also @ TechSpot: OCZ Vertex 450 SSD Review

Virus: System Check

Discussion in 'Virus and Malware Removal' started by Emerik, Jan 9, 2012.

Post New Reply
Page 3 of 5

  1. Emerik Newcomer, in training Posts: 51

    Same problem with IE, getting redirected still...

    GooredFix by jpshortstuff (03.07.10.1)
    Log created at 21:18 on 13/01/2012 (Administrator)
    Firefox version 8.0.1 (en-US)

    ========== GooredScan ==========


    ========== GooredLog ==========

    C:\Program Files (x86)\Mozilla Firefox\extensions\
    {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [17:19 02/09/2011]
    {972ce4c6-7e08-4474-a285-3208198ce6fd} [17:33 08/09/2011]
    {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [19:06 11/01/2012]

    C:\Users\Administrator\Application Data\Mozilla\Firefox\Profiles\44rgjj9n.default\extensions\
    forcetls@sid.stamm [12:02 08/09/2011]
    sv@dictionaries.addons.mozilla.org [09:26 21/12/2011]

    [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
    (none)

    -=E.O.F=-
    Emerik, Jan 13, 2012
    #41

  2. Broni Malware Annihilator Posts: 39,349   +175

    Please download MiniToolBox and run it.

    Checkmark following boxes:
    • Flush DNS
    • Report IE Proxy Settings
    • Report FF Proxy Settings
    • List content of Hosts
    • List IP configuration
    • List Winsock Entries
    • List last 10 Event Viewer log
    • List Users, Partitions and Memory size
    Click Go and post the result.
    Broni, Jan 13, 2012
    #42

  3. Emerik Newcomer, in training Posts: 51

    MiniToolBox by Farbar
    Ran by Administrator (administrator) on 13-01-2012 at 22:03:41
    Microsoft Windows 7 Enterprise Service Pack 1 (X64)
    Boot Mode: Normal
    ***************************************************************************

    ========================= Flush DNS: ===================================

    IP-konfiguration f”r Windows

    DNS-matcharens cacheminne har rensats.

    ========================= IE Proxy Settings: ==============================

    Proxy is not enabled.
    No Proxy Server is set.

    ========================= FF Proxy Settings: ==============================

    ========================= Hosts content: =================================

    127.0.0.1 localhost

    ========================= IP Configuration: ================================

    Intel(R) Centrino(R) Advanced-N 6205 = Wireless Network Connection (Connected)
    Intel(R) 82579LM Gigabit Network Connection = Local Area Connection (Media disconnected)
    Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)
    Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)
    ========================= Winsock entries =====================================

    Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
    Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
    Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
    Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
    Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
    Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
    Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
    Catalog5 09 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)
    Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
    x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
    x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
    x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
    x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
    x64-Catalog5 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
    x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
    x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
    x64-Catalog5 09 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)
    x64-Catalog9 01 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 02 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 03 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 04 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 06 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 07 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 08 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 09 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 10 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
    x64-Catalog9 11 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)

    ========================= Event log errors: ===============================

    Application errors:
    ==================
    Error: (01/13/2012 09:29:24 PM) (Source: PC-Doctor) (User: )
    Description: (3984) Asapi: (21:29:24:9480)(3984) engine.EngineLink - Error -- 81 Invalid connection to client

    Error: (01/13/2012 09:20:46 PM) (Source: Application Error) (User: )
    Description: Felet uppstod i programmet med namn: jusched.exe, version 2.0.6.1, tidsstämpel 0x4df127ab
    , felet uppstod i modulen med namn: USER32.dll, version 6.1.7601.17514, tidsstämpel 0x4ce7ba59
    Undantagskod: 0xc0000005
    Felförskjutning: 0x00029951
    Process-ID: 0x4d4
    Programmets starttid: 0xjusched.exe0
    Sökväg till program: jusched.exe1
    Sökväg till modul: jusched.exe2
    Rapport-ID: jusched.exe3

