Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected by Eraem Vire Studaa 2012 & updateflashplayer_***.exe


  • This topic is locked This topic is locked
32 replies to this topic

#16 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 06:40 AM

ComboFix 15-01-08.01 - user 2015-01-14  12:02:22.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.46.1053.18.8106.5193 [GMT 1:00]
Körs från: c:\users\user\Desktop\ComboFix.exe
Kommandoväxlar som använts :: c:\users\user\Desktop\CFScript.txt
AV: McAfee Antivirus och antispionprogram *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Antivirus och antispionprogram *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\Microsoft\Secure\Icons\temp\tmp6A49.exe"
"c:\programdata\Microsoft\Secure\Icons\temp\tmp6D84.exe"
"c:\programdata\Microsoft\Secure\Icons\temp\tmp979E.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Secure\Icons
c:\programdata\Microsoft\Secure\Icons\CachedIcons\zepplauncher.mif
c:\programdata\Microsoft\Secure\Icons\IconsCacheHelper.dll
c:\programdata\Microsoft\Secure\Icons\SecureIconsProvider.dll
c:\programdata\Microsoft\Secure\Icons\temp\{3158BBF2-FC2D-6435-2F94-7F8A6034DF32}
c:\programdata\Microsoft\Secure\Icons\temp\{63745EB4-C83E-F324-6E4E-DF430AD1DEF7}
c:\programdata\Microsoft\Secure\Icons\temp\{BC5200A1-5D31-7672-EF5D-C96F0D77FC01}
c:\programdata\Microsoft\Secure\Icons\temp\tmp3AB7.exe
c:\programdata\Microsoft\Secure\Icons\temp\tmp5376.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp5590.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp6A49.exe
c:\programdata\Microsoft\Secure\Icons\temp\tmp6A49.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp6D84.exe
c:\programdata\Microsoft\Secure\Icons\temp\tmp6D84.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp74B1.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp7C97.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp8ABA.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp979E.exe
c:\programdata\Microsoft\Secure\Icons\temp\tmp979E.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmp9B18.tmp
c:\programdata\Microsoft\Secure\Icons\temp\tmpA174.tmp
c:\users\user\AppData\Local\Ilwsoft
c:\users\user\AppData\Local\Ilwsoft\ctrlnetInterval.dll
c:\users\user\AppData\Local\Ilwsoft\ctrlnetInterval.idx
c:\users\user\AppData\Local\ITsoft
c:\users\user\AppData\Local\ITsoft\{A1D5A785-E8F9-8049-DB58-5869DBC05884}
c:\users\user\AppData\Local\ITsoft\Inengine.dll
c:\users\user\AppData\Local\ITsoft\Inengine.idx
c:\users\user\AppData\Local\Temp\e3c74ee6-7482-4280-b9c3-f233b390296e\CliSecureRT.dll
c:\users\user\AppData\Roaming\Agqobu
c:\users\user\AppData\Roaming\Apoxapyz
c:\users\user\AppData\Roaming\Apoxapyz\alevy.exe
c:\users\user\AppData\Roaming\Xoulaqe
c:\users\user\AppData\Roaming\Xoulaqe\uffaysv.exe
c:\users\user\AppData\Roaming\Zaasben
.
.
((((((((((((((((((((((((   Filer skapade från 2014-12-14 till 2015-01-14  ))))))))))))))))))))))))))))))
.
.
2015-01-14 11:20 . 2015-01-14 11:20	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-01-14 11:19 . 2015-01-14 11:24	--------	d-----w-	c:\users\user\AppData\Roaming\Xoulaqe
2015-01-14 11:19 . 2015-01-14 11:24	--------	d-----w-	c:\users\user\AppData\Roaming\Apoxapyz
2015-01-12 12:56 . 2015-01-12 13:01	--------	d-----w-	C:\FRST
2015-01-12 11:26 . 2015-01-12 12:11	--------	d-----w-	C:\AdwCleaner
2015-01-10 21:55 . 2015-01-14 11:16	--------	d-----w-	c:\users\user\AppData\Roaming\Skype
2015-01-10 21:32 . 2015-01-10 21:32	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2015-01-10 21:08 . 2015-01-10 21:08	26528	----a-w-	c:\windows\SysWow64\drivers\HWiNFO64A.SYS
2015-01-10 21:07 . 2015-01-10 21:07	--------	d-----w-	c:\users\user\AppData\Roaming\ProductData
2015-01-10 21:07 . 2015-01-10 21:08	--------	d-----w-	c:\programdata\IObit
2015-01-10 21:07 . 2015-01-14 11:23	--------	d-----w-	c:\programdata\ProductData
2015-01-10 21:07 . 2015-01-10 21:08	--------	d-----w-	c:\program files (x86)\IObit
2015-01-10 21:07 . 2015-01-10 21:08	--------	d-----w-	c:\users\user\AppData\Roaming\IObit
2015-01-07 12:11 . 2015-01-07 16:18	--------	d-----w-	c:\users\user\AppData\Roaming\Nico Mak Computing
2015-01-07 12:11 . 2015-01-07 16:18	--------	d-----w-	c:\programdata\Nico Mak Computing
2015-01-02 12:58 . 2015-01-02 12:58	--------	d-sh--w-	c:\users\user\AppData\Local\EmieBrowserModeList
2014-12-19 20:44 . 2014-12-19 20:44	--------	dc----w-	c:\windows\system32\DRVSTORE
2014-12-19 20:44 . 2014-05-06 19:11	67808	----a-w-	c:\windows\system32\drivers\MOBK.sys
2014-12-19 20:44 . 2014-12-19 20:44	--------	d-----w-	c:\program files (x86)\McAfee Online Backup
2014-12-19 20:43 . 2013-09-23 12:49	197704	----a-w-	c:\windows\system32\drivers\HipShieldK.sys
2014-12-19 20:42 . 2014-12-19 20:43	--------	d-----w-	c:\program files (x86)\Common Files\McAfee
2014-12-19 20:42 . 2014-12-19 20:44	--------	d-----w-	c:\program files\McAfee
2014-12-19 20:41 . 2015-01-07 11:06	--------	d-----w-	c:\program files (x86)\McAfee
2014-12-19 20:35 . 2014-06-20 09:30	189912	----a-w-	c:\windows\system32\mfevtps.exe
2014-12-19 20:20 . 2014-12-19 20:20	--------	d-----w-	c:\windows\system32\drivers\NSTx64
2014-12-19 20:20 . 2014-12-19 20:20	--------	d-----w-	c:\program files (x86)\Norton Identity Safe
2014-12-19 20:15 . 2015-01-07 05:44	--------	d-----w-	c:\program files\Common Files\McAfee
2014-12-17 21:06 . 2014-12-13 05:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-17 21:06 . 2014-12-13 03:33	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-14 01:35 . 2012-04-02 19:11	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-14 01:35 . 2011-10-09 07:45	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-14 01:35 . 2014-12-09 22:35	5013680	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-01-07 15:08 . 2014-08-16 08:44	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-10 15:12 . 2011-10-07 07:40	112710672	----a-w-	c:\windows\system32\MRT.exe
