.systemlookup.com/CLSID/62525-ieplugin_dll.html
Snap.Do http://www.systemlookup.com/CLSID/75361-mscoree_dll_MS_file.h...
Snap.Do Engine
Wajam http://www.systemlookup.com/CLSID/74615-wajam_dll_priam_bho_d...

Nedanstående är urgamla versioner med mängder av kända säkerhetshål som gör det lätt för en webbsida att infektera datorn t ex med polistrojanen. De ska avinstalleras.
Java(TM) 6 Update 15 (64-bit)
Java(TM) 6 Update 39
Java(TM) SE Development Kit 6 Update 15 (64-bit)
De flesta klarar sig bra utan Java men om man måste ha Java så är det viktigt att alltid ha senaste versionen.

3. Spara AdwCleaner av Xplode på Skrivbordet: http://general-changelog-team.fr/fr/downloads/finish/20-outil...

Stäng alla program, inklusive webbläsare.
Dubbelklicka på AdwCleaner för att starta programmet.

Klicka på Search-knappen.
Vänta tills sökningen är klar.
En rapport kommer upp, kopiera innehållet och klistra in i ditt svar.
Om rapporten inte kommer upp, så finns den även som C:\AdwCleaner[R1].txt

Rapportera Redigera

Citera flera Citera

2013-08-24 02:44

Permalänk

bam777bam

Medlem

Registrerad: Aug 2013

●

Tror att jag får förnya Norton för mormor.
Har sparat alla dessa program i en mormor usb, kommer att donera till Adwcleaner, och så hoppas jag att det inte händer igen:)
Du får gärna rekommendera program att ha!

Har avinstallerat de hål du påpekade. Det dök inte upp någon automatisk rapport, men man kunde trycka på en knapp och få upp rapporten enkelt.
Biforar rappoerten.

# AdwCleaner v3.000 - Report created 24/08/2013 at 02:25:38
# Updated 20/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : lilla - LILLA-DATOR
# Running from : C:\Users\lilla\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\searchplugins\Web Search.xml
Folder Found : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Folder Found : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\Extensions\dloejdefkancmfajekobpfoacecnhpgp
Folder Found C:\Users\lilla\AppData\Local\Temp\boost_interprocess
Folder Found C:\Users\lilla\AppData\LocalLow\Bandoo
Folder Found C:\Users\lilla\AppData\Roaming\Bandoo
Folder Found C:\Users\lilla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : HKCU\Software\SmartBar
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : [x64] HKCU\Software\SmartBar
Key Found : HKLM\Software\Bandoo
Key Found : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Found : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Found : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660

-\\ Mozilla Firefox v18.0.2 (sv-SE)

[ File : C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\prefs.js ]

Line Found : user_pref("browser.search.selectedEngine", "Web Search");

-\\ Google Chrome v28.0.1500.95

[ File : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [4869 octets] - [24/08/2013 02:25:38]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4929 octets] ##########

Dold text

Senast redigerat 2013-08-24 03:33

Rapportera Redigera

Citera flera Citera

2013-08-24 11:51

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av bam777bam:

Har avinstallerat de hål du påpekade. Det dök inte upp någon automatisk rapport, men man kunde trycka på en knapp och få upp rapporten enkelt.
Biforar rappoerten.

Gå till inlägget

Det är ingen idé att spara FRST, DDS och AdwCleaner, om det var det du menade, för de uppdateras rätt ofta för att klara av nya skadliga program och olämpliga tillägg.

Stäng alla program, inklusive webbläsare.
Dubbelklicka på AdwCleaner för att starta programmet.

Klicka på Delete-knappen.
Tryck på OK.

Datorn kommer att startas om.
En rapport kommer upp, kopiera innehållet och klistra in i ditt svar.
Om rapporten inte kommer upp, så finns den även som C:\AdwCleaner[S1].txt

Kör DDS igen och klistra in den nya DDS.txt så får vi se om det är kvar något som ska bort.

Rapportera Redigera

Citera flera Citera

2013-08-24 14:15

Permalänk

bam777bam

Medlem

Registrerad: Aug 2013

●

Ok. Men iallafall fixa Norton:)

Fanns ingen Delete knapp, men Clean.

DDS efter kört Adware clean:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16660
Run by lilla at 14:01:23 on 2013-08-24
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.46.1053.18.3895.2253 [GMT 2:00]
.
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\taskhost.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\AESTSr64.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\taskeng.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearch Bar = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearch Page = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll
BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ipsbho.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>
BHO: Windows Live inloggningshjälpen: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect121....
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{A2C2D383-78CB-47BF-975C-417B40459310} : DHCPNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll
LSA: Notification Packages = scecli DPPWDFLT
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/sw...
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=S...
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: !HIDDEN! 2010-01-24 21:17; otis@digitalpersona.com; C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1109000.00C\symds64.sys [2013-2-25 433200]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1109000.00C\symefa64.sys [2013-2-25 221304]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [2013-7-17 1393240]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NISx64\1109000.00C\cchpx64.sys [2013-2-25 593544]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-2-24 283200]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130804.001\IDSviA64.sys [2013-8-6 513184]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1109000.00C\ironx64.sys [2013-2-25 150064]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\NISx64\1109000.00C\symtdiv.sys [2013-2-25 451704]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_928ff2cce8313015\AESTSr64.exe [2010-1-24 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-11-12 202752]
R2 ezSharedSvc;Easybits Shared Services for Windows;C:\Windows\System32\svchost.exe -k netsvcs [2009-7-14 27136]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-13 30520]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccsvchst.exe [2013-2-25 126400]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-1-24 2320920]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2009-7-13 1924400]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-12-9 228408]
R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-6-29 70656]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-2-24 138912]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2009-10-13 151040]
R3 intelkmd;intelkmd;C:\Windows\System32\drivers\igdpmd64.sys [2009-11-12 7770048]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-21 162408]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-2-19 19456]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2010-1-24 200736]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-24 232480]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-14 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-14 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-14 740864]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-2-19 57856]
S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-2-18 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
.
=============== Created Last 30 ================
.
2013-08-24 06:57:46 -------- d-----w- C:\FRST
2013-08-24 00:25:14 -------- d-----w- C:\AdwCleaner
2013-08-23 21:26:05 -------- d-----w- C:\Users\lilla\AppData\Local\NPE
2013-08-21 09:46:17 1169609 ----a-w- C:\Windows\unins000.exe
2013-08-21 09:46:12 -------- d-----w- C:\Program Files (x86)\vGrabber-software
2013-08-21 09:44:25 -------- d-----w- C:\Users\lilla\AppData\Local\Programs
2013-08-14 22:17:12 224256 ----a-w- C:\Windows\System32\wintrust.dll
2013-08-14 22:17:12 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-08-14 22:17:12 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
2013-08-14 22:17:12 1472512 ----a-w- C:\Windows\System32\crypt32.dll
2013-08-14 22:17:12 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-08-14 22:17:12 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-08-14 22:17:12 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-08-14 22:17:12 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-08-14 22:17:04 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2013-08-14 22:17:04 2048 ----a-w- C:\Windows\System32\tzres.dll
2013-08-10 16:15:22 -------- d-----w- C:\Windows\System32\MRT
.
==================== Find3M ====================
.
2013-08-21 11:00:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-21 11:00:12 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-07-26 05:13:37 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-07-26 05:12:08 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-07-26 05:12:04 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-07-26 05:12:03 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-07-26 03:35:08 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-07-26 03:13:24 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-07-26 03:12:04 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-07-26 03:12:00 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-07-26 03:12:00 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-07-26 02:49:14 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-07-26 02:39:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-26 01:59:38 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll
2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll
2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll
2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe
2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2013-06-15 04:32:16 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys
2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll
2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
.
============= FINISH: 14:02:22,83 ===============

Dold text

Adware efter startat om:

# AdwCleaner v3.000 - Report created 24/08/2013 at 13:55:07
# Updated 20/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : lilla - LILLA-DATOR
# Running from : C:\Users\lilla\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\lilla\AppData\Local\Temp\boost_interprocess
Folder Deleted : C:\Users\lilla\AppData\LocalLow\Bandoo
Folder Deleted : C:\Users\lilla\AppData\Roaming\Bandoo
Folder Deleted : C:\Users\lilla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader
Folder Deleted : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Folder Deleted : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\Extensions\dloejdefkancmfajekobpfoacecnhpgp
File Deleted : C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\searchplugins\Web Search.xml

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\Software\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660

-\\ Mozilla Firefox v18.0.2 (sv-SE)

[ File : C:\Users\lilla\AppData\Roaming\Mozilla\Firefox\Profiles\hs2d3lrb.default\prefs.js ]

Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");

-\\ Google Chrome v28.0.1500.95

[ File : C:\Users\lilla\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [5041 octets] - [24/08/2013 02:25:38]
AdwCleaner[R1].txt - [5101 octets] - [24/08/2013 13:53:06]
AdwCleaner[S0].txt - [4945 octets] - [24/08/2013 13:55:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5005 octets] ##########

Dold text

Nya Attach.. råkade göra den till rar.

https://www.dropbox.com/s/88yylu9t9q4atql/Attach.rar

Rapportera Redigera

Citera flera Citera

2013-08-24 15:08

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av bam777bam:

Ok. Men iallafall fixa Norton:)

Fanns ingen Delete knapp, men Clean.

DDS efter kört Adware clean:

Nya Attach.. råkade göra den till rar.

https://www.dropbox.com/s/88yylu9t9q4atql/Attach.rar

Gå till inlägget

Tack för att du berättar att AdwCleaner har ändrat sitt användargränssnitt, jag ska uppdatera mina sparade instruktioner.

2013-08-21 09:46:12 -------- d-----w- C:\Program Files (x86)\vGrabber-software
Är det ett program som går att avinstallera?
För det verkar vara det som drog in en massa tillägg. Om det redan är avinstallerat ta bort mappen.

