Virus, Trojaner, Spyware ?

HairFU

Virustotal geht hier leider im moment nicht.

Hier mal die Ergebnisse der anderen Programme:

ComboFix 08-02-15.1 - HairFU 2008-02-14 22:36:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.1029 [GMT 1:00]
ausgeführt von:: E:\zum löschen\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fbjrosio.dll
C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\wowfx.dll
C:\Dokumente und Einstellungen\All Users\Desktop\UUSEE~1.LNK
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\autorun.exe
C:\Dokumente und Einstellungen\All Users\Startmenü\UUSEE~1.LNK
C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\printer.exe
C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\ultra
C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\ultra\uninstall.bat
C:\Dokumente und Einstellungen\HairFU\Startmenü\Programme\Autostart\findfast.exe
C:\Programme\newdotnet
C:\Programme\SystemDefender
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\btusllaj.ini
C:\WINDOWS\system32\cebknpyp.dll
C:\WINDOWS\system32\dvhjmosu.dll
C:\WINDOWS\system32\dyummpla.dll
C:\WINDOWS\system32\ehjgpaas.ini
C:\WINDOWS\system32\fbjrosio.dll
C:\WINDOWS\system32\fbjrosio.dllbox
C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\ffhkj.ini2
C:\WINDOWS\system32\hkxvtidv.ini
C:\WINDOWS\system32\ieupdates.exe
C:\WINDOWS\system32\jallsutb.dll
C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\kzhrthpr.dllbox
C:\WINDOWS\system32\ntload.sys
C:\WINDOWS\system32\pgbkfdek.dll
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\saapgjhe.dll
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\swfpvmmh.dll
C:\WINDOWS\system32\vditvxkh.dll
C:\WINDOWS\system32\windows
C:\WINDOWS\system32\winsrc.dll
C:\WINDOWS\system32\xlibgfl254.dll
C:\WINDOWS\system32\xpsghtxm.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NNSERV
-------\LEGACY_NPF
-------\LEGACY_NTLOAD
-------\NNServ
-------\ntload


((((((((((((((((((((((( Dateien erstellt von 2008-01-15 bis 2008-02-15 ))))))))))))))))))))))))))))))
.