2014-12-04 02:50 . 2014-12-10 08:41	413184	----a-w-	c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-10 08:41	741376	----a-w-	c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-10 08:41	396800	----a-w-	c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-10 08:41	830976	----a-w-	c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-10 08:41	192000	----a-w-	c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-10 08:41	227328	----a-w-	c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-10 08:41	1083392	----a-w-	c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-10 08:41	1232040	----a-w-	c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-10 08:41	389296	----a-w-	c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-10 08:40	25059840	----a-w-	c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-10 08:41	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-10 08:41	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-10 08:41	66560	----a-w-	c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-10 08:40	580096	----a-w-	c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-10 08:41	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-10 08:41	2885120	----a-w-	c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-10 08:40	88064	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-10 08:41	54784	----a-w-	c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-10 08:41	34304	----a-w-	c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-10 08:41	633856	----a-w-	c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-10 08:41	114688	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-10 08:41	814080	----a-w-	c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-10 08:41	6039552	----a-w-	c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-10 08:41	968704	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-10 08:41	490496	----a-w-	c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-10 08:41	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-10 08:41	77824	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-10 08:40	199680	----a-w-	c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-10 08:41	92160	----a-w-	c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-10 08:41	501248	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-10 08:41	62464	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-10 08:41	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-10 08:41	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-10 08:41	316928	----a-w-	c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-10 08:41	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-10 08:41	718848	----a-w-	c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-10 08:41	800768	----a-w-	c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-10 08:41	1359360	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-10 08:41	2125312	----a-w-	c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-10 08:41	14412800	----a-w-	c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-10 08:41	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-10 08:41	4299264	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-10 08:40	2358272	----a-w-	c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-10 08:41	2052096	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-10 08:41	1155072	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-10 08:41	1548288	----a-w-	c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-10 08:41	800768	----a-w-	c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-10 08:41	1888256	----a-w-	c:\windows\SysWow64\wininet.dll
2014-11-21 05:14 . 2014-08-16 08:43	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-08-16 08:43	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-02-19 14:29	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-11-18 13:56 . 2014-11-18 13:56	1202848	----a-w-	c:\windows\SysWow64\FM20.DLL
2014-11-11 03:09 . 2014-12-10 08:41	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-18 18:23	241152	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-18 18:23	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-10 08:41	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-18 18:23	186880	----a-w-	c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-18 18:23	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-10 08:41	119296	----a-w-	c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-10 08:39	2048	----a-w-	c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-10 08:39	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-11-02 19:30 . 2014-11-02 19:30	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-30 02:03 . 2014-12-10 08:39	165888	----a-w-	c:\windows\system32\charmap.exe
2014-10-30 01:45 . 2014-12-10 08:39	155136	----a-w-	c:\windows\SysWow64\charmap.exe
2014-10-25 01:57 . 2014-11-12 01:45	77824	----a-w-	c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-12 01:45	67584	----a-w-	c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-12 01:45	861696	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-18 02:05 . 2014-12-10 15:07	4121600	----a-w-	c:\windows\system32\mf.dll
2014-10-18 01:33 . 2014-11-12 01:45	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2014-10-18 01:33 . 2014-12-10 15:07	3209728	----a-w-	c:\windows\SysWow64\mf.dll
.
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* tomma poster & legitima standardposter visas inte. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-03-17 896912]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-03-17 3373456]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-03-17 19872]
"DelayShred"="c:\progra~1\mcafee\mqs\ShrCL.EXE" [2014-06-12 129088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Telia"="c:\program files (x86)\Telia\Supportassistenten\bin\sprtcmd.exe" [2010-11-11 206120]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128]
"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2010-06-21 136416]
"Seagate Dashboard"="c:\program files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-11-03 73728]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744]
"mcpltui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2014-04-25 537992]
.