Kör AdwCleaner igen och se om det hittar något mer för Snap.do är inte borta helt från webbläsarna. Om den hittar något så låt programmet ta bort det också. Annars se om du själv kan ändra start- och sökmotor i Internet Explorer (Internetalternativ) och Firefox.

Rapportera Redigera

Citera flera Citera

2013-08-24 22:03

Permalänk

bam777bam

Medlem

Registrerad: Aug 2013

●

Tack för din hjälp:) Datorn fungerar! Valde att göra en återställning efter att ha backat upp det som fanns i datorn.

Rapportera Redigera

Citera flera Citera

2013-10-06 19:58

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Hur få bort denna trojan?

Skrivet av CeciliaB:

Om du har Vista eller Windows 7 kan det här vara en bra början:
Jag kommer då att gå igenom loggen som visar vad som hänt i datorn och kan ge vidare rekommendationer om vad som bör göras. Men det är inte alltid som det går att få datorn ren utan det behövs en ominstallation av Windows.

Gå till inlägget

Hejsan, detta är mitt första inlägg på forumet och hjälp är något som jag skulle uppskatta väldigt mycket. Jag råkade för någon timme sedan ut för denna "Polisen har blockerat din dator" trojan och jag tänker använda den metod som beskrivs i inlägg 14. Dessvärre har jag ingen annan internetansluten dator i hemmet och jag vet inte hur jag ska kunna klistra in genomsökningsloggen på detta forum!!?
Visserligen har jag ju internet i mobil, men det lär väl knappast hjälpa!

Hur kan jag lösa denna problematik?

Med vänlig hälsning, Danne

Rapportera Redigera

Citera flera Citera

2013-10-06 22:52

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av DanSweden84:

Hur kan jag lösa denna problematik?

Med vänlig hälsning, Danne

Gå till inlägget

Du behöver på ett eller annat sätt få ned FRST till ett USB-minne för att metoden i inlägg 14 ska fungera. Har du någon kompis som kan hjälpa dig eller tillgång till en dator på jobbet/skolan/biblioteket?

För att klistra in loggen får du öppna loggen i Anteckningar eller liknande, markera hela innehållet, kopiera det och sedan klistra in det i ditt svar här.

Rapportera Redigera

Citera flera Citera

2013-10-07 13:13

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Min loggfil lyder följande:

Skrivet av CeciliaB:

För att klistra in loggen får du öppna loggen i Anteckningar eller liknande, markera hela innehållet, kopiera det och sedan klistra in det i ditt svar här.

Gå till inlägget

Hejsan, körde din metod på min dator och fick ner loggtexten på ett USB-minne som till min förvåning inte var så svårt. Då jag bor nära mitt gamla campus så sitter jag där nu och skriver detta meddelande. Här kommer frst-loggen:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by SYSTEM on MININT-DHFD4DQ on 07-10-2013 12:15:16
Running from E:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-03-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
Winlogon\Notify\avldr: C:\Windows\system32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-05-08] (Apple Inc.)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-03] (APN)
HKLM-x32\...\Run: [APVXDWIN] - C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\APVXDWIN.EXE [1062880 2013-07-05] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] - C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\Inicio.exe [70432 2012-11-08] (Panda Security, S.L.)
HKU\Daniel\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\Daniel\...\Run: [Polar Sync] - [x]
HKU\Daniel\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-01-23] (Google Inc.)
HKU\Daniel\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-05-09] (Skype Technologies S.A.)
HKU\Daniel\...\Winlogon: [Shell] explorer.exe,C:\Users\Daniel\AppData\Roaming\data.dat [69120 2013-08-02] () <==== ATTENTION

==================== Services (Whitelisted) =================

S2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-10-03] (APN LLC.)
S2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
S2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PavFnSvr.exe [202016 2012-09-21] (Panda Security, S.L.)
S2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
S2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
S2 PSHost; c:\program files (x86)\panda security\panda internet security 2014\firewall\PSHOST.EXE [226560 2009-11-26] (Panda Security International)
S2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
S2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\TPSrvWow.exe [173344 2012-11-16] (Panda Security, S.L.)

==================== Drivers (Whitelisted) ====================

S2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
S2 APPFLT; C:\Windows\system32\Drivers\APPFLT64.SYS [129096 2011-01-31] (Panda Security, S.L.)
S2 ComFiltr; C:\Windows\system32\DRIVERS\COMFiltr.sys [15928 2013-08-20] ()
S2 ComFiltr; C:\Windows\system32\DRIVERS\COMFiltr.sys [15928 2013-08-20] ()
S2 DSAFLT; C:\Windows\system32\Drivers\DSAFLT64.SYS [82952 2009-09-25] (Panda Security, S.L.)
S2 FNETMON; C:\Windows\system32\Drivers\fnetm64.SYS [31752 2009-09-25] (Panda Security, S.L.)
S3 fsccsys1346927715; C:\Windows\System32\drivers\fsccsys.sys [58424 2012-09-28] (F-Secure Corporation)
S2 IDSFLT; C:\Windows\system32\Drivers\IDSFLT64.SYS [78920 2010-09-09] (Panda Security, S.L.)
S3 MosIrUsb; C:\Windows\System32\DRIVERS\MosIrUsb.sys [27648 2007-10-11] ()
S2 NETFLTDI; C:\Windows\system32\Drivers\NETTDI64.SYS [170504 2009-09-25] (Panda Security, S.L.)
S3 NETIMFLT01060044; C:\Windows\System32\DRIVERS\n64i1644.sys [216648 2010-09-01] (Panda Security, S.L.)
S0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S3 Tdsshbecr; C:\Windows\System32\DRIVERS\shbecr.sys [50176 2008-09-23] (Todos Data System AB)
S2 WNMFLT; C:\Windows\system32\Drivers\WNMFLT64.SYS [74760 2009-09-25] (Panda Security, S.L.)
S3 ALSysIO; \??\C:\Users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x]
S3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-10-07 12:14 - 2013-10-07 12:14 - 00000000 ____D C:\FRST
2013-10-06 16:50 - 2013-10-06 17:01 - 00000004 _____ C:\Users\Daniel\AppData\Roaming\settings.ini
2013-10-06 09:35 - 2013-10-06 09:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{20E41D17-6D52-4C0C-9C6C-1E117155FEA4}
2013-10-05 10:15 - 2013-10-05 10:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch (1)
2013-10-05 10:15 - 2013-10-05 10:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch
2013-10-05 09:28 - 2013-10-05 21:29 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E76AC3B8-9BE0-4291-B5A6-AE3FF26C925B}
2013-10-04 20:40 - 2013-10-04 20:41 - 00000000 ____D C:\Users\Daniel\Documents\asylbluffen
2013-10-04 15:01 - 2013-10-05 15:09 - 00000000 ____D C:\Users\Daniel\Desktop\Jämlikhet_Valfrihet
2013-10-04 11:23 - 2013-10-04 11:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{727F2F58-483A-4E68-A304-A7F4CE48149B}
2013-10-03 20:37 - 2013-10-03 20:37 - 00055296 _____ C:\Users\Daniel\Downloads\be0101tab8samdrag.xls
2013-10-03 20:37 - 2013-10-03 20:37 - 00055296 _____ C:\Users\Daniel\Desktop\be0101tab8samdrag.xls
2013-10-03 10:15 - 2013-10-03 22:15 - 00000000 ____D C:\Users\Daniel\AppData\Local\{AD8D387F-D880-46AD-BEF4-FF0E22832C77}
2013-10-02 10:35 - 2013-10-02 10:36 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37ABE325-99C4-49BB-A63A-30D3F9DF2D8F}
2013-10-01 17:25 - 2013-10-01 17:28 - 00000123 _____ C:\Users\Daniel\Documents\kartläggning_skäggunge.txt
2013-10-01 10:35 - 2013-10-01 22:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B0F54D90-2821-485D-A5CD-4AEAE7292539}
2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9BCC706F-CA89-4DF4-8FBC-094F878058D4}
2013-09-29 23:13 - 2013-09-29 23:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{619E8892-7F9F-4AAD-8D85-147DC30A31F1}
2013-09-29 09:40 - 2013-09-29 09:41 - 00000000 ____D C:\Users\Daniel\AppData\Local\{60F5DC28-FF38-43D7-A278-E1462A4B0EFC}
2013-09-28 20:30 - 2013-09-28 20:30 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB5104EC-2E79-4DE3-808D-4DF6040AE0CC}
2013-09-27 11:03 - 2013-09-27 23:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2698CEE1-2922-42ED-B7D5-EAB4F96133D3}
2013-09-26 14:09 - 2013-09-27 00:07 - 00000509 _____ C:\Users\Daniel\Desktop\skicka.txt
2013-09-26 11:02 - 2013-09-26 23:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{209B0934-DBE6-4355-B1D4-11C38C2A0ADA}
2013-09-25 11:02 - 2013-09-25 23:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2528D32C-C20E-449E-BFD7-9DD9FDE2F933}
2013-09-24 20:31 - 2013-09-24 20:31 - 00000204 _____ C:\Users\Daniel\Downloads\the-complete-infidel-s-guide-to-the-koran-pdf.zip
2013-09-24 15:39 - 2013-09-24 15:39 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B93F8400-D709-4A03-B622-A41CC4667BB6}
2013-09-12 10:50 - 2013-08-10 06:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 10:50 - 2013-08-10 06:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 10:50 - 2013-08-10 06:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 10:50 - 2013-08-10 06:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 10:50 - 2013-08-10 06:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 10:50 - 2013-08-10 06:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 10:50 - 2013-08-10 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 10:50 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 10:50 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 10:50 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 10:50 - 2013-08-10 04:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 10:50 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 10:50 - 2013-08-10 03:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 10:50 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 09:38 - 2013-08-08 02:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 09:38 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 09:38 - 2013-08-02 03:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-09-12 09:38 - 2013-08-02 03:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-09-12 09:38 - 2013-08-02 03:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2013-09-12 09:38 - 2013-08-02 03:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-09-12 09:38 - 2013-08-02 03:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2013-09-12 09:38 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 09:38 - 2013-08-02 03:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2013-09-12 09:38 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 09:38 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 09:38 - 2013-08-02 02:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 09:38 - 2013-08-02 02:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 09:38 - 2013-08-02 02:51 - 00069120 _____ C:\Users\Daniel\AppData\Roaming\data.dat
2013-09-12 09:38 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 09:38 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 09:38 - 2013-08-02 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 09:38 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe
2013-09-12 09:38 - 2013-08-02 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 09:38 - 2013-08-02 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 09:38 - 2013-08-02 01:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 09:38 - 2013-08-02 01:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 09:38 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 09:38 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 09:38 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 09:38 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 09:38 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 09:38 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 15:29 - 2013-09-11 15:29 - 00329728 _____ C:\Users\Daniel\Downloads\Telenor_02 (1).vsd
2013-09-11 11:09 - 2013-09-11 23:10 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B258C3AE-67B8-471F-973B-900FD7A02C20}
2013-09-10 11:09 - 2013-09-10 23:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB02D81C-514A-486D-AD47-47560A35226D}
2013-09-09 09:34 - 2013-09-09 21:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E1C359C0-FEB9-400B-9A19-6209542C1A89}
2013-09-08 09:32 - 2013-09-08 21:33 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A4C83DAE-F7E2-4959-85AB-99542FDE243F}

