Är det något virus?

Device \Driver\nvatabus \Device\NvAta2 IRP_MJ_INTERNAL_DEVICE_CONTROL [BA8E98B4] sfsync02.sys
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SYSTEM_CONTROL 89D561D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 89D561D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_CREATE 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_CLOSE 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_DEVICE_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL [BA8E98B4] sfsync02.sys
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_POWER 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_SYSTEM_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target1Lun0 IRP_MJ_PNP 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CREATE 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CLOSE 89B2D1D8

Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_DEVICE_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL [BA8E98B4] sfsync02.sys
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_POWER 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_SYSTEM_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_PNP 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_CREATE 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_CLOSE 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL [BA8E98B4] sfsync02.sys
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_POWER 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 89B2D1D8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 IRP_MJ_PNP 89B2D1D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_CREATE 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_CLOSE 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_READ 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_WRITE 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_DEVICE_CONTROL 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_INTERNAL_DEVICE_CONTROL [BA8E98B4] sfsync02.sys
Device \Driver\usbstor \Device\0000008d IRP_MJ_POWER 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_SYSTEM_CONTROL 878401D8
Device \Driver\usbstor \Device\0000008d IRP_MJ_PNP 878401D8
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_READ 877971D8

Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP 877971D8
Device \FileSystem\Fastfat \Fat IRP_MJ_PNP 877971D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 878631D8

Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP 878631D8
Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP 878631D8

---- Files - GMER 1.0.12 ----

ADS C:\Documents and Settings\Andreas\Lokala inställningar\Application Data\Microsoft\Messenger\marcustheonly@hotmail.com \SharingMetadata\skitintressant@hotmail.com\DFSR\S taging\CS{10CB297C-1FFD-5E42-29E4-55A74290FEE9}\01\10-{10CB297C-1FFD-5E42-29E4-55A74290FEE9}-v1-{C5E66DA8-60D9-4B96-9CA0-54B1FE50CF84}-v10-Downloaded.f rx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS D:\Postal2\System\Postal2.eXe:SummaryInformation
ADS D:\Postal2\System\Postal2.eXe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

---- EOF - GMER 1.0.12 ----

Det blev väldigt många posts men nu är den här: Vad tycker du??

Även denna loggen ser ok ut, den blev lång tack vara F-Secure som du har

Finns mera program att köra, frågan är om du vill det??

vrf skulle ja inte vilja, får jag mer virus av dem. Det ända jag vill e att bli av med dem jag har!

då provar vi detta

Please download SilentRunners from here:
http://www.silentrunners.org/Silent%20Runners.zip
Unzip it to the desktop and double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, a message will pop up and a logfile will have been created on the desktop. Please post the entire contents of this logfile for me to see.

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SweetIM" = "C:\Program\Macrogaming\SweetIM\SweetIM.exe" [file not found]
"msnmsgr" = "~"C:\Program\MSN Messenger\msnmsgr.exe" /background" [file not found]
"Steam" = ""c:\program\steam\steam.exe" -silent" ["Valve Corporation"]
"updateMgr" = ""C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run \ {++}
"F-Secure Manager" = ""C:\Program\Telia\Telias Sakerhetstjanster\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
"F-Secure TNB" = ""C:\Program\Telia\Telias Sakerhetstjanster\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
"F-Secure Startup Wizard" = ""C:\Program\Telia\Telias Sakerhetstjanster\FSGUI\FSSW.EXE" /reboot" ["F-Secure Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"SsAAD.exe" = "C:\Program\Sony\SONICS~1\SsAAD.exe" [null data]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"

HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}\(Default) = "SWEETIE"
-> {HKLM...CLSID} = "SWEETIE Class"
\InProcServer32\(Default) = "C:\Program\MACROG~1\SWEETI~1\toolbar.dll" ["Macrogaming"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Windows Live Sign-in Helper"
\InProcServer32\(Default) = "C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program\google\googletoolbar2.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Kontrollpanelstillägg för bildskärmspanorering"
-> {HKLM...CLSID} = "Kontrollpanelstillägg för bildskärmspanorering"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-ikontillägg"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play-enheter"
-> {HKLM...CLSID} = "Universal Plug and Play-enheter"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\Program\MICROS~4\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\Program\MICROS~4\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Mina delade mappar"
\InProcServer32\(Default) = "C:\Program\MSN Messenger\fsshext.8.0.0812.00.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program\Delade filer\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandler s\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandler s\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMen uHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHa ndlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program\WinRAR\rarext.dll" [null data]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellState


Startup items in "Andreas" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\All Users\Start-meny\Program\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"hp psc 2000 Series" -> shortcut to: "C:\Program\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe" ["Hewlett-Packard Co."]
"hpoddt01.exe" -> shortcut to: "C:\Program\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"Telias säkerhetstjänster" -> shortcut to: "C:\Program\Telia\Telias Sakerhetstjanster\backweb\7836882\Program\fspex.ex e -startup" ["BackWeb Technologies Inc. "]


Enabled Scheduled Tasks:
------------------------

"FRU Task #Hewlett-Packard#hp psc 2170 series#1167516373" -> launches: "C:\Program\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I "#Hewlett-Packard#hp psc 2170 series#1167516373"" [empty string]
"Scheduled scanning task" -> launches: "C:\Program\Telia\TELIAS~1\ANTI-V~1\fsav.exe /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\Program\Telia\TELIAS~1\ANTI-V~1\report.txt " ["F-Secure Corporation"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}"
-> {HKLM...CLSID} = "SweetIM For Internet Explorer"
\InProcServer32\(Default) = "C:\Program\Macrogaming\SweetIMBarForIE\toolbar.dl l" ["Macrogaming"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program\google\googletoolbar2.dll" ["Google Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}" = (no title provided)
-> {HKLM...CLSID} = "SweetIM For Internet Explorer"
\InProcServer32\(Default) = "C:\Program\Macrogaming\SweetIMBarForIE\toolbar.dl l" ["Macrogaming"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program\google\googletoolbar2.dll" ["Google Inc."]

Explorer Bars


så!

jag behöver inte få någon mer hjläp för jag sökte med kasperrsky online scanner igen och då hittde den bara en irc worm som jag tog bort så jag har inga trojaner längre. TACK MannenGbg för all hjläp!!!

Jävlar, en tråd på 6 sidor som nästan enbart är massa loggar Vad hände med diskussionsunderlag?

Jag måste få fråga dig. Tycker du att de andra trådarna som ligger i Datavirus & trojaner är så jävligt intressanta?

"Jag vill hacka skolans huvud data, yee haxxa jaaa!!!" är så mycket bättre än denna tråd?