c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Skärmurklipp och start för OneNote 2007.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0PCloudBroom64.exe \systemroot\system32\BroomData.bit
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
@=""
.
R2 c2cautoupdatesvc;Skype Click to Call Updater; [x]
R2 c2cpnrsvc;Skype Click to Call PNR Service; [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 LiveUpdateSvc;LiveUpdate;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 mfencrk;McAfee Inc. mfencrk;c:\windows\system32\DRIVERS\mfencrk.sys;c:\windows\SYSNATIVE\DRIVERS\mfencrk.sys [x]
R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys;c:\windows\SYSNATIVE\DRIVERS\PSKMAD.sys [x]
R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe;c:\windows\SYSNATIVE\SUPDSvc.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 tapSF0901;Spotflux Virtual Network Device Driver;c:\windows\system32\DRIVERS\tapSF0901.sys;c:\windows\SYSNATIVE\DRIVERS\tapSF0901.sys [x]
R3 Tdsshbecr;Handelsbanken card reader;c:\windows\system32\DRIVERS\shbecr.sys;c:\windows\SYSNATIVE\DRIVERS\shbecr.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot64.sys;c:\windows\SYSNATIVE\drivers\pavboot64.sys [x]
S1 ccSet_NST;Norton Identity Safe Settings Manager;c:\windows\system32\drivers\NSTx64\7DE07080.017\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NSTx64\7DE07080.017\ccSetx64.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S1 MOBKFilter;MOBKFilter;c:\windows\system32\DRIVERS\MOBK.sys;c:\windows\SYSNATIVE\DRIVERS\MOBK.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 HomeNetSvc;McAfee Home Network;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [x]
S2 McAPExe;McAfee AP Service;c:\program files\McAfee\MSC\McAPExe.exe;c:\program files\McAfee\MSC\McAPExe.exe [x]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 mcpltsvc;McAfee Platform Services;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]
S2 mfecore;McAfee Anti-Malware Core;c:\program files\Common Files\McAfee\AMCore\mcshield.exe;c:\program files\Common Files\McAfee\AMCore\mcshield.exe [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 MOBKbackup;McAfee Online Backup Service;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe [x]
S2 NCO;Norton Identity Safe;c:\program files (x86)\Norton Identity Safe\Engine\2014.7.8.23\NST.exe;c:\program files (x86)\Norton Identity Safe\Engine\2014.7.8.23\NST.exe [x]
S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [x]
S2 sprtsvc_teliada;SupportSoft Sprocket Service (teliada);c:\program files (x86)\Telia\Supportassistenten\bin\sprtsvc.exe;c:\program files (x86)\Telia\Supportassistenten\bin\sprtsvc.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S2 tgsrvc_teliada;SupportSoft Repair Service (teliada);c:\program files (x86)\Telia\Supportassistenten\bin\tgsrvc.exe;c:\program files (x86)\Telia\Supportassistenten\bin\tgsrvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys;c:\windows\SYSNATIVE\drivers\HipShieldK.sys [x]
S3 IntcDAud;Intel(R) Bildskärmsljud;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
S3 mfencbdc;McAfee Inc. mfencbdc;c:\windows\system32\DRIVERS\mfencbdc.sys;c:\windows\SYSNATIVE\DRIVERS\mfencbdc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Innehåll i mappen 'Schemalagda aktiviteter':
.
2015-01-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 01:35]
.
2015-01-01 c:\windows\Tasks\DriverNavigator Scheduled Scan.job
- c:\program files\Easeware\DriverNavigator\DriverNavigator.exe [2011-10-28 10:03]
.
2015-01-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-04 00:54]
.
2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-04 00:54]
.
2014-11-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2666454066-465502622-1009703566-1000Core.job
- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-19 03:12]
.
2015-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2666454066-465502622-1009703566-1000UA.job
- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-19 03:12]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2015-01-10 21:07	2471744	----a-w-	c:\program files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2014-05-06 19:12	6486376	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2014-05-06 19:12	6486376	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2014-05-06 19:12	6486376	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-27 11780712]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-02 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-02 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-02 417560]
.
------- Extra genomsökning -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportera till Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Skicka bild till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Skicka sida till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\1zmd8jlb.default\
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 1970-05-30 05:08; {4EADCDA6-6762-E449-44F8-C3010B4AC0C7}; - 
.
- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NCO]
"ImagePath"="\"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.8.23\NST.exe\" /s \"NCO\" /m \"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.8.23\diMaster.dll\" /prefetch:1"
.
--------------------- LÅSTA REGISTERNYCKLAR ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Andra processer som körs ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Samsung\Easy Display Manager\WifiManager.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
c:\program files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
c:\program files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
c:\program files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
c:\program files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
c:\program files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Sluttid: 2015-01-14  12:35:19 - datorn startades om.
ComboFix-quarantined-files.txt  2015-01-14 11:35
ComboFix2.txt  2015-01-13 17:09
.
Före genomsökningen: 68 116 983 808 byte ledigt
Efter genomsökningen: 68 059 115 520 byte ledigt
.
- - End Of File - - 42461410F87823418252ED01EE3C4B08