==================== One Month Modified Files and Folders =======

2013-10-07 12:14 - 2013-10-07 12:14 - 00000000 ____D C:\FRST
2013-10-06 17:03 - 2013-08-21 10:17 - 00000068 _____ C:\Windows\System32\Drivers\etc\NetFlt.cfg.bck
2013-10-06 17:03 - 2013-08-21 10:17 - 00000068 _____ C:\Windows\System32\Drivers\etc\NetFlt.cfg
2013-10-06 17:02 - 2013-08-21 10:17 - 00000072 _____ C:\Windows\System32\Drivers\etc\NetAR.wlt.bck
2013-10-06 17:02 - 2013-08-21 10:17 - 00000072 _____ C:\Windows\System32\Drivers\etc\NetAR.wlt
2013-10-06 17:02 - 2013-08-21 10:16 - 00000120 _____ C:\Windows\System32\Drivers\etc\NetAdapt.cfg.bck
2013-10-06 17:02 - 2013-08-21 10:16 - 00000120 _____ C:\Windows\System32\Drivers\etc\NetAdapt.cfg
2013-10-06 17:02 - 2012-04-18 09:05 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-06 17:02 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-06 17:02 - 2009-07-14 05:51 - 00089939 _____ C:\Windows\setupact.log
2013-10-06 17:01 - 2013-10-06 16:50 - 00000004 _____ C:\Users\Daniel\AppData\Roaming\settings.ini
2013-10-06 17:00 - 2013-08-21 10:19 - 00000080 _____ C:\Windows\System32\Drivers\etc\NetLoc.wlt.bck
2013-10-06 17:00 - 2013-08-21 10:19 - 00000080 _____ C:\Windows\System32\Drivers\etc\NetLoc.wlt
2013-10-06 17:00 - 2013-08-21 10:17 - 00000252 _____ C:\Windows\System32\Drivers\etc\IdsFlt.cfg.bck
2013-10-06 17:00 - 2013-08-21 10:17 - 00000252 _____ C:\Windows\System32\Drivers\etc\IdsFlt.cfg
2013-10-06 17:00 - 2013-08-21 10:17 - 00000056 _____ C:\Windows\System32\Drivers\etc\WnmFlt.cfg.bck
2013-10-06 17:00 - 2013-08-21 10:17 - 00000056 _____ C:\Windows\System32\Drivers\etc\WnmFlt.cfg
2013-10-06 17:00 - 2013-08-21 10:17 - 00000056 _____ C:\Windows\System32\Drivers\etc\DsaFlt.cfg.bck
2013-10-06 17:00 - 2013-08-21 10:17 - 00000056 _____ C:\Windows\System32\Drivers\etc\DsaFlt.cfg
2013-10-06 17:00 - 2013-08-20 23:33 - 00303044 _____ C:\Windows\System32\Drivers\etc\DsaFlt.rls.bck
2013-10-06 17:00 - 2013-08-20 23:33 - 00303044 _____ C:\Windows\System32\Drivers\etc\DsaFlt.rls
2013-10-06 17:00 - 2013-08-20 23:33 - 00001132 _____ C:\Windows\System32\Drivers\APPFLTR.CFG.bck
2013-10-06 17:00 - 2013-08-20 23:33 - 00001132 _____ C:\Windows\System32\Drivers\APPFLTR.CFG
2013-10-06 16:59 - 2013-08-18 12:30 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-10-06 16:59 - 2013-08-18 12:30 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-10-06 16:59 - 2013-08-18 12:30 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-10-06 16:59 - 2012-07-19 11:50 - 00000990 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-06 16:59 - 2012-05-21 18:08 - 00000000 ____D C:\Users\Daniel\Tracing
2013-10-06 16:39 - 2013-01-23 21:09 - 00000868 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-06 16:07 - 2012-07-19 11:50 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-06 15:44 - 2012-04-18 09:04 - 01833497 _____ C:\Windows\WindowsUpdate.log
2013-10-06 09:41 - 2009-07-14 05:45 - 00021872 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-06 09:41 - 2009-07-14 05:45 - 00021872 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-06 09:37 - 2013-08-20 23:33 - 00317096 _____ C:\Windows\System32\Drivers\APPFCONT.DAT.bck
2013-10-06 09:37 - 2013-08-20 23:33 - 00317096 _____ C:\Windows\System32\Drivers\APPFCONT.DAT
2013-10-06 09:35 - 2013-10-06 09:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{20E41D17-6D52-4C0C-9C6C-1E117155FEA4}
2013-10-05 21:29 - 2013-10-05 09:28 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E76AC3B8-9BE0-4291-B5A6-AE3FF26C925B}
2013-10-05 20:09 - 2013-01-23 21:09 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-05 15:09 - 2013-10-04 15:01 - 00000000 ____D C:\Users\Daniel\Desktop\Jämlikhet_Valfrihet
2013-10-05 10:15 - 2013-10-05 10:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch (1)
2013-10-05 10:15 - 2013-10-05 10:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch
2013-10-04 22:28 - 2012-04-29 11:42 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\SoftGrid Client
2013-10-04 20:41 - 2013-10-04 20:40 - 00000000 ____D C:\Users\Daniel\Documents\asylbluffen
2013-10-04 19:47 - 2012-12-18 15:23 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2013-10-04 11:23 - 2013-10-04 11:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{727F2F58-483A-4E68-A304-A7F4CE48149B}
2013-10-03 22:15 - 2013-10-03 10:15 - 00000000 ____D C:\Users\Daniel\AppData\Local\{AD8D387F-D880-46AD-BEF4-FF0E22832C77}
2013-10-03 20:37 - 2013-10-03 20:37 - 00055296 _____ C:\Users\Daniel\Downloads\be0101tab8samdrag.xls
2013-10-03 20:37 - 2013-10-03 20:37 - 00055296 _____ C:\Users\Daniel\Desktop\be0101tab8samdrag.xls
2013-10-02 10:36 - 2013-10-02 10:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37ABE325-99C4-49BB-A63A-30D3F9DF2D8F}
2013-10-01 22:35 - 2013-10-01 10:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B0F54D90-2821-485D-A5CD-4AEAE7292539}
2013-10-01 17:28 - 2013-10-01 17:25 - 00000123 _____ C:\Users\Daniel\Documents\kartläggning_skäggunge.txt
2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9BCC706F-CA89-4DF4-8FBC-094F878058D4}
2013-09-30 10:52 - 2012-07-10 21:37 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\vlc
2013-09-29 23:14 - 2013-09-29 23:13 - 00000000 ____D C:\Users\Daniel\AppData\Local\{619E8892-7F9F-4AAD-8D85-147DC30A31F1}
2013-09-29 09:41 - 2013-09-29 09:40 - 00000000 ____D C:\Users\Daniel\AppData\Local\{60F5DC28-FF38-43D7-A278-E1462A4B0EFC}
2013-09-28 20:30 - 2013-09-28 20:30 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB5104EC-2E79-4DE3-808D-4DF6040AE0CC}
2013-09-27 23:04 - 2013-09-27 11:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2698CEE1-2922-42ED-B7D5-EAB4F96133D3}
2013-09-27 00:07 - 2013-09-26 14:09 - 00000509 _____ C:\Users\Daniel\Desktop\skicka.txt
2013-09-26 23:03 - 2013-09-26 11:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{209B0934-DBE6-4355-B1D4-11C38C2A0ADA}
2013-09-25 23:02 - 2013-09-25 11:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2528D32C-C20E-449E-BFD7-9DD9FDE2F933}
2013-09-24 20:31 - 2013-09-24 20:31 - 00000204 _____ C:\Users\Daniel\Downloads\the-complete-infidel-s-guide-to-the-koran-pdf.zip
2013-09-24 18:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-09-24 15:55 - 2013-08-20 23:36 - 00008627 _____ C:\Windows\SysWOW64\PAV_FOG.OPC
2013-09-24 15:39 - 2013-09-24 15:39 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B93F8400-D709-4A03-B622-A41CC4667BB6}
2013-09-24 15:39 - 2013-01-23 21:09 - 00003806 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 15:39 - 2012-04-18 09:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 15:39 - 2012-03-15 10:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-24 15:37 - 2009-07-14 05:45 - 00285296 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 10:50 - 2012-04-29 11:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-12 10:50 - 2012-03-15 10:54 - 01622912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-12 10:50 - 2010-11-21 12:38 - 00669914 _____ C:\Windows\System32\perfh01D.dat
2013-09-12 10:50 - 2010-11-21 12:38 - 00145252 _____ C:\Windows\System32\perfc01D.dat
2013-09-12 10:48 - 2013-09-01 00:30 - 79143768 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-09-12 10:48 - 2013-09-01 00:30 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 10:48 - 2012-10-10 23:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 09:54 - 2009-07-14 06:13 - 01598668 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-11 23:10 - 2013-09-11 11:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B258C3AE-67B8-471F-973B-900FD7A02C20}
2013-09-11 15:29 - 2013-09-11 15:29 - 00329728 _____ C:\Users\Daniel\Downloads\Telenor_02 (1).vsd
2013-09-10 23:09 - 2013-09-10 11:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB02D81C-514A-486D-AD47-47560A35226D}
2013-09-09 21:34 - 2013-09-09 09:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E1C359C0-FEB9-400B-9A19-6209542C1A89}
2013-09-09 11:06 - 2013-09-01 23:37 - 00000100 _____ C:\Users\Daniel\Desktop\35345.txt
2013-09-08 22:54 - 2013-08-14 14:39 - 00000000 ____D C:\Users\Daniel\Documents\My Digital Editions
2013-09-08 21:33 - 2013-09-08 09:32 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A4C83DAE-F7E2-4959-85AB-99542FDE243F}
2013-09-07 21:32 - 2013-09-06 10:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{0BBBF807-3E43-4EA1-B286-AC8A6FF04319}
2013-09-07 12:57 - 2012-08-05 20:29 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\tixati
2013-09-07 12:57 - 2012-04-29 20:51 - 00000000 ____D C:\Musik
2013-09-07 12:30 - 2012-05-23 13:37 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps

Files to move or delete:
====================
C:\Users\Daniel\AppData\Roaming\data.dat
C:\Users\Daniel\AppData\Roaming\settings.ini
C:\Users\Daniel\AppData\Roaming\i.ini

Some content of TEMP:
====================
C:\Users\Daniel\AppData\Local\Temp\fscEE13.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\fsprod.dll
C:\Users\Daniel\AppData\Local\Temp\fssfm.dll
C:\Users\Daniel\AppData\Local\Temp\gismyyrrsrtgicsftjr.bfg
C:\Users\Daniel\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Daniel\AppData\Local\Temp\PCloudCleanerUpdater.exe
C:\Users\Daniel\AppData\Local\Temp\preconfig.exe
C:\Users\Daniel\AppData\Local\Temp\vlc-2.0.2-win32.exe

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

6
Restore point made on: 2013-08-31 19:20:07
Restore point made on: 2013-09-01 00:30:02
Restore point made on: 2013-09-05 10:18:48
Restore point made on: 2013-09-12 10:45:25
Restore point made on: 2013-09-24 18:32:02
Restore point made on: 2013-10-01 18:38:27

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8189.22 MB
Available physical RAM: 7361.25 MB
Total Pagefile: 8187.42 MB
Available Pagefile: 7371.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1863.01 GB) (Free:1747.69 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: () (Removable) (Total:0.48 GB) (Free:0.26 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 17578220)
Partition 1: (Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 496 MB) (Disk ID: 820C7766)
Partition 1: (Active) - (Size=496 MB) - (Type=0B)

LastRegBack: 2013-10-01 18:31

==================== End Of Log ============================

Rapportera Redigera

Citera flera Citera

2013-10-07 13:59

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av DanSweden84:

Gå till inlägget

Starta Anteckningar.
Kopiera alla rader i rutan:

HKU\Daniel\...\Winlogon: [Shell] explorer.exe,C:\Users\Daniel\AppData\Roaming\data.dat [69120 2013-08-02] () <==== ATTENTION 
C:\Users\Daniel\AppData\Roaming\data.dat
C:\Users\Daniel\AppData\Roaming\settings.ini
C:\Users\Daniel\AppData\Roaming\i.ini

och klistra in i Anteckningar. Kontrollera att inga filer har delats upp på två rader.
Spara filen på USB-minnet med namnet fixlist.txt.

På den infekterade datorn
Starta FRST på samma sätt som sist.
Klicka på knappen Fix.
Vänta tills programmet är klart.

Programmet skapar en logg Fixlog.txt på USB-minnet.
Klistra in innehållet i den i ditt svar.

Se om det går att starta datorn normalt.
I så fall är det dags att fortsätta kontrollen av datorn därifrån. För det är inte alls säkert att datorn är ren bara för att man inte märker av polistrojanen, dessutom behöver man kolla vad för säkerhetshål det finns i datorn eftersom polistrojanen brukar utnyttja såna.

PS. Folk i forumet uppskattar om man lägger i loggar innanför spoiler-taggar.

Rapportera Redigera

Citera flera Citera

2013-10-07 20:13

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Skrivet av CeciliaB:

Gå till inlägget

So far, so good. Kom in normalt på datorn nu igen, och postar härmed fixloggen:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
Ran by SYSTEM at 2013-10-07 19:48:00 Run:1
Running from E:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Daniel\...\Winlogon: [Shell] explorer.exe,C:\Users\Daniel\AppData\Roaming\data.dat [69120 2013-08-02] () <==== ATTENTION
C:\Users\Daniel\AppData\Roaming\data.dat
C:\Users\Daniel\AppData\Roaming\settings.ini
C:\Users\Daniel\AppData\Roaming\i.ini
*****************

HKU\Daniel\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Daniel\AppData\Roaming\data.dat => Moved successfully.
C:\Users\Daniel\AppData\Roaming\settings.ini => Moved successfully.
"C:\Users\Daniel\AppData\Roaming\i.ini" => File/Directory not found.

==== End of Fixlog ====

Dold text

Att använda Adwcleaner som det länkas till i inlägg #156, kan det vara ett bra nästa steg?
Känner på mig att det behövs en del jobb för att min dator skall vara säker framöver.
Hur som helst, tack för den hittills erhållna hjälpen, det var riktigt skönt att kunna logga in som vanligt igen

Rapportera Redigera

Citera flera Citera

2013-10-07 21:33

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Bra!

AdwCleaner är för att ta bort olämpliga/skadliga tillägg i webbläsaren och än vet jag inte om det finns några sådana i din dator. AdwCleaner har ingen verkan när det gäller polistrojanen.

1. Kopiera FRST från USB-minnet till skrivbordet och kör det igen. Denna gång kommer två loggar att skapas. Klistra in båda två i ditt svar här innan du fortsätter med punkt 2.

2. Skanna datorn online på http://www.eset.com/onlinescan/
För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Avbocka alternativet Remove found threats
Bocka för Scan Archives

Klicka på Advanced Settings
Bocka för:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Klicka på Scan

När skanningen är klar klicka på List of threats found, följt av Export to a text file. Spara till en fil på skrivbordet, öppna filen, kopiera resultatet och klistra sedan in det i ditt svar.

3. Polistrojanen kommer oftast in genom gamla programversioner med säkerhetshål. Låt Secunias Software Inspector kolla upp datorn och fixa de problem som den rapporterar. Den engelska sidan http://www.bleepingcomputer.com/tutorials/detect-vulnerable-p... beskriver hur man installerar och använder programmet.

Rapportera Redigera

Citera flera Citera

2013-10-07 21:47

Permalänk

Qwal

Medlem

Plats: Banananana
Registrerad: Apr 2008

●

Skrivet av upr0426:

Steg 10: Kommer upp något licensavtals skit bara tryck acceptera

Gå till inlägget

Gav mig ett stort skratt, bästa meningen i en hjälp tråd någonsin! "asg"

Rapportera Redigera

Citera flera Citera

2013-10-07 21:56

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

FRST genomkört

Skrivet av CeciliaB:

1. Kopiera FRST från USB-minnet till skrivbordet och kör det igen. Denna gång kommer två loggar att skapas. Klistra in båda två i ditt svar här innan du fortsätter med punkt 2.

Gå till inlägget

Sådär, har just kört FRST. Lägger upp huvudloggen här och tilläggsloggen i inlägget nedan:

FRST(huvudloggen)

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Daniel (administrator) on DANIELS_DATOR on 07-10-2013 21:40:55
Running from C:\Users\Daniel\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PskSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\TPSrvWow.exe
(Panda Security) C:\PROGRAM FILES (X86)\PANDA SECURITY\PANDA INTERNET SECURITY 2014\WebProxy.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsCtrls.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PavFnSvr.exe
(Panda Security, S.L.) C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\pavsrvx86.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\AVENGINE.EXE
(Panda Security International) c:\program files (x86)\panda security\panda internet security 2014\firewall\PSHOST.EXE
(Panda Security S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsImSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Technology Nexus AB) C:\Program Files (x86)\Personal\bin\Personal.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\ApVxdWin.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\SRVLOAD.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PavBckPT.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\consent.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\UPGRADER.EXE
(Panda Security S.L.) C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\avciman.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
() C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-03-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
Winlogon\Notify\avldr: C:\Windows\system32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
HKCU\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKCU\...\Run: [Polar Sync] - [x]
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-01-23] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-05-09] (Skype Technologies S.A.)
MountPoints2: {1e986297-9b69-11e1-97eb-50e549c61993} - E:\iStudio.exe
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-05-08] (Apple Inc.)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-03] (APN)
HKLM-x32\...\Run: [APVXDWIN] - C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\APVXDWIN.EXE [1062880 2013-07-05] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] - C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\Inicio.exe [70432 2012-11-08] (Panda Security, S.L.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://se.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4E9BF6871644CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = sv-SE
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HDvid Codec V1 - {11111111-1111-1111-1111-110311431162} - C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-bho.dll (installdaddy)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.co...
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 213.80.98.2 213.80.101.3

FireFox:
========
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @se.nexus/Personal - C:\Program Files (x86)\Personal\bin\np_prsnl.dll (Technology Nexus AB)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: hdvc3 - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\profiles\extensions\hdvc3@hdvidcodec.com.xpi

Chrome:
=======
CHR HomePage: hxxp://www.search.ask.com/?p2=%5EB7N%5EYYYYYY%5EYY%5ESE&gct=h...
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Ask Search) - http://www.search.ask.com/web?p2=%5EB7N%5EYYYYYY%5EYY%5ESE&gc...
CHR DefaultSuggestURL: (Ask Search) - http://ss.websearch.ask.com/query?qsrc={qsrc}&li=ff&sstype=pr...
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Nexus Personal) - C:\Program Files (x86)\Personal\bin\np_prsnl.dll (Technology Nexus AB)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (Ask Toolbar) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajabnoiehionljhjpclogplgillib\24.59711_0
CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (HDvid Codec 3) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnllcmllkjofnojidnaknldfehfhehoo\3.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [aaaajabnoiehionljhjpclogplgillib] - C:\ProgramData\AskPartnerNetwork\Toolbar\CME-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-10-03] (APN LLC.)
R2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
R2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PavFnSvr.exe [202016 2012-09-21] (Panda Security, S.L.)
R2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
R2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
R2 PSHost; c:\program files (x86)\panda security\panda internet security 2014\firewall\PSHOST.EXE [226560 2009-11-26] (Panda Security International)
R2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
R2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
R2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\TPSrvWow.exe [173344 2012-11-16] (Panda Security, S.L.)