    Error: (01/13/2012 09:18:14 PM) (Source: SideBySide) (User: )
    Description: Det gick inte att skapa aktiveringskontext för C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1. Det finns ett fel i manifest- eller principfilen C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2 på rad C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
    En komponentversion som begärs av programmet står i konflikt med en annan komponentversion som redan är aktiv.
    Följande komponenter orsakar konflikten:
    Komponent 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
    Komponent 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

    Error: (01/13/2012 09:08:30 PM) (Source: WinMgmt) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 02:58:24 PM) (Source: Application Error) (User: )
    Description: Felet uppstod i programmet med namn: jusched.exe, version 2.0.6.1, tidsstämpel 0x4df127ab
    , felet uppstod i modulen med namn: USER32.dll, version 6.1.7601.17514, tidsstämpel 0x4ce7ba59
    Undantagskod: 0xc0000005
    Felförskjutning: 0x00029951
    Process-ID: 0x680
    Programmets starttid: 0xjusched.exe0
    Sökväg till program: jusched.exe1
    Sökväg till modul: jusched.exe2
    Rapport-ID: jusched.exe3

    Error: (01/13/2012 02:53:08 PM) (Source: WinMgmt) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 00:07:21 PM) (Source: Application Error) (User: )
    Description: Felet uppstod i programmet med namn: jusched.exe, version 2.0.6.1, tidsstämpel 0x4df127ab
    , felet uppstod i modulen med namn: USER32.dll, version 6.1.7601.17514, tidsstämpel 0x4ce7ba59
    Undantagskod: 0xc0000005
    Felförskjutning: 0x00029951
    Process-ID: 0x1368
    Programmets starttid: 0xjusched.exe0
    Sökväg till program: jusched.exe1
    Sökväg till modul: jusched.exe2
    Rapport-ID: jusched.exe3

    Error: (01/13/2012 00:01:49 PM) (Source: WinMgmt) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 08:39:17 AM) (Source: Application Error) (User: )
    Description: Felet uppstod i programmet med namn: jusched.exe, version 2.0.6.1, tidsstämpel 0x4df127ab
    , felet uppstod i modulen med namn: USER32.dll, version 6.1.7601.17514, tidsstämpel 0x4ce7ba59
    Undantagskod: 0xc0000005
    Felförskjutning: 0x00029951
    Process-ID: 0x1350
    Programmets starttid: 0xjusched.exe0
    Sökväg till program: jusched.exe1
    Sökväg till modul: jusched.exe2
    Rapport-ID: jusched.exe3

    Error: (01/13/2012 08:34:01 AM) (Source: WinMgmt) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    System errors:
    =============
    Error: (01/13/2012 09:56:47 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:56:47 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:29:09 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:09:09 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:08:31 PM) (Source: Service Control Manager) (User: )
    Description: Följande start- eller systemstartdrivrutin(er) avbröts på grund av fel under start:
    cdrom

    Error: (01/13/2012 09:08:27 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:08:27 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 09:08:14 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 03:13:47 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .

    Error: (01/13/2012 02:53:45 PM) (Source: Ntfs) (User: )
    Description: Filsystemstrukturen på disken är skadad och oanvändbar.
    Kör verktyget CHKDSK på volymen .


    Microsoft Office Sessions:
    =========================
    Error: (01/13/2012 09:29:24 PM) (Source: PC-Doctor)(User: )
    Description: (3984) Asapi: (21:29:24:9480)(3984) engine.EngineLink - Error -- 81 Invalid connection to client

    Error: (01/13/2012 09:20:46 PM) (Source: Application Error)(User: )
    Description: jusched.exe2.0.6.14df127abUSER32.dll6.1.7601.175144ce7ba59c0000005000299514d401ccd23020c5f64dC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\syswow64\USER32.dll12fa4379-3e24-11e1-9796-cc52afe0241b