After runing ComboFix with the filr You provided there are no longer any signs of Eraem in my task manager>processes .... but probably too early to jump for joy.

I will now run MBAM and post the log from that one in a later message



BC AdBot (Login to Remove)

 


#17 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 07:29 AM

Malwarebytes Anti-Malware
www.malwarebytes.org

Skanningsdatum: 2015-01-14
Skanningstid: 12:47:54
Loggfil: MBAMScan_2015-01-14.txt
Administratör: Ja

Version: 2.00.4.1028
Databas med skadliga progarm: v2015.01.14.04
Databas med rootkit: v2015.01.07.01
Licens: Gratis
Skydd mot skadliga program: Inaktiverat
Skydd mot skadliga webbplatser: Inaktiverat
Självförsvar: Inaktiverat

OS: Windows 7 Service Pack 1
CPU: x64
Filsystem: NTFS
Användare: user

Skanningstyp: Hotskanning
Resultat: Slutförd
Skannade objekt: 383071
Förfluten tid: 35 min, 52 sek

Minne: Aktiverat
Autostart: Aktiverat
Filsystem: Aktiverat
Arkivfiler: Aktiverat
Rootkits: Inaktiverat
Heuristik: Aktiverat
PUP: Varna
PUM: Aktiverat

Processer: 0
(Inga illasinnade poster hittades)

Moduler: 0
(Inga illasinnade poster hittades)

Registernycklar: 0
(Inga illasinnade poster hittades)

Registervärden: 0
(Inga illasinnade poster hittades)

Registerdata: 0
(Inga illasinnade poster hittades)

Mappar: 0
(Inga illasinnade poster hittades)

Filer: 1
PUP.Optional.uTorrentTB.A, C:\Users\user\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx, Flyttad till karantän, [3b1140b74643b185050df17b659ec739], 

Fysiska sektorer: 0
(Inga illasinnade poster hittades)


(end)

I selected quarantine for the identified PUP


Edited by Ioshik, 14 January 2015 - 07:51 AM.