==================== Drivers (Whitelisted) ====================

R2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
R2 APPFLT; C:\Windows\system32\Drivers\APPFLT64.SYS [129096 2011-01-31] (Panda Security, S.L.)
R2 ComFiltr; C:\Windows\system32\DRIVERS\COMFiltr.sys [15928 2013-08-21] ()
R2 ComFiltr; C:\Windows\system32\DRIVERS\COMFiltr.sys [15928 2013-08-21] ()
R2 DSAFLT; C:\Windows\system32\Drivers\DSAFLT64.SYS [82952 2009-09-25] (Panda Security, S.L.)
R2 FNETMON; C:\Windows\system32\Drivers\fnetm64.SYS [31752 2009-09-25] (Panda Security, S.L.)
S3 fsccsys1346927715; C:\Windows\System32\drivers\fsccsys.sys [58424 2012-09-28] (F-Secure Corporation)
R2 IDSFLT; C:\Windows\system32\Drivers\IDSFLT64.SYS [78920 2010-09-09] (Panda Security, S.L.)
S3 MosIrUsb; C:\Windows\System32\DRIVERS\MosIrUsb.sys [27648 2007-10-11] ()
R2 NETFLTDI; C:\Windows\system32\Drivers\NETTDI64.SYS [170504 2009-09-25] (Panda Security, S.L.)
R3 NETIMFLT01060044; C:\Windows\System32\DRIVERS\n64i1644.sys [216648 2010-09-01] (Panda Security, S.L.)
R0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
R1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S3 Tdsshbecr; C:\Windows\System32\DRIVERS\shbecr.sys [50176 2008-09-23] (Todos Data System AB)
R2 WNMFLT; C:\Windows\system32\Drivers\WNMFLT64.SYS [74760 2009-09-25] (Panda Security, S.L.)
S3 ALSysIO; \??\C:\Users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-10-07 21:39 - 2013-10-06 18:53 - 01954124 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2013-10-07 19:54 - 2013-10-07 19:55 - 00000000 ____D C:\Users\Daniel\AppData\Local\{D48B2B0D-ABEA-484C-A996-B926FB38B8BC}
2013-10-07 13:14 - 2013-10-07 13:14 - 00000000 ____D C:\FRST
2013-10-06 10:35 - 2013-10-06 10:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{20E41D17-6D52-4C0C-9C6C-1E117155FEA4}
2013-10-05 11:15 - 2013-10-05 11:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch (1)
2013-10-05 11:15 - 2013-10-05 11:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch
2013-10-05 10:28 - 2013-10-05 22:29 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E76AC3B8-9BE0-4291-B5A6-AE3FF26C925B}
2013-10-04 21:40 - 2013-10-04 21:41 - 00000000 ____D C:\Users\Daniel\Documents\asylbluffen
2013-10-04 16:01 - 2013-10-05 16:09 - 00000000 ____D C:\Users\Daniel\Desktop\Jämlikhet_Valfrihet
2013-10-04 12:23 - 2013-10-04 12:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{727F2F58-483A-4E68-A304-A7F4CE48149B}
2013-10-03 21:37 - 2013-10-03 21:37 - 00055296 _____ C:\Users\Daniel\Downloads\be0101tab8samdrag.xls
2013-10-03 21:37 - 2013-10-03 21:37 - 00055296 _____ C:\Users\Daniel\Desktop\be0101tab8samdrag.xls
2013-10-03 11:15 - 2013-10-03 23:15 - 00000000 ____D C:\Users\Daniel\AppData\Local\{AD8D387F-D880-46AD-BEF4-FF0E22832C77}
2013-10-02 11:35 - 2013-10-02 11:36 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37ABE325-99C4-49BB-A63A-30D3F9DF2D8F}
2013-10-01 18:25 - 2013-10-01 18:28 - 00000123 _____ C:\Users\Daniel\Documents\kartläggning_skäggunge.txt
2013-10-01 11:35 - 2013-10-01 23:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B0F54D90-2821-485D-A5CD-4AEAE7292539}
2013-09-30 12:14 - 2013-09-30 12:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9BCC706F-CA89-4DF4-8FBC-094F878058D4}
2013-09-30 00:13 - 2013-09-30 00:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{619E8892-7F9F-4AAD-8D85-147DC30A31F1}
2013-09-29 10:40 - 2013-09-29 10:41 - 00000000 ____D C:\Users\Daniel\AppData\Local\{60F5DC28-FF38-43D7-A278-E1462A4B0EFC}
2013-09-28 21:30 - 2013-09-28 21:30 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB5104EC-2E79-4DE3-808D-4DF6040AE0CC}
2013-09-27 12:03 - 2013-09-28 00:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2698CEE1-2922-42ED-B7D5-EAB4F96133D3}
2013-09-26 15:09 - 2013-09-27 01:07 - 00000509 _____ C:\Users\Daniel\Desktop\skicka.txt
2013-09-26 12:02 - 2013-09-27 00:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{209B0934-DBE6-4355-B1D4-11C38C2A0ADA}
2013-09-25 12:02 - 2013-09-26 00:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2528D32C-C20E-449E-BFD7-9DD9FDE2F933}
2013-09-24 21:31 - 2013-09-24 21:31 - 00000204 _____ C:\Users\Daniel\Downloads\the-complete-infidel-s-guide-to-the-koran-pdf.zip
2013-09-24 16:39 - 2013-09-24 16:39 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B93F8400-D709-4A03-B622-A41CC4667BB6}
2013-09-12 11:50 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 11:50 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 11:50 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 11:50 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 11:50 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 11:50 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 11:50 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 11:50 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 11:50 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 11:50 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 11:50 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 11:50 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 11:50 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 11:50 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 10:38 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:38 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:38 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:38 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:38 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:38 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:38 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:38 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:38 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:38 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:38 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:38 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:38 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:38 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:38 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:38 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:38 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:38 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:38 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:38 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:38 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:38 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:38 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:38 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:38 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:38 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:38 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 16:29 - 2013-09-11 16:29 - 00329728 _____ C:\Users\Daniel\Downloads\Telenor_02 (1).vsd
2013-09-11 12:09 - 2013-09-12 00:10 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B258C3AE-67B8-471F-973B-900FD7A02C20}
2013-09-10 12:09 - 2013-09-11 00:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB02D81C-514A-486D-AD47-47560A35226D}
2013-09-09 10:34 - 2013-09-09 22:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E1C359C0-FEB9-400B-9A19-6209542C1A89}
2013-09-08 10:32 - 2013-09-08 22:33 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A4C83DAE-F7E2-4959-85AB-99542FDE243F}