    Error: (01/13/2012 09:18:14 PM) (Source: SideBySide)(User: )
    Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Administrator\Downloads\esetsmartinstaller_enu.exe

    Error: (01/13/2012 09:08:30 PM) (Source: WinMgmt)(User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 02:58:24 PM) (Source: Application Error)(User: )
    Description: jusched.exe2.0.6.14df127abUSER32.dll6.1.7601.175144ce7ba59c00000050002995168001ccd1fab5c771b3C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\syswow64\USER32.dlla8238034-3dee-11e1-af02-cc52afe0241b

    Error: (01/13/2012 02:53:08 PM) (Source: WinMgmt)(User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 00:07:21 PM) (Source: Application Error)(User: )
    Description: jusched.exe2.0.6.14df127abUSER32.dll6.1.7601.175144ce7ba59c000000500029951136801ccd1e2d11b9704C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\syswow64\USER32.dllc34e1dd4-3dd6-11e1-a21c-cc52afe0241b

    Error: (01/13/2012 00:01:49 PM) (Source: WinMgmt)(User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/13/2012 08:39:17 AM) (Source: Application Error)(User: )
    Description: jusched.exe2.0.6.14df127abUSER32.dll6.1.7601.175144ce7ba59c000000500029951135001ccd1c5c016495bC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\syswow64\USER32.dllb204eee9-3db9-11e1-9de0-cc52afe0241b

    Error: (01/13/2012 08:34:01 AM) (Source: WinMgmt)(User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    ========================= Memory info: ===================================

    Percentage of memory in use: 40%
    Total physical RAM: 3983.23 MB
    Available physical RAM: 2354.51 MB
    Total Pagefile: 7964.66 MB
    Available Pagefile: 5949.57 MB
    Total Virtual: 4095.88 MB
    Available Virtual: 3975.76 MB