#18 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 08:10 AM

Scan with ESET Online Scan

Go here to run an online scannner from ESET. Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Here's how.
  • Click the blue Run ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
  • Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
  • Click on Advanced Settings
  • Make sure that the option Remove found threats is unticked.
  • Ensure these options are ticked
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Click Start
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#19 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 09:07 AM

scaning .... http://prntscr.com/5scqvu .... looks like there will be quite some time before the log is available

 

I have had a couple of pop-up windows saying I'm about to open a secure link over internet ... sounds to me as some kind of proxy tuneling, but I've uninstalled all my proxy software - could this be activities from a hacker using this malware we're trying to remove?


Edited by Ioshik, 14 January 2015 - 09:07 AM.


#20 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 09:19 AM

I don´t think so - it seems that you are accessing sites that require SSL connections.

Let´s await the scan to be finished


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#21 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 04:10 PM

C:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Xoulaqe\uffaysv.exe.vir	a variant of Win32/Kryptik.CUZQ trojan	
C:\AdwCleaner\Quarantine\C\Program Files (x86)\1ClickDownload\1ClickSettingsManager.exe.vir	Win32/Adware.1ClickDownload.E application	cleaned by deleting - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\1ClickDownload\ocmainpack.exe.vir	Win32/Adware.1ClickDownload.E application	cleaned by deleting - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir	Win32/Toolbar.Conduit.Y potentially unwanted application	deleted - quarantined
C:\AdwCleaner\Quarantine\C\ProgramData\SweetIM\Messenger\update\sweetimsetup.exe.vir	a variant of Win32/SweetIM.L potentially unwanted application	deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\user\AppData\Local\iLivid\Helper.dll.vir	a variant of Win32/Toolbar.SearchSuite.W potentially unwanted application	deleted - quarantined
C:\AdwCleaner\Quarantine\C\windows\System32\roboot64.exe.vir	a variant of Win64/Systweak.A potentially unwanted application	deleted - quarantined
C:\Config.Msi\a9d141.rbf	a variant of Win32/SweetIM.L potentially unwanted application	deleted - quarantined
C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Secure\Icons\IconsCacheHelper.dll.vir	a variant of Win64/Sathurbot.A trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Secure\Icons\SecureIconsProvider.dll.vir	a variant of Win64/Sathurbot.E trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Secure\Icons\temp\tmp3AB7.exe.vir	Win32/Boaxxe.BR trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\user\AppData\Local\Ilwsoft\ctrlnetInterval.dll.vir	a variant of Win32/Boaxxe.CL trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\user\AppData\Local\ITsoft\Inengine.dll.vir	a variant of Win32/Boaxxe.CJ trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Apoxapyz\alevy.exe.vir	a variant of Win32/Kryptik.CVCK trojan	cleaned by deleting - quarantined
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx	a variant of Win32/SweetIM.L potentially unwanted application	deleted - quarantined
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\1zmd8jlb.default\extensions\{4EADCDA6-6762-E449-44F8-C3010B4AC0C7}\components\MicrosoftRDPClient.js	Win32/Boaxxe.BU trojan	cleaned by deleting - quarantined
C:\Users\user\Downloads\avc-free.exe	Win32/OpenCandy potentially unsafe application	deleted - quarantined
C:\Users\user\Downloads\Mad_Love_Season_1_Complete_720p_HDTV_[MeGUiL].exe	Win32/Adware.1ClickDownload.G application	cleaned by deleting - quarantined
C:\Users\user\Downloads\setup_chrispc_free_anonymous_proxy_5_50.exe	Win32/BundleLoader.B potentially unwanted application	deleted - quarantined
C:\Users\user\Downloads\wzro18.exe	a variant of Win32/Systweak potentially unwanted application	deleted - quarantined

I might have missed to untick the "Remove found threats" at the start of this  7h 17min long scan


Edited by Ioshik, 15 January 2015 - 03:05 AM.