==================== One Month Modified Files and Folders =======

2013-10-07 21:40 - 2013-08-21 00:33 - 00319860 _____ C:\Windows\system32\Drivers\APPFCONT.DAT.bck
2013-10-07 21:40 - 2013-08-21 00:33 - 00319860 _____ C:\Windows\system32\Drivers\APPFCONT.DAT
2013-10-07 21:39 - 2013-01-23 22:09 - 00000868 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-07 21:08 - 2012-04-18 10:04 - 01856924 _____ C:\Windows\WindowsUpdate.log
2013-10-07 21:07 - 2012-07-19 12:50 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-07 20:00 - 2009-07-14 06:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 20:00 - 2009-07-14 06:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 19:59 - 2010-11-21 13:38 - 00669914 _____ C:\Windows\system32\perfh01D.dat
2013-10-07 19:59 - 2010-11-21 13:38 - 00145252 _____ C:\Windows\system32\perfc01D.dat
2013-10-07 19:59 - 2009-07-14 07:13 - 01598668 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-07 19:55 - 2013-10-07 19:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{D48B2B0D-ABEA-484C-A996-B926FB38B8BC}
2013-10-07 19:55 - 2013-08-21 11:19 - 00000080 _____ C:\Windows\system32\Drivers\etc\NetLoc.wlt.bck
2013-10-07 19:55 - 2013-08-21 11:19 - 00000080 _____ C:\Windows\system32\Drivers\etc\NetLoc.wlt
2013-10-07 19:55 - 2013-08-21 11:17 - 00000252 _____ C:\Windows\system32\Drivers\etc\IdsFlt.cfg.bck
2013-10-07 19:55 - 2013-08-21 11:17 - 00000252 _____ C:\Windows\system32\Drivers\etc\IdsFlt.cfg
2013-10-07 19:55 - 2013-08-21 11:17 - 00000068 _____ C:\Windows\system32\Drivers\etc\NetFlt.cfg.bck
2013-10-07 19:55 - 2013-08-21 11:17 - 00000068 _____ C:\Windows\system32\Drivers\etc\NetFlt.cfg
2013-10-07 19:55 - 2013-08-21 11:17 - 00000056 _____ C:\Windows\system32\Drivers\etc\WnmFlt.cfg.bck
2013-10-07 19:55 - 2013-08-21 11:17 - 00000056 _____ C:\Windows\system32\Drivers\etc\WnmFlt.cfg
2013-10-07 19:55 - 2013-08-21 11:17 - 00000056 _____ C:\Windows\system32\Drivers\etc\DsaFlt.cfg.bck
2013-10-07 19:55 - 2013-08-21 11:17 - 00000056 _____ C:\Windows\system32\Drivers\etc\DsaFlt.cfg
2013-10-07 19:55 - 2013-08-21 11:16 - 00000120 _____ C:\Windows\system32\Drivers\etc\NetAdapt.cfg.bck
2013-10-07 19:55 - 2013-08-21 11:16 - 00000120 _____ C:\Windows\system32\Drivers\etc\NetAdapt.cfg
2013-10-07 19:55 - 2013-08-21 00:33 - 00303044 _____ C:\Windows\system32\Drivers\etc\DsaFlt.rls.bck
2013-10-07 19:55 - 2013-08-21 00:33 - 00303044 _____ C:\Windows\system32\Drivers\etc\DsaFlt.rls
2013-10-07 19:55 - 2013-08-21 00:33 - 00001132 _____ C:\Windows\system32\Drivers\APPFLTR.CFG.bck
2013-10-07 19:55 - 2013-08-21 00:33 - 00001132 _____ C:\Windows\system32\Drivers\APPFLTR.CFG
2013-10-07 19:55 - 2012-12-18 16:23 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2013-10-07 19:54 - 2012-05-21 19:08 - 00000000 ____D C:\Users\Daniel\Tracing
2013-10-07 19:54 - 2009-07-14 06:51 - 00090029 _____ C:\Windows\setupact.log
2013-10-07 19:53 - 2013-08-21 11:17 - 00000060 _____ C:\Windows\system32\Drivers\etc\NetAR.wlt.bck
2013-10-07 19:53 - 2013-08-21 11:17 - 00000060 _____ C:\Windows\system32\Drivers\etc\NetAR.wlt
2013-10-07 19:53 - 2013-08-18 13:30 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-10-07 19:53 - 2013-08-18 13:30 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-10-07 19:53 - 2013-08-18 13:30 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-10-07 19:53 - 2012-07-19 12:50 - 00000990 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-07 19:52 - 2012-04-18 10:05 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-07 19:52 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-07 13:14 - 2013-10-07 13:14 - 00000000 ____D C:\FRST
2013-10-06 18:53 - 2013-10-07 21:39 - 01954124 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2013-10-06 10:35 - 2013-10-06 10:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{20E41D17-6D52-4C0C-9C6C-1E117155FEA4}
2013-10-05 22:29 - 2013-10-05 10:28 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E76AC3B8-9BE0-4291-B5A6-AE3FF26C925B}
2013-10-05 21:09 - 2013-01-23 22:09 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-05 16:09 - 2013-10-04 16:01 - 00000000 ____D C:\Users\Daniel\Desktop\Jämlikhet_Valfrihet
2013-10-05 11:15 - 2013-10-05 11:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch (1)
2013-10-05 11:15 - 2013-10-05 11:15 - 00088209 _____ C:\Users\Daniel\Downloads\watch
2013-10-04 23:28 - 2012-04-29 12:42 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\SoftGrid Client
2013-10-04 21:41 - 2013-10-04 21:40 - 00000000 ____D C:\Users\Daniel\Documents\asylbluffen
2013-10-04 12:23 - 2013-10-04 12:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{727F2F58-483A-4E68-A304-A7F4CE48149B}
2013-10-03 23:15 - 2013-10-03 11:15 - 00000000 ____D C:\Users\Daniel\AppData\Local\{AD8D387F-D880-46AD-BEF4-FF0E22832C77}
2013-10-03 21:37 - 2013-10-03 21:37 - 00055296 _____ C:\Users\Daniel\Downloads\be0101tab8samdrag.xls
2013-10-03 21:37 - 2013-10-03 21:37 - 00055296 _____ C:\Users\Daniel\Desktop\be0101tab8samdrag.xls
2013-10-02 11:36 - 2013-10-02 11:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37ABE325-99C4-49BB-A63A-30D3F9DF2D8F}
2013-10-01 23:35 - 2013-10-01 11:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B0F54D90-2821-485D-A5CD-4AEAE7292539}
2013-10-01 18:28 - 2013-10-01 18:25 - 00000123 _____ C:\Users\Daniel\Documents\kartläggning_skäggunge.txt
2013-09-30 12:14 - 2013-09-30 12:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9BCC706F-CA89-4DF4-8FBC-094F878058D4}
2013-09-30 11:52 - 2012-07-10 22:37 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\vlc
2013-09-30 00:14 - 2013-09-30 00:13 - 00000000 ____D C:\Users\Daniel\AppData\Local\{619E8892-7F9F-4AAD-8D85-147DC30A31F1}
2013-09-29 10:41 - 2013-09-29 10:40 - 00000000 ____D C:\Users\Daniel\AppData\Local\{60F5DC28-FF38-43D7-A278-E1462A4B0EFC}
2013-09-28 21:30 - 2013-09-28 21:30 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB5104EC-2E79-4DE3-808D-4DF6040AE0CC}
2013-09-28 00:04 - 2013-09-27 12:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2698CEE1-2922-42ED-B7D5-EAB4F96133D3}
2013-09-27 01:07 - 2013-09-26 15:09 - 00000509 _____ C:\Users\Daniel\Desktop\skicka.txt
2013-09-27 00:03 - 2013-09-26 12:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{209B0934-DBE6-4355-B1D4-11C38C2A0ADA}
2013-09-26 00:02 - 2013-09-25 12:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{2528D32C-C20E-449E-BFD7-9DD9FDE2F933}
2013-09-24 21:31 - 2013-09-24 21:31 - 00000204 _____ C:\Users\Daniel\Downloads\the-complete-infidel-s-guide-to-the-koran-pdf.zip
2013-09-24 19:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-24 16:55 - 2013-08-21 00:36 - 00008627 _____ C:\Windows\SysWOW64\PAV_FOG.OPC
2013-09-24 16:39 - 2013-09-24 16:39 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B93F8400-D709-4A03-B622-A41CC4667BB6}
2013-09-24 16:39 - 2013-01-23 22:09 - 00003806 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 16:39 - 2012-04-18 10:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 16:39 - 2012-03-15 11:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-24 16:38 - 2012-04-24 16:33 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-24 16:38 - 2012-04-24 16:33 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-24 16:37 - 2009-07-14 06:45 - 00285296 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 11:50 - 2013-09-01 01:30 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 11:50 - 2012-04-29 12:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-12 11:50 - 2012-03-15 11:54 - 01622912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-12 11:48 - 2013-09-01 01:30 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 11:48 - 2012-10-11 00:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 00:10 - 2013-09-11 12:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B258C3AE-67B8-471F-973B-900FD7A02C20}
2013-09-11 16:29 - 2013-09-11 16:29 - 00329728 _____ C:\Users\Daniel\Downloads\Telenor_02 (1).vsd
2013-09-11 00:09 - 2013-09-10 12:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DB02D81C-514A-486D-AD47-47560A35226D}
2013-09-09 22:34 - 2013-09-09 10:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E1C359C0-FEB9-400B-9A19-6209542C1A89}
2013-09-09 12:06 - 2013-09-02 00:37 - 00000100 _____ C:\Users\Daniel\Desktop\35345.txt
2013-09-08 23:54 - 2013-08-14 15:39 - 00000000 ____D C:\Users\Daniel\Documents\My Digital Editions
2013-09-08 22:33 - 2013-09-08 10:32 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A4C83DAE-F7E2-4959-85AB-99542FDE243F}
2013-09-07 22:32 - 2013-09-06 11:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{0BBBF807-3E43-4EA1-B286-AC8A6FF04319}
2013-09-07 13:57 - 2012-08-05 21:29 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\tixati
2013-09-07 13:57 - 2012-04-29 21:51 - 00000000 ____D C:\Musik
2013-09-07 13:30 - 2012-05-23 14:37 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps

==================== Bamital & volsnap Check =================

LastRegBack: 2013-10-01 19:31

==================== End Of Log ============================

Dold text

Rapportera Redigera

Citera flera Citera

2013-10-07 21:59

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Tilläggsloggen

Skrivet av CeciliaB:

1. Kopiera FRST från USB-minnet till skrivbordet och kör det igen. Denna gång kommer två loggar att skapas. Klistra in båda två i ditt svar här innan du fortsätter med punkt 2.

Gå till inlägget

Addition(Tilläggsloggen)

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013
Ran by Daniel at 2013-10-07 21:42:31
Running from C:\Users\Daniel\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Panda Internet Security 2014 (Enabled - Up to date) {86971480-9989-6750-B122-681A86518D59}
AS: Panda Internet Security 2014 (Enabled - Up to date) {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Panda Personal Firewall 2014 (Enabled) {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