    ========================= Partitions: =====================================

    1 Drive c: (OSDisk) (Fixed) (Total:297.79 GB) (Free:236.32 GB) NTFS

    ========================= Users: ========================================

    **** End of log ****
    Emerik, Jan 13, 2012
    #43

  4. Broni Malware Annihilator Posts: 39,349   +175

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Jan 13, 2012
    #44

  5. Emerik Newcomer, in training Posts: 51

    ComboFix 12-01-13.05 - Administrator 2012-01-13 23:26:57.3.4 - x64
    Microsoft Windows 7 Enterprise 6.1.7601.1.1252.46.1033.18.3983.2510 [GMT 1:00]
    Körs från: c:\users\Administrator\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
    SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
    SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
    .
    .
    (((((((((((((((((((((((( Filer skapade från 2011-12-13 till 2012-01-13 ))))))))))))))))))))))))))))))
    .
    .
    2012-01-13 23:01 . 2012-01-13 23:01 -------- d-----w- c:\users\VRElev\AppData\Local\temp
    2012-01-13 23:01 . 2012-01-13 23:01 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-01-13 20:19 . 2012-01-13 20:19 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7472ADB9-061A-4480-BBE7-BBD2C048DE96}\offreg.dll
    2012-01-13 20:19 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7472ADB9-061A-4480-BBE7-BBD2C048DE96}\mpengine.dll
    2012-01-12 02:00 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
    2012-01-12 02:00 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
    2012-01-12 02:00 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
    2012-01-12 02:00 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
    2012-01-11 23:02 . 2012-01-11 23:02 -------- d-----w- c:\program files (x86)\ESET
    2012-01-11 19:14 . 2012-01-11 19:14 -------- d-----w- c:\program files (x86)\Common Files\Java
    2012-01-11 18:56 . 2012-01-11 18:56 -------- d-----w- C:\_OTL
    2012-01-10 20:14 . 2012-01-10 20:16 -------- d-----w- C:\FRST
    2012-01-08 20:13 . 2012-01-08 20:13 -------- d-----w- c:\users\Administrator\AppData\Roaming\Malwarebytes
    2012-01-08 20:13 . 2012-01-08 20:13 -------- d-----w- c:\programdata\Malwarebytes
    2012-01-08 20:11 . 2012-01-08 20:11 -------- d-----w- c:\program files\CCleaner
    2012-01-08 18:57 . 2012-01-08 20:05 1365 ----a-w- c:\users\Administrator\AppData\Roaming\GetValue.vbs
    2012-01-08 18:57 . 2012-01-08 18:57 35 ----a-w- c:\users\Administrator\AppData\Roaming\SetValue.bat
    2011-12-25 13:12 . 2011-12-25 13:13 -------- d-----w- c:\users\Administrator\HTC Legend filer
    2011-12-25 12:32 . 2011-12-25 12:53 -------- d-----w- c:\users\Administrator\HTC Hero filer
    2011-12-24 13:48 . 2011-12-24 13:48 -------- d-----w- c:\users\Administrator\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
    2011-12-15 02:04 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
    2011-12-15 02:01 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
    2011-12-15 02:01 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
    2011-12-15 02:01 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2011-12-15 02:00 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-12-15 02:00 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-21 13:53 . 2011-09-02 17:04 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-11-21 11:40 . 2011-09-07 11:48 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-11-10 04:54 . 2011-09-02 13:58 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-05-19 15:38 . 2011-09-08 21:38 94080 ----a-w- c:\program files (x86)\Install Lightroom 3.exe
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-01-10_23.36.39 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2010-11-21 03:24 . 2010-11-21 03:24 96768 c:\windows\SysWOW64\sspicli.dll
    + 2012-01-12 02:03 . 2011-11-17 05:28 96768 c:\windows\SysWOW64\sspicli.dll
    + 2012-01-12 02:03 . 2011-11-17 05:34 22016 c:\windows\SysWOW64\secur32.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 22016 c:\windows\SysWOW64\secur32.dll
    - 2009-07-14 04:54 . 2012-01-10 22:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:54 . 2012-01-13 13:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:54 . 2012-01-13 13:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2012-01-10 22:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2012-01-13 13:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-07-14 04:54 . 2012-01-10 22:25 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-11-21 03:09 . 2012-01-13 20:17 53456 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-01-13 20:17 31012 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2011-09-02 15:48 . 2012-01-12 21:23 12316 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1710067825-1136283663-2566881455-500_UserData.bin
    - 2010-11-21 03:24 . 2010-11-21 03:24 29184 c:\windows\system32\sspisrv.dll
    + 2012-01-12 02:03 . 2011-11-17 06:35 29184 c:\windows\system32\sspisrv.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 28160 c:\windows\system32\secur32.dll
    + 2012-01-12 02:03 . 2011-11-17 06:35 28160 c:\windows\system32\secur32.dll
    + 2012-01-12 02:03 . 2011-11-17 06:33 31232 c:\windows\system32\lsass.exe
    - 2009-07-13 23:20 . 2009-07-14 01:39 31232 c:\windows\system32\lsass.exe
    + 2012-01-12 02:03 . 2011-11-17 06:49 95600 c:\windows\system32\drivers\ksecdd.sys
    + 2011-08-08 13:06 . 2012-01-13 20:15 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2011-08-08 13:06 . 2012-01-10 22:24 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2011-08-08 13:06 . 2012-01-13 20:15 81920 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2011-08-08 13:06 . 2012-01-10 22:24 81920 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2012-01-10 22:24 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2012-01-13 20:15 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:46 . 2012-01-12 10:41 80120 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
    - 2011-09-02 15:01 . 2012-01-08 01:30 2190 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