#22 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 14 January 2015 - 04:52 PM

  • ... and let me know how things are now.

 

 

As I mentioned earlier, there are no longer any signs of "Eraem Vire Studaa" among the processes shown in task manager, but the boot-up sequence is, in my opinion, very slow. During the latest scan I recieved new updates for windows and as soon as the scan was done I rebooted the pc to have those updates installed as shown in this screen dump http://prntscr.com/5sjca1.

 

I don't know what else to say about the performance of my pc. I'm afraid it's too soon to defenatily say all crap has been removed/erased but so far so good.


Edited by Ioshik, 15 January 2015 - 03:04 AM.


#23 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 17 January 2015 - 05:52 AM

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe
  • Hit Scan and wait for the scan to finish.
  • Confirm the message but don´t uncheck anything.
  • Hit Clean
  • When the run is finished, it will open up a text file
  • Please post its contents within your next reply
  • You´ll find the log file at C:\AdwCleaner[S1].txt also




Delete junk with JRT

thisisujrt.gif Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.




SecurityCheck

Reboot your system before starting!

Please download SecurityCheck: LINK Mirror (if the link is down)

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread (Note: Do NOT post this one into a code box!





Are any problems left or may I post the final reply? :)


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#24 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 21 January 2015 - 06:56 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#25 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 26 January 2015 - 06:14 AM

This topic has been re-opened at the request of the person who originally posted.
Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#26 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 26 January 2015 - 06:15 AM

Hi there,

 

JRT does not function properly on some systems. Let´s check something:

 

 

Use the Windows Error Checking utility (Check Disk), with the options to fix file system errors and scan the disk surface for errors, attempt recovery of data and repair the disk:

  • Click the "Windows Orb" Start button, then click Computer.
  • Right-click on the drive that you wish to check > Properties > Tools tab
  • In the "Error checking" section, click on Check now.
  • Place a checkmark in both boxes > Start.
  • If the disk you have chosen is the Windows system disk:
  • A message will notify you that a restart is necessary ask "Do you want to check for hard disk errors the next time you start your computer?".
  • Click Schedule disk check > OK and close all windows.
  • Re-start the computer. The disk will be checked when the system boots.
  • This will take some time to run and at times may appear stalled but just let it run.
  • When the disk check is complete, the system will re-start automatically and load Windows.


A log of the disk check is recorded only if the scheduled re-start is used, and only for drives on the same HDD as the Operating System.
To open Event Viewer and view the log:

  • Click the "Windows Orb" Start button -> type "eventvwr" without the quotes -> press the key.
  • The Event Viewer window will open.
  • In the left pane, expand "Windows Logs" and then click on Application.
  • In the right pane, at the top, click on the column heading Source to sort the list alphabetically.
  • Look in the Source column for "Wininit", with an entry corresponding to the date and time of the disk check.
  • Click on that Wininit entry to select it.
  • On the top main menu, click Action > Copy > Copy Details as Text.
  • Paste the contents into your next reply.

 

 

 

System File Check

For Windows XP:

  • Press the Windows- and the R-key simultanously.
  • Within the text box that jus opened, write cmd and hit Enter.


For Windows Vista/7:

  • Press the Windows key to open the start menu.
  • Don´t highlight anything, just write cmd.
  • The start menu will offer you an entry named cmd.
  • Right click it and select "run as administrator"



Within the opening window, write the following:

sfc /scannow
(See the blank within).


  • Hit enter. Your system will be checked for damaged system files.
  • Tell me the result of that scan in here (as the tool produces no log).

Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#27 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 26 January 2015 - 02:15 PM

Loggnamn:      Application
Källa:         Microsoft-Windows-Wininit
Datum:         2015-01-26 19:53:12
Händelse-ID:   1001
Aktivitetskategori:Ingen
Nivå:          Information
Nyckelord:     Klassiskt
Användare:     Saknas
Dator:         user-Dator
Beskrivning:


Kontrollerar filsystemet på C:
Filsystemet är av typen NTFS.

En diskkontroll har schemalagts.
Disken kommer nu att kontrolleras.                       

CHKDSK verifierar filer (steg 1 av 5)...
Rensar upp instanstaggar för filen 0x272ff.
Rensar upp instanstaggar för filen 0x2b320.
  300288 filposter har behandlats.                                       

Filverifieringen är klar.
  1229 stora filposter har behandlats.                                 