==================== Installed Programs ======================

ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)
Adobe Digital Editions 2.0 (x32 Version: 2.0.1)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Reader X (10.1.8) - Svenska (x32 Version: 10.1.8)
Apple Application Support (x32 Version: 2.1.5)
Apple Software Update (x32 Version: 2.1.3.127)
Ask Toolbar (x32 Version: 12.5.1.1394)
BankID säkerhetsprogram (x32 Version: 4.19.0)
Brother HL-5250DN (x32 Version: 1.00)
D3DX10 (x32 Version: 15.4.2368.0902)
Etron USB3.0 Host Controller (x32 Version: 0.109)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)
Google Chrome (x32 Version: 30.0.1599.69)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
Google Update Helper (x32 Version: 1.3.21.153)
Handelsbankens kortläsare (x32 Version: 1.00.0000)
HDvid Codec V1 (x32 Version: 1.27.153.8)
HDVidCodec (x32 Version: 2.1 Build 26473)
Java Auto Updater (x32 Version: 2.0.7.1)
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klicka-och-kör 2010 (Version: 14.0.4763.1000)
Microsoft Office Klicka-och-kör 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Starter 2010 - svenska (x32 Version: 14.0.5128.5002)
Microsoft Office Visio 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Visio MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Visio Professional 2007 (x32 Version: 12.0.6612.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
NVIDIA 3D Vision drivrutin 311.06 (Version: 311.06)
NVIDIA 3D Vision drivrutin för styrenhet 296.10 (Version: 296.10)
NVIDIA Grafikdrivrutin 311.06 (Version: 311.06)
NVIDIA HD audiodrivrutin 1.3.12.0 (Version: 1.3.12.0)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.12.0213)
NVIDIA PhysX systemprogramvara 9.12.0213 (Version: 9.12.0213)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Update Components (Version: 1.11.3)
NVIDIAs kontrollpanel 311.06 (Version: 311.06)
NVIDIA-uppdatering 1.11.3 (Version: 1.11.3)
Panda Cloud Cleaner (x32 Version: 1.0.50)
Panda Internet Security 2014 (x32 Version: 19.01.00)
Password Depot 6 - Panda Secure Vault Edition (x32 Version: 6.1.5)
Polar IrDA USB Adapter (x32 Version: 1.03.0000)
Polar ProTrainer (x32 Version: 5.35.160)
QuickTime (x32 Version: 7.71.80.42)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6602)
Skype Click to Call (x32 Version: 6.3.11079)
Skype™ 6.3 (x32 Version: 6.3.107)
Tixati (x32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Visio 2007 Help (KB963666) (x32)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows-drivrutinspaket - Advanced Micro Devices, Inc System (04/15/2010 5.12.0.13) (Version: 04/15/2010 5.12.0.13)
Windows-drivrutinspaket - AMD (amd_sata) HDC (10/28/2011 1.2.001.0321) (Version: 10/28/2011 1.2.001.0321)
Windows-drivrutinspaket - AMD (amd_sata) HDC (12/12/2011 1.2.001.0327) (Version: 12/12/2011 1.2.001.0327)
Windows-drivrutinspaket - Realtek (RTL8167) Net (02/16/2012 7.053.0216.2012) (Version: 02/16/2012 7.053.0216.2012)
Windows-drivrutinspaket - Realtek (RTL8167) Net (11/23/2011 7.050.1123.2011) (Version: 11/23/2011 7.050.1123.2011)
Windows-drivrutinspaket - Realtek Semiconductor Corp. HD Audio Driver (03/27/2012 6.0.1.6602) (Version: 03/27/2012 6.0.1.6602)
Windows-drivrutinspaket - Realtek Semiconductor Corp. HD Audio Driver (12/13/2011 6.0.1.6526) (Version: 12/13/2011 6.0.1.6526)
WinRAR 4.11 (64-bit) (Version: 4.11.0)
VLC media player 2.0.2 (x32 Version: 2.0.2)
Youtube Downloader HD v. 2.9.8.9 (x32)

==================== Restore Points =========================

31-08-2013 18:19:52 Schemalagd kontrollpunkt
31-08-2013 23:29:58 Windows Update
05-09-2013 09:18:32 Windows Update
12-09-2013 09:45:12 Windows Update
24-09-2013 17:31:48 Schemalagd kontrollpunkt
01-10-2013 17:38:12 Schemalagd kontrollpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {56F79DCE-D1BD-4041-AC82-AF0898F5AF28} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {860C813A-F7DD-462C-9E75-B4CF2B51CCDF} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {8C5FAFFC-6710-47A0-83A4-DA8E14E86442} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9922575C-E622-4328-A478-42691F3EDF9A} - System32\Tasks\HDvid Codec V1-updater => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe [2013-08-18] (installdaddy)
Task: {9B12E600-3FF2-4B53-93B7-BA7196936C4D} - System32\Tasks\HDvid Codec V1-enabler => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe [2013-08-18] (installdaddy)
Task: {9D176794-DBAA-4A61-89FD-1C3AFBE6672A} - System32\Tasks\HDvid Codec V1-codedownloader => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe [2013-08-18] (installdaddy)
Task: {B7EF677D-2D59-444F-B454-4DA597D94061} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-24] (Adobe Systems Incorporated)
Task: {EC28EB35-9AD6-4115-8FFD-2418B8F42BA4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-19] (Google Inc.)
Task: {F72EFF06-F468-4027-9077-BE92EB4ED469} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-19] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HDvid Codec V1-codedownloader.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe
Task: C:\Windows\Tasks\HDvid Codec V1-enabler.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe
Task: C:\Windows\Tasks\HDvid Codec V1-updater.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe

==================== Loaded Modules (whitelisted) =============

2012-05-09 15:11 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2013-08-21 00:33 - 2007-02-14 13:55 - 00165424 _____ () C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\MiniCrypto.dll
2013-08-21 00:33 - 2004-05-19 11:33 - 00507904 _____ () C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\libxml2.dll
2013-08-21 00:33 - 2007-02-14 13:55 - 00099888 _____ () C:\Program Files (x86)\Panda Security\Panda Internet Security 2014\APIcr.dll
2013-10-05 21:09 - 2013-10-03 08:02 - 00698832 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\libglesv2.dll
2013-10-05 21:09 - 2013-10-03 08:02 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\libegl.dll
2013-10-05 21:09 - 2013-10-03 08:03 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll
2013-10-05 21:09 - 2013-10-03 08:03 - 00415184 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll
2013-10-05 21:09 - 2013-10-03 08:02 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ffmpegsumo.dll
2013-10-05 21:09 - 2013-10-03 08:03 - 13611984 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail => ""="Service"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (10/07/2013 07:54:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 06:10:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 06:07:30 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Tjänsten Cryptographic Services kunde inte initiera System Writer-objektet för VSS-säkerhetskopiering.

Details:
Could not query the status of the EventSystem service.

System Error:
Systemet håller på att avslutas.
.

Error: (10/06/2013 05:56:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 05:52:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 10:35:13 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/05/2013 10:28:30 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 00:12:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2013 11:15:05 AM) (Source: MsiInstaller) (User: NT instans)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/03/2013 11:14:51 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (10/07/2013 07:55:38 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten NVIDIA Update Service Daemon kunde inte startas på grund av följande fel:
%%1069

Error: (10/07/2013 07:55:38 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten nvUpdatusService kunde inte logga in som .\UpdatusUser med det för närvarande konfigurerade lösenordet på grund av följande fel:
%%1330

Kontrollera att tjänsten är korrekt konfigurerad med hjälp av snapin-modulen Tjänster i MMC (Microsoft Management Console).

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Följande start- eller systemstartdrivrutin(er) avbröts på grund av fel under start:
AFD
DfsC
discache
NetBIOS
NetBT
nsiproxy
pavboot
Psched
rdbss
ShldFlt
spldr
tdx
Wanarpv6
WfpLwf

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten Client Virtualization Handler är beroende av tjänsten Application Virtualization Client. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten SMB 2.0 miniomdirigerare är beroende av tjänsten SMB-miniomdirigerare, adapterprogram och motor. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten SMB 1.x miniomdirigerare är beroende av tjänsten SMB-miniomdirigerare, adapterprogram och motor. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten SMB-miniomdirigerare, adapterprogram och motor är beroende av tjänsten Undersystem för buffert har omdirigerats. Den sistnämnda kunde inte starta på grund av följande fel:
%%31

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten IP Helper är beroende av tjänsten Network Store Interface Service. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten Workstation är beroende av tjänsten Network Store Interface Service. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Error: (10/06/2013 06:09:13 PM) (Source: Service Control Manager) (User: )
Description: Tjänsten Network Location Awareness är beroende av tjänsten Network Store Interface Service. Den sistnämnda kunde inte starta på grund av följande fel:
%%1068

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 26%
Total physical RAM: 8189.22 MB
Available physical RAM: 6027.25 MB
Total Pagefile: 12283.41 MB
Available Pagefile: 9572.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1863.01 GB) (Free:1748.05 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: () (Removable) (Total:0.48 GB) (Free:0.26 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 17578220)
Partition 1: (Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 496 MB) (Disk ID: 820C7766)
Partition 1: (Active) - (Size=496 MB) - (Type=0B)

==================== End Of Log ============================

Dold text

Rapportera Redigera

Citera flera Citera

2013-10-07 23:05

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Steg 2, genomfört!

Skrivet av CeciliaB:

2. Skanna datorn online på http://www.eset.com/onlinescan/
För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Gå till inlägget

Online skannern hittade inte mindre än 19 potentiella hot!

C:\FRST\Quarantine\data.dat a variant of Win32/Kryptik.BMAG trojan
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-bg.exe a variant of Win32/Toolbar.CrossRider.H application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-bho.dll a variant of Win32/Toolbar.CrossRider.H application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-buttonutil.dll probably a variant of Win32/Toolbar.CrossRider.H application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-buttonutil.exe a variant of Win32/Toolbar.CrossRider.I application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe a variant of Win32/Toolbar.CrossRider.I application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe probably a variant of Win32/Toolbar.CrossRider.I application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-helper.exe a variant of Win32/Toolbar.CrossRider.I application
C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe probably a variant of Win32/Toolbar.CrossRider.I application
C:\Program Files (x86)\HDvid Codec V1\utils.exe multiple threats
C:\Program Files (x86)\hdvidcodec.com\HDvidCodecIE.exe multiple threats
C:\Program Files (x86)\hdvidcodec.com\hdvidextsetup.exe multiple threats
C:\Users\Daniel\AppData\Local\Temp\gismyyrrsrtgicsftjr.bfg a variant of Win32/Kryptik.BMAG trojan
C:\Users\Daniel\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\500c10ca-225b50a2 multiple threats
C:\Users\Daniel\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\6e12ac4f-67a10e3a a variant of Win32/Kryptik.BMAG trojan
C:\Users\Daniel\Downloads\FTF1C2_xmtx.avi.exe Win32/InstalleRex.I application
C:\Users\Daniel\Downloads\HDVidCodec_hdplugin_ch.exe Win32/Adware.1ClickDownload.AO application
C:\Users\Daniel\Downloads\Lockheed_Blackbird_Beyond_the_Secret_Missions_downloader_se_99045.exe a variant of Win32/YourFileDownloader.B application
C:\Users\Daniel\Downloads\youtube_downloader_hd_setup.exe Win32/OpenCandy application

Dold text

Rapportera Redigera

Citera flera Citera

2013-10-08 01:12

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av DanSweden84:

Online skannern hittade inte mindre än 19 potentiella hot!