    + 2011-09-02 15:01 . 2012-01-13 14:57 2190 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
    + 2012-01-13 20:08 . 2012-01-13 20:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2012-01-10 22:48 . 2012-01-10 22:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-01-13 20:08 . 2012-01-13 20:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-01-10 22:48 . 2012-01-10 22:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2012-01-12 02:03 . 2011-11-17 05:35 314880 c:\windows\SysWOW64\webio.dll
    - 2010-11-21 03:23 . 2010-11-21 03:23 314880 c:\windows\SysWOW64\webio.dll
    + 2012-01-12 02:03 . 2011-11-17 05:34 224768 c:\windows\SysWOW64\schannel.dll
    - 2010-11-21 03:23 . 2010-11-21 03:23 514560 c:\windows\SysWOW64\qdvd.dll
    + 2012-01-12 02:03 . 2011-10-26 04:32 514560 c:\windows\SysWOW64\qdvd.dll
    - 2011-09-02 13:58 . 2011-09-02 13:58 157472 c:\windows\SysWOW64\javaws.exe
    + 2012-01-11 19:06 . 2011-11-10 04:54 157472 c:\windows\SysWOW64\javaws.exe
    + 2012-01-11 19:06 . 2011-11-10 04:54 149280 c:\windows\SysWOW64\javaw.exe
    + 2012-01-11 19:06 . 2011-11-10 04:54 149280 c:\windows\SysWOW64\java.exe
    + 2012-01-12 02:03 . 2011-11-17 06:35 395776 c:\windows\system32\webio.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 395776 c:\windows\system32\webio.dll
    + 2011-08-09 07:53 . 2012-01-12 17:24 253040 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
    - 2010-11-21 03:24 . 2010-11-21 03:24 136192 c:\windows\system32\sspicli.dll
    + 2012-01-12 02:03 . 2011-11-17 06:35 136192 c:\windows\system32\sspicli.dll
    + 2012-01-12 02:03 . 2011-11-17 06:35 340992 c:\windows\system32\schannel.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 340992 c:\windows\system32\schannel.dll
    + 2012-01-12 02:03 . 2011-10-26 05:25 366592 c:\windows\system32\qdvd.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 366592 c:\windows\system32\qdvd.dll
    + 2011-08-08 23:00 . 2012-01-13 20:15 622356 c:\windows\system32\perfh01D.dat
    - 2011-08-08 23:00 . 2012-01-10 22:32 622356 c:\windows\system32\perfh01D.dat
    - 2009-07-14 02:36 . 2012-01-10 22:32 612194 c:\windows\system32\perfh009.dat
    + 2009-07-14 02:36 . 2012-01-13 20:15 612194 c:\windows\system32\perfh009.dat
    - 2011-08-08 23:00 . 2012-01-10 22:32 122902 c:\windows\system32\perfc01D.dat
    + 2011-08-08 23:00 . 2012-01-13 20:15 122902 c:\windows\system32\perfc01D.dat
    + 2009-07-14 02:36 . 2012-01-13 20:15 105412 c:\windows\system32\perfc009.dat
    - 2009-07-14 02:36 . 2012-01-10 22:32 105412 c:\windows\system32\perfc009.dat
    + 2012-01-12 02:03 . 2011-11-17 06:49 152432 c:\windows\system32\drivers\ksecpkg.sys
    + 2012-01-12 02:03 . 2011-11-17 06:44 459232 c:\windows\system32\drivers\cng.sys
    - 2009-07-14 05:01 . 2012-01-08 01:30 469728 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2012-01-13 14:57 469728 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2012-01-11 19:14 . 2012-01-11 19:14 207360 c:\windows\Installer\6ca08.msi
    + 2012-01-12 02:03 . 2011-10-29 05:23 465920 c:\windows\ehome\mstvcapn.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 465920 c:\windows\ehome\mstvcapn.dll
    + 2012-01-12 02:03 . 2011-10-26 04:32 1328128 c:\windows\SysWOW64\quartz.dll
    - 2010-11-21 03:23 . 2010-11-21 03:23 1328128 c:\windows\SysWOW64\quartz.dll
    + 2012-01-12 02:03 . 2011-10-26 05:25 1572864 c:\windows\system32\quartz.dll
    - 2010-11-21 03:24 . 2010-11-21 03:24 1447936 c:\windows\system32\lsasrv.dll
    + 2012-01-12 02:03 . 2011-11-17 06:35 1447936 c:\windows\system32\lsasrv.dll
    + 2009-07-14 04:45 . 2012-01-12 02:22 6854835 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    - 2009-07-14 04:45 . 2012-01-02 18:14 6854835 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2011-10-24 10:14 . 2012-01-13 14:57 2024056 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    - 2011-10-24 10:14 . 2012-01-10 22:48 2024056 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    + 2011-09-06 19:25 . 2012-01-13 14:57 7108232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
    - 2011-09-06 19:25 . 2012-01-08 01:30 7108232 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
    - 2009-07-14 02:34 . 2011-12-15 02:24 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    + 2009-07-14 02:34 . 2012-01-12 02:19 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    + 2011-08-08 13:14 . 2012-01-12 02:00 54008112 c:\windows\system32\MRT.exe
    + 2011-09-02 15:01 . 2012-01-13 14:57 22046672 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1710067825-1136283663-2566881455-500-12288.dat
    .
    -- 'Snapshot' återställt till dagens datum --
    .
    (((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Not* tomma poster & legitima standardposter visas inte.
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-09-02 3077528]
    "Facebook Update"="c:\users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-11-07 137536]
    "OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2011-07-21 718720]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-07-04 1605992]
    "TSMResident"="c:\program files (x86)\ThinkPad\Tablettmeny\TSMRESIDENT.EXE" [2011-05-09 484856]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "COMODO"="c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe" [2011-11-23 213304]
    "CPA"="c:\program files\COMODO\COMODO GeekBuddy\VALA.exe" [2011-11-23 184120]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    .
    c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
    Skärmurklipp och start för OneNote 2010.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
    R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-07-04 477032]
    R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
    R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft - nätverkskontroll;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
    R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
    R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2011-07-04 83304]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