  0 skadade filposter har behandlats.                               

  0 EA-poster har behandlats.                                       

  44 referensposter har behandlats.                                  

CHKDSK verifierar index (steg 2 av 5)...
  385762 indexposter har behandlats.                                     

Indexverifieringen är klar.
  0 oindexerade filer har genomsökts.                               

  0 oindexerade filer har återställts.                              

CHKDSK verifierar säkerhetsbeskrivare (steg 3 av 5)...
  300288 fil-SD/SID-poster har behandlats.                               

Rensar upp 573 oanvända indexposter från indexet $SII i filen 0x9.
Rensar upp 573 oanvända indexposter från indexet $SDH i filen 0x9.
Rensar upp 573 oanvända säkerhetsbeskrivare.
Verifieringen av säkerhetsbeskrivare är klar.
  42738 datafiler har behandlats.                                       

CHKDSK verifierar USN-journalen...
  34594744 USN-byte har behandlats.                                        

Verifieringen av USN-journalen är klar.
CHKDSK verifierar fildata (steg 4 av 5)...
  300272 filer har behandlats.                                           

Verifieringen av filinformationen är klar.
CHKDSK verifierar ledigt diskutrymme (steg 5 av 5)...
  16303254 lediga kluster har bearbetats.                                  

Verifieringen av ledigt diskutrymme är klar.
Korrigeringar har gjorts i filsystemet.

 186646527 kB diskutrymme totalt.
 120879416 kB i 228859 filer.
    145880 kB i 42739 index.
         0 kB i skadade sektorer.
    408215 kB används av operativsystemet.
     65536 kB hårddisksutrymme används av loggfilen.
  65213016 kB ledigt utrymme.

      4096 byte i varje allokeringsenhet.
  46661631 allokeringsenheter finns totalt på disken.
  16303254 allokeringsenheter är tillgängliga på disken.

Intern information:
00 95 04 00 fa 24 04 00 2e 7e 07 00 00 00 00 00  .....$...~......
c6 08 00 00 2c 00 00 00 00 00 00 00 00 00 00 00  ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Kontrollen av disken har slutförts.
Vänta medan datorn startas om.

Händelsens XML-data:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-01-26T18:53:12.000000000Z" />
    <EventRecordID>48525</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>user-Dator</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Kontrollerar filsystemet på C:
Filsystemet är av typen NTFS.

En diskkontroll har schemalagts.
Disken kommer nu att kontrolleras.                       

CHKDSK verifierar filer (steg 1 av 5)...
Rensar upp instanstaggar för filen 0x272ff.
Rensar upp instanstaggar för filen 0x2b320.
  300288 filposter har behandlats.                                       

Filverifieringen är klar.
  1229 stora filposter har behandlats.                                 

  0 skadade filposter har behandlats.                               

  0 EA-poster har behandlats.                                       

  44 referensposter har behandlats.                                  

CHKDSK verifierar index (steg 2 av 5)...
  385762 indexposter har behandlats.                                     

Indexverifieringen är klar.
  0 oindexerade filer har genomsökts.                               

  0 oindexerade filer har återställts.                              

CHKDSK verifierar säkerhetsbeskrivare (steg 3 av 5)...
  300288 fil-SD/SID-poster har behandlats.                               

Rensar upp 573 oanvända indexposter från indexet $SII i filen 0x9.
Rensar upp 573 oanvända indexposter från indexet $SDH i filen 0x9.
Rensar upp 573 oanvända säkerhetsbeskrivare.
Verifieringen av säkerhetsbeskrivare är klar.
  42738 datafiler har behandlats.                                       

CHKDSK verifierar USN-journalen...
  34594744 USN-byte har behandlats.                                        

Verifieringen av USN-journalen är klar.
CHKDSK verifierar fildata (steg 4 av 5)...
  300272 filer har behandlats.                                           

Verifieringen av filinformationen är klar.
CHKDSK verifierar ledigt diskutrymme (steg 5 av 5)...
  16303254 lediga kluster har bearbetats.                                  

Verifieringen av ledigt diskutrymme är klar.
Korrigeringar har gjorts i filsystemet.

 186646527 kB diskutrymme totalt.
 120879416 kB i 228859 filer.
    145880 kB i 42739 index.
         0 kB i skadade sektorer.
    408215 kB används av operativsystemet.
     65536 kB hårddisksutrymme används av loggfilen.
  65213016 kB ledigt utrymme.