Gå till inlägget

1. Esets logg
C:\Users\Daniel\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\6e12ac4f-67a10e3a a variant of Win32/Kryptik.BMAG trojan
Ovanstående visar att polistrojanen kom in genom ett säkerhetshål i Java.

De sista 4 filerna i Esets logg är installationsfiler som ligger i din mapp "Hämtade filer" (tror jag den heter på svenska). Du kan ta bort de filerna själv.

C:\Users\Daniel\AppData\Local\Temp
Den mappen kan du tömma, dvs själva mappen ska vara kvar men filer i den kan tas bort.

2. Avinstallera:
Ask Toolbar pga http://www.systemlookup.com/CLSID/56968-GenericAskToolbar_dll...
HDVidCodec Esets skanner klagade mycket på filer som hör till det programmet och samma sak på http://www.systemlookup.com/CLSID/78102-

Åtminstone följande är gamla version och det kommer säkert Secunias program att säga till om också:
Adobe Reader X (10.1.8) - Svenska (x32 Version: 10.1.8)
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
De flesta klarar sig bra utan att ha någon Java installerad, men om du måste se till att alltid ha senaste versionen.
Se även till att få bort Java från Firefox insticksprogram.

När du har avinstallerat Java kan du ta bort mappen C:\Users\Daniel\AppData\LocalLow\Sun\Java

3. Eftersom du har olämpliga toolbars i datorn blir det nu AdwCleaner av Xplode: http://general-changelog-team.fr/fr/downloads/finish/20-outil...
Stäng alla program, inklusive webbläsare, innan du använder det.

Rapportera Redigera

Citera flera Citera

2013-10-08 13:19

Permalänk

DanSweden84

Medlem

Registrerad: Okt 2013

●

Nu börjar det likna något!

Skrivet av CeciliaB:

C:\Users\Daniel\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\6e12ac4f-67a10e3a a variant of Win32/Kryptik.BMAG trojan
Ovanstående visar att polistrojanen kom in genom ett säkerhetshål i Java.

Åtminstone följande är gamla version och det kommer säkert Secunias program att säga till om också:

Gå till inlägget

- Har nu gjort ytterligare en skanning med ESET och det enda som finns kvar är en fil i karantän:
C:\FRST\Quarantine\data.dat a variant of Win32/Kryptik.BMBA trojan
Vad göra med denna fil?

- Secunia PSI har nu ingenting att klaga på, sedan programmet uppdaterade gamla versioner igår kväll.

-AdwCleaner, efter att ha kört programmet ett par gånger så klagas det enbart på följande lilla:

[ File : C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : icon_url
Found : search_url
Found : suggest_url
Found : suggest_url

Dold text

Känns som det mesta skadliga är borta nu. Stort tack för din hjälp
Har du förresten några bra förslag på säkerhetspaket?, kan absolut tänka mig att betala för det också. Eftersom jag inte riktigt är nöjd med Panda så funderar jag nämligen på att byta.

Rapportera Redigera

Citera flera Citera

2013-10-08 13:40

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Bra!

Bara trevligt att kunna bidra med lite hjälp

FRST-mappen kan du ta bort när allt är klar om den inte tas bort av OTC nedan.

Om Chrome fungerar helt normalt utan att några konstigt sidor, sökmotorer, sökförslag dyker upp ska inte de raderna i AdwCleaner vara något att bry sig utan bara en notering att det finns inställningar.

1. Stäng alla program, inklusive webbläsare.
Dubbelklicka på AdwCleaner för att starta programmet.
Klicka på Uninstall-knappen.

2. Ladda ner avinstallationsprogrammet OTC till Skrivbordet.
http://oldtimer.geekstogo.com/OTC.exe
Dubbelklicka på filen för att starta programmet.
Tryck på knappen CleanUp! och FRST kommer att avinstalleras efter en omstart av datorn. Ta bort eventuella loggar.

Panda är sällan med i tester av antivirusprogram så det är svårt att veta hur det står sig i konkurrensen.

Innan du bestämmer dig slutgiltigt (och betalar) ska du ladda ner en utvärderingsversion så att du ser att programmet fungerar bra i din dator och att du begriper dig på det. Så länge du håller dig till något program som ligger bra till i tester har du nog gjort vad du kan. Vettiga tester:
http://www.virusbtn.com/vb100/rap-index.xml
http://www.av-test.org/en/tests/home-user/windows-7/julaug-20...
http://www.av-comparatives.org/dynamic-tests/
http://www.matousec.com/projects/proactive-security-challenge... (brandväggar)

Även bra att komplettera med Malwarewbytes Anti-Malware (MBAM) som ofta är bra på sådant som antivirusprogram har svårt med, t ex polistrojanen. En kombination av gratis antivirus och betalvarianten av MBAM är en möjlighet.

När du avinstallerar antivirusprogram se till att köra tillverkarens särskilda städprogram förutom den vanliga avinstallationen:
http://forums.malwarebytes.org/index.php?showtopic=127580&pid...

Rapportera Redigera

Citera flera Citera

2013-10-17 15:00

Permalänk

wolfmanjack

Medlem

Registrerad: Okt 2013

●

Tack Cecilia för mycket användbara råd! Ett problem, när jag ska ladda ner TFC by Oldtimer säger McAffee att det innehåller virus. Är det säkert att hämta ändå?

Rapportera Redigera

Citera flera Citera

2013-10-17 15:48

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av wolfmanjack:

Tack Cecilia för mycket användbara råd! Ett problem, när jag ska ladda ner TFC by Oldtimer säger McAffee att det innehåller virus. Är det säkert att hämta ändå?

Gå till inlägget

Menar du OTC?
Du kan alltid spara en fil på datorn utan att det händer något, men du kan vänta med att köra den tills du har kontrollerat den på http://www.virustotal.com men det är inte ovanligt att något antivirusprogram då och då reagerar på dessa små verktygsprogram.

Rapportera Redigera

Citera flera Citera

2013-10-17 19:14

Permalänk

wolfmanjack

Medlem

Registrerad: Okt 2013

●

TFC är ett rensningsprogram för tempfiler som det skrevs om på bleepingcomputer men jag tittade närmare nu och jag hade nog lite brottom förut. Temp och temorary internetfiles har jag ju redan rensat manuellt, det jag är ute efter är ett verktyg för att ta bort filer och registerposter från avinstallerade program. AddAwere tror jag fixar detta men till en liten kostnad. Det finns kanske något gratisprogram som gör samma nytta.

Rapportera Redigera

Citera flera Citera

2013-10-18 00:06

Permalänk

CeciliaB

Medlem

Plats: Stockholm
Registrerad: Nov 2011

●

Skrivet av wolfmanjack:

Gå till inlägget

Eftersom jag inte nämnt TFC i tråden (troligen eftersom det inte är något jag brukar föreslå) trodde jag du hade skrivit fel. AddAwere har jag aldrig hört talas och registerstädningsprogram ställer jag mig mycket tveksam till överhuvudtaget.

Rapportera Redigera

Citera flera Citera

2013-11-05 10:40

Permalänk

Jonas79

Medlem

Plats: Östersund
Registrerad: Sep 2007

●

Mötte på detta igår och fick en popup ruta som jag valde att inte trycka på som gjorde att webläsaren ej kunde stängas och valde att stänga ner den via aktiivitetshanteraren.

Nu är min fråga hur vet man om man fått skadlig kod på sin dator efter att Polistrojan fönstret kommit upp med popup som låser webläsaren och att man stänger ner webläsaren via aktivitetshanteraren.

Har kunnat använda den som vanligt på internet och annat och kört Avg free 2014 virus sökning efteråt utan att hitta något.

Visa signatur

Chassi: Ssupd Meshroom S V2, Moderkort: Gigabyte Aorus X570I Pro Wifi, Processor:Ryzen 7 5800X3D , Cpu kylare: EK-AIO Elite 280 D-RGB Minnen Gskill Ripsaw 16 Gb Cl16 3600 mhz,Startdisk:SSD Samsung 970 Evo plus 1 TB , Grafikkort:PNY RTX4070TI Super Verto Oc PSU: Corsair SF850L Skärm: ASUS ROG Swift PG278Q Tillbehör: Logitech G903 & Funk KB460 , Logitech Z520 datorhögtalare.

Rapportera Redigera

Citera flera Citera

2013-11-05 13:07

Permalänk

Jonas79

Medlem

Plats: Östersund
Registrerad: Sep 2007

●

Var dum och testade att uppgradera Avg Free 2014 till Avg Full protection 2014 med 30 testdagar och när skyddet och brandväggen gick ner för att uppgradera så startade det direkt en nedladdning från nått skit som kommit till datorn som låste internetfönstret.

Valde då att formatera datorn och köra en ren installation av Windows.

Men måste erkänna att det är drygt att man ej kan installera WIN 8.1 Direkt utan måste först installera Win 8 och köra alla uppdateringar via Windows update och sedan Uppgradera igen till Win 8.1

Ringde Microsoft och frågade om man kan slippa detta och installara Win 8.1 direkt men det gick inte i dagsläget utan påpeka att detta är som ett servicepack och då sa jag att i Win 7 kunde man installera på skiva med service pack 2 tex direkt men han hade inte ett direkt svar varför detta ej går på denna version av windows.

Visa signatur

Rapportera Redigera

Citera flera Citera

3 4 5 6 7 8 9 10

Skriv svar

Guide: Hur man blir av med "Polisen har blockerat din dator!"

Hur få bort denna trojan?

Min loggfil lyder följande:

FRST genomkört

Tilläggsloggen

Steg 2, genomfört!

Nu börjar det likna något!

Externa nyheter

Spelnyheter från FZ