    R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
    R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
    R3 tsusbhub;tsusbhub; [x]
    S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [x]
    S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [x]
    S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]
    S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]
    S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [x]
    S2 ASRSVC;ASR Service;c:\program files (x86)\ThinkPad\Tablettmeny\ASR\ASRSVC.exe [2010-10-27 79136]
    S2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-11-23 1267000]
    S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [x]
    S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-07 210896]
    S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2011-05-31 41320]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-04-04 45496]
    S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-05-31 59240]
    S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
    S2 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2011-07-04 148840]
    S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys [x]
    S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 13840]
    S2 SROSVC;Screen Reading Optimizer Service Program;c:\program files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [2011-03-02 443240]
    S2 TabletSVC;TABLET Service;c:\program files (x86)\ThinkPad\Tablettmeny\TSMService.exe [2011-05-18 83440]
    S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-04-20 144232]
    S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-03-29 64952]
    S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [x]
    S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
    S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
    S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
    .
    .
    Innehåll i mappen 'Schemalagda aktiviteter':
    .
    2012-01-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1710067825-1136283663-2566881455-500Core.job
    - c:\users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-20 14:21]
    .
    2012-01-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1710067825-1136283663-2566881455-500UA.job
    - c:\users\Administrator\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-20 14:21]
    .
    2012-01-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1710067825-1136283663-2566881455-500Core.job
    - c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-29 11:16]
    .
    2012-01-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1710067825-1136283663-2566881455-500UA.job
    - c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-29 11:16]
    .
    2012-01-13 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
    - c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:06]
    .
    2012-01-13 c:\windows\Tasks\SystemToolsDailyTest.job
    - c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:06]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-05-31 40808]
    "TpShocks"="TpShocks.exe" [2011-03-29 380776]
    "AcWin7Hlpr"="c:\program files (x86)\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]
    "ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-05-25 281960]
    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
    "ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-03-14 316032]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
    "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-06-30 9048392]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=c:\windows\System32\guard64.dll
    .
    ------- Extra genomsökning -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = https://home.vrg.se
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 83.255.245.11 193.150.193.150
    FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\44rgjj9n.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - facebook.com
    .
    .
    --------------------- LÅSTA REGISTERNYCKLAR ---------------------
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Internet Explorer\Approved Extensions]
    @Denied: (2) (Administrator)
    "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,17,ca,
    00,9a,bb,ea,08,b1,9f,bd,17,8d,6c,fb,d9
    "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,3b,1b,71,2e,90,
    6a,f2,63,4b,07,a3,f0,4c,fc,1c,7a,e5,64
    "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,cb,25,
    88,35,1f,d6,00,9a,c5,16,24,77,4a,25,dc
    "{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,3b,1b,25,b7,e6,
    ac,16,5d,30,03,ae,2b,05,f3,01,cc,44,e5
    "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,3b,1b,f1,05,41,
    32,c1,08,0c,0c,bc,aa,88,e9,66,6c,04,8b
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
    @Denied: (2) (Administrator)
    "Timestamp"=hex:e8,c5,dd,da,72,69,cc,01
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (Administrator)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b9,cd,29,60,03,3f,d3,45,b4,90,d4,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b9,cd,29,60,03,3f,d3,45,b4,90,d4,\
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="FirefoxHTML"
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="FirefoxHTML"
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="Applications\\notepad.exe"
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="FirefoxHTML"
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="FirefoxHTML"
    .
    [HKEY_USERS\S-1-5-21-1710067825-1136283663-2566881455-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
    @Denied: (2) (Administrator)
    "Progid"="FirefoxHTML"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Sluttid: 2012-01-14 00:24:12
    ComboFix-quarantined-files.txt 2012-01-13 23:24
    ComboFix2.txt 2012-01-10 23:59
    .
    Före genomsökningen: 253*720*588*288 byte ledigt
    Efter genomsökningen: 253*734*404*096 byte ledigt
    .
    - - End Of File - - C02752A312D6DF6B8B54FB1C538E3E8F
    Emerik, Jan 13, 2012
    #45