      4096 byte i varje allokeringsenhet.
  46661631 allokeringsenheter finns totalt på disken.
  16303254 allokeringsenheter är tillgängliga på disken.

Intern information:
00 95 04 00 fa 24 04 00 2e 7e 07 00 00 00 00 00  .....$...~......
c6 08 00 00 2c 00 00 00 00 00 00 00 00 00 00 00  ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Kontrollen av disken har slutförts.
Vänta medan datorn startas om.
</Data>
  </EventData>
</Event>

Result of the System File Check: http://prntscr.com/5xekw5  (no errors found)

 

and again, sorry about the swedish, but I suppose you know what is what in that log anyway


Edited by Ioshik, 26 January 2015 - 02:51 PM.


#28 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 27 January 2015 - 09:34 AM

No problem! ;)

 

Errors were found and corrected - please proceed with SecurityCheck now.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#29 Ioshik

Ioshik
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 28 January 2015 - 05:14 AM

 Results of screen317's Security Check version 0.99.95  
   x64   
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
McAfee Antivirus och antispionprogram   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 McAfee SiteAdvisor    
 Panda Cloud Cleaner   
 Java 7 Update 71  
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31
 Adobe Flash Player 16.0.0.296  
 Mozilla Firefox (35.0) 
 Google Chrome (40.0.2214.91) 
 Google Chrome (40.0.2214.93) 
````````Process Check: objlist.exe by Laurent````````
 McAfee Online Backup MOBKbackup.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
 
 
There was still a lot of "File not found" flashing by in the cmd window while the program was running

Edited by Ioshik, 28 January 2015 - 05:16 AM.


#30 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:28 AM

Posted 29 January 2015 - 08:00 AM

That is normal behaviour.

 

 

Your system is clean now! :)

 

 

Java runtime Environment out of date

Your Java runtime environment is outdated. We will fix this.

  • Get the actual JRE from here
  • Save jxpiinstall.exe to your desktop
  • Close all running programs, especially your browser(s)
  • Run jxpiinstall.exe. This will download the newest JRE installer and install the software
  • when finished, go to
    Start-->control panel-->add/remove programs and remove all older Java versions. (if existing)
  • When finished, reboot your computer.

After the reboot
  • Open control panel again and click the java symbol.
  • Click Settings under Temporary Internet Files.
    The Temporary Files Settings dialog box appears.
  • Click Delete Files.
    The Delete Temporary Files dialog box appears
  • Click OK on Delete Temporary Files window.
  • Click OK again.

 

 

 

Uninstall our tools using delfix

Please follow these steps in order:

  • In the case we used Defogger to turn off your CD emulation software. You can start it again and use the Enable button.
  • In the case we used Combofix. Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time. You shall be noted that Combofix has been removed.
  • In any case please download delfix to your desktop.
    • Close all other programms and start delfix.
    • Please check all the boxes and run the tool.
    • delfix will now delete all found traces of our removal process
  • If there is still something left please delete it manualy.




Delete System Restore Points

To ensure your System Restore Points are free of malware, we will delete all of them but the most recent or create a new one.

On Windows Vista: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows 7/8: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows XP: Please follow these instructions to delete all but the most common System Protection Restore Points.




Temp File Cleaner

We need to download Temp File Cleaner (TFC) by OldTimer:
  • Please download TFC.exe by Oldtimer at one of the two links: Link 1 Link 2
  • Save and close all running applications
  • Double-click on TFC.exe to run the program
  • Click on Start to begin the cleaning process note: this program may close running applications, make your screen disappear temporarily, or require a reboot of your PC - this is normal and part of the cleanup
  • When the scan is complete, if you were not asked to reboot the computer, please do so now
More Information can be found about the tool here: http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

 

 

 

Recommendations: How to protect yourself

  • System Updates
    Please ensure to have automatic updates activated in your control panel.
    For further information and a tutorial, see this Microsoft Support article.
  • Protection
    What you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.
    Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.
    • To keep your browser free of advertising, you may install the Adblock Plus browser extension.
      It will filter unwanted advertising out of the website´s content.
    • To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.
      It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.
      In addition, before accessing a dangerous classified web site, a warning screen is displayed.

  • Up to date Software
    Keep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:

  • Backup
    Hardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system.
  • Behaviour
    The commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help if you aren´t careful enough.
    • While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware.
    • Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything.
    • When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system.
    • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
      They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users