  6. Broni Malware Annihilator Posts: 39,349   +175

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
    Broni, Jan 13, 2012
    #46
     

  7. Emerik Newcomer, in training Posts: 51

    After rebooting the computer, it wasn't able to boot correctly, I was immidiatly sent to Windows Starpup Repair... And now it's currently "Attempting repair" What should I do??
    Emerik, Jan 13, 2012
    #47

  8. Emerik Newcomer, in training Posts: 51

    Oh, and the program asked me to Cure after finding an infected file, and I continued. Now the repair thing shut down, and it didn't do anything about the virus. So should I restart in safe-mode and try again?
    Emerik, Jan 13, 2012
    #48

  9. Broni Malware Annihilator Posts: 39,349   +175

    Yes, go ahead.
    Broni, Jan 13, 2012
    #49

  10. Emerik Newcomer, in training Posts: 51

    Okay, major problem... can't even boot in safe mode... I can choose the option "Safe Mode" but afterwards I get a half second bluescreen and then it goes back to the first startup-screen, and the process starts over... What to do? :S
    Emerik, Jan 13, 2012
    #50

  11. Broni Malware Annihilator Posts: 39,349   +175

    Please Boot to the System Recovery Options
    If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
    It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...
    NOTE. If none of the above apply you can create System Repair Disc (link in "Option two") and boot from it.

    On the System Recovery Options menu you will get the following options:

    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt

    Choose Command Prompt
    You should see X:\SOURCES>...

    Execute the following commands in bold.
    Press Enter after every one of them.

    bootrec /fixmbr (<--- there is a "space" after "bootrec")

    bootrec /fixboot (<--- there is a "space" after "bootrec")

    exit

    Restart computer.
    Broni, Jan 13, 2012
    #51

  12. Emerik Newcomer, in training Posts: 51

    Should I restart it in safe mode? The cmd thing worked by the way.
    Emerik, Jan 13, 2012
    #52

  13. Emerik Newcomer, in training Posts: 51

    Damn it. Still getting the same problem as before the system recovery. Can't start computer, not even in safe mode. Still getting a quick bluescreen, and then restarting it.
    Emerik, Jan 13, 2012
    #53

  14. Broni Malware Annihilator Posts: 39,349   +175

    Let's see, if we can look at your computer booting from an external source.

    Please download OTLPE (filesize 120,9 MB)

    • When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
    • Reboot your system using the boot CD you just created.
      • Note : If you do not know how to set your computer to boot from CD follow the steps HERE
    • Your system should now display a REATOGO-X-PE desktop.
    • Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
    • Double-click on the OTLPE icon.
    • When asked Do you wish to load the remote registry, select Yes
    • When asked Do you wish to load remote user profile(s) for scanning, select Yes
    • Ensure the box Automatically Load All Remaining Users" is checked and press OK
    • OTL should now start.
    • Under the Custom Scan box paste this in:
      /md5start
      eventlog.dll
      scecli.dll
      netlogon.dll
      cngaudit.dll
      sceclt.dll
      ntelogon.dll
      logevent.dll
      iaStor.sys
      nvstor.sys
      atapi.sys
      IdeChnDr.sys
      viasraid.sys
      AGP440.sys
      vaxscsi.sys
      nvatabus.sys
      viamraid.sys
      nvata.sys
      nvgts.sys
      iastorv.sys
      ViPrt.sys
      eNetHook.dll
      ahcix86.sys
      KR10N.sys
      nvstor32.sys
      ahcix86s.sys
      nvrd32.sys
      symmpi.sys
      adp3132.sys
      mv61xx.sys
      userinit.exe
      explorer.exe
      volsnap.sys
      winlogon.exe
      nvraid.sys
      consrv.dll
      winsrv.dll
      svchost.exe
      /md5stop
    • Press Run Scan to start the scan.
    • When finished, the file will be saved in drive C:\OTL.txt
    • Copy this file to your USB drive if you do not have internet connection on this system
    • Please post the contents of the OTL.txt file in your reply.
    Broni, Jan 13, 2012
    #54

  15. Emerik Newcomer, in training Posts: 51

    I will do this in the morning. I can't thank you enough for the help! :)
    Emerik, Jan 13, 2012
    #55

  16. Broni Malware Annihilator Posts: 39,349   +175

    Hey I wanna get that sucker too :)
    Broni, Jan 13, 2012
    #56

  17. Emerik Newcomer, in training Posts: 51

    Hey... I just remembered my laptop can't run CD's... So, is there any other way?
    Emerik, Jan 14, 2012
    #57

  18. Broni Malware Annihilator Posts: 39,349   +175

    Broni, Jan 14, 2012
    #58

  19. Emerik Newcomer, in training Posts: 51

    Hi again, I'm sorry I haven't replied sooner but I've been busy these last couple of days... Anyway, I successfully installed the OTLPE on a flash drive, but the problem is that I'm not sure how to boot my laptop from it, seeing how the guide on booting from CD doesn't match the interface of my laptop's BIOS. I did however took a picture of my screen showing how far I've gotten... I'm quite sure I'm in the right place, but I don't know which option makes it boot from my flash drive. Thank you


    Link to picture: http://imageshack.us/photo/my-images/163/img1648qc.jpg/
    Emerik, Jan 17, 2012
    #59

  20. Broni Malware Annihilator Posts: 39,349   +175

    Move #7 (USB HDD) to 1st position.
    Broni, Jan 17, 2012
    #60
Page 3 of 5

Add New Comment

Social Login & Guest Posting

TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.