2008-02-14 18:42 . 2008-02-14 18:42 10,240 --a------ C:\Programme\tmp119343.exe
2008-02-14 17:12 . 2008-02-14 17:12 <DIR> d-------- C:\Programme\EasySpywareCleaner
2008-02-14 17:12 . 2008-02-14 17:12 <DIR> d-------- C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\EasySpywareCleaner.com
2008-02-14 16:52 . 2008-02-14 17:49 240,128 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-02-14 16:52 . 2008-02-14 16:52 10,240 --a------ C:\Programme\tmp75390.exe
2008-02-14 16:52 . 2008-02-14 16:52 10,240 --a------ C:\Programme\tmp75375.exe
2008-02-14 16:52 . 2008-02-14 16:52 10,240 --a------ C:\Programme\tmp75359.exe
2008-02-14 16:52 . 2008-02-14 16:52 10,240 --a------ C:\Programme\tmp74515.exe
2008-02-14 07:18 . 2008-02-14 07:18 45,061 --a------ C:\Programme\tmp100078.exe
2008-02-13 23:05 . 2008-02-13 23:05 <DIR> d-------- C:\Programme\SysCleaner
2008-02-13 21:03 . 2008-02-13 21:03 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2008-02-13 21:02 . 2008-02-13 21:02 <DIR> d-------- C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\SUPERAntiSpyware.com
2008-02-13 20:54 . 2008-02-13 20:54 3,262 --a------ C:\WINDOWS\system32\sex2.ico
2008-02-13 20:53 . 2008-02-13 20:53 3,262 --a------ C:\WINDOWS\system32\sex1.ico
2008-02-11 16:07 . 2008-02-11 16:52 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-05 19:58 . 2008-02-05 19:58 <DIR> d-------- C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\Nero
2008-02-05 19:56 . 2008-02-05 19:56 <DIR> d-------- C:\Programme\Nero
2008-02-05 19:56 . 2008-02-05 19:57 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Nero
2008-02-05 19:56 . 2008-02-05 19:56 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 21:32 --------- d-----w C:\Programme\Firefox
2008-02-14 19:45 --------- d-----w C:\Programme\Mozilla Thunderbird
2008-02-14 06:08 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-13 21:36 --------- d-----w C:\Programme\Google
2008-02-13 20:01 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-02-08 23:43 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-02-08 22:55 85,504 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-02-05 18:48 --------- d-----w C:\Programme\Ahead
2008-01-14 14:18 --------- d-----w C:\Dokumente und Einstellungen\HairFU\Anwendungsdaten\Music Recognition
2007-12-20 01:03 --------- d-----w C:\Programme\SystemRequirementsLab
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-13 18:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-07 01:06 665,088 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 10:29 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-12-05 10:29 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2007-12-04 18:40 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-12-03 17:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
2007-09-26 13:00 220 -csh--w C:\WINDOWS\dwin.sys
2005-05-13 16:12 217,073 -csha-r C:\WINDOWS\meta4.exe
2005-07-14 11:31 27,648 -csha-r C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 14:32 616,448 -csha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-21 21:37 45,568 -csha-r C:\WINDOWS\system32\cygz.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\system32\i420vfw.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2005-02-28 12:16 240,128 -csha-r C:\WINDOWS\system32\x.264.exe
2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\system32\yv12vfw.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:57 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 19:10 1688872]
"SUPERAntiSpyware"="E:\Programme\AntiSpy\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"NeroFilterCheck"="C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NBKeyScan"="C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]
"MSDrive"="C:\WINDOWS\system32\drvpes.dll" [ ]
"QuickTime Task"="E:\Programme\QuickTime\qttask.exe" [2006-09-01 15:57 282624]
"EasySpywareCleaner"="C:\Programme\EasySpywareCleaner\EasySpywareCleaner.exe" [2007-12-25 17:34 305490]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:57 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= E:\Programme\AntiSpy\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SetupBoot"= {09bf27b7-4406-4b7c-ab1c-869a7595677c} - C:\WINDOWS\Installer\{09bf27b7-4406-4b7c-ab1c-869a7595677c}\SetupBoot.dll [2008-02-13 20:52 14374]
"zip"= {4839523e-77fb-4080-af02-bf89d4d99e5a} - C:\WINDOWS\Installer\{4839523e-77fb-4080-af02-bf89d4d99e5a}\zip.dll [2008-02-14 18:43 38438]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
E:\Programme\AntiSpy\SASWINLO.dll 2007-04-19 13:41 294912 E:\Programme\AntiSpy\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kzhrthpr]
kzhrthpr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwea32]
winwea32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^F-Secure 2006.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\F-Secure 2006.lnk
backup=C:\WINDOWS\pss\F-Secure 2006.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Ralink Wireless Utility.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Ralink Wireless Utility.lnk
backup=C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^HairFU^Startmenü^Programme^Autostart^Office-Start.lnk]
path=C:\Dokumente und Einstellungen\HairFU\Startmenü\Programme\Autostart\Office-Start.lnk
backup=C:\WINDOWS\pss\Office-Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2005-06-23 20:33 57344 E:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-03 23:57 15360 C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a--c--- 2004-01-14 02:10 409600 C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDonkey2000]
E:\Programme\eDonkey2000\eDonkey2000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
C:\Programme\F-Secure Internet Security\Common\FSM32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Startup Wizard]
C:\Programme\F-Secure Internet Security\FSGUI\FSSW.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
C:\Programme\F-Secure Internet Security\TNB\TNBUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google IME Autoupdater]
--a------ 2007-10-23 03:54 275952 C:\Programme\Google\Google Pinyin\GooglePinyinDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
E:\Programme\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 05:03 221184 C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 05:03 81920 C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mozilla Quick Launch]
--a------ 2005-07-28 08:27 98192 E:\Programme\Mozilla1.7.11\Mozilla.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 17:24 1694208 C:\Programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Programme\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\News Service]
C:\Programme\F-Secure Internet Security\FSGUI\ispnews.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-10-04 17:14 81920 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
--a------ 2007-04-12 15:49 3741264 E:\Programme\Pando Networks\Pando\Pando.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-12-05 16:02 217088 E:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
c:\powerstrip\pstrip.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 E:\Programme\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 E:\Programme\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Programme\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-11-10 13:03 36975 C:\Programme\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-02-14 23:11 185896 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11]
R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-01-08 09:22]
R1 Ext2Fsd;Linux ext2 File system driver;C:\WINDOWS\system32\Drivers\ext2fsd.sys [2005-07-27 08:45]
R1 tvtool;tvtool;E:\TVTool\tvtool.sys [1996-04-03 19:33]
R2 EZUSB;Cypress General Purpose USB Driver (ezusb.sys);C:\WINDOWS\system32\Drivers\ezusb.sys [2003-04-04 03:53]
R3 PsxPortEnumerator;Psx Port Enumerator;C:\WINDOWS\system32\Drivers\psxenum.sys [2002-09-26 05:36]
S2 EZUSBDEV;Cypress General Purpose USB Driver w/ Keil Monitor (ezusb.sys);C:\WINDOWS\system32\Drivers\ezusb.sys [2003-04-04 03:53]
S2 GAUCLow;USB Composite Device;C:\WINDOWS\system32\DRIVERS\GAUCLow.sys [2005-01-29 09:37]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []
S3 padenum;Enumerador de dispositivos de NTPAD;C:\WINDOWS\system32\DRIVERS\padenum.sys []
S3 PSXGamepadEnabler;Psx Hid to Gamepad Port Enabler;C:\WINDOWS\system32\drivers\psxpad.sys [2002-05-15 13:24]
S3 VendorJoystickEnabler;Driver para joystick paralelo de consola;C:\WINDOWS\system32\drivers\ntpad.sys []
S3 zlportio;zlportio;E:\Spiele\UltraStar Deluxe1-1\zlportio.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-15 22:43:13
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{09bf27b7-4406-4b7c-ab1c-869a7595677c}\SetupBoot.dll
-> C:\WINDOWS\Installer\{4839523e-77fb-4080-af02-bf89d4d99e5a}\zip.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\64power.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\serverserver.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\lookhost.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\32sv.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\serverhost.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\synpower.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\1664.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\winmon.exe
C:\DOKUME~1\HairFU\LOKALE~1\Temp\16sys.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-02-15 22:44:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-15 21:44:12
.
2008-02-13 21:28:19 --- E O F ---



SmitFraudFix v2.288

Scan done at 17:42:29,31, 14.02.2008
Run from E:\zum l”schen\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

10.18.250.4 ad.doubleclick.net
10.18.250.4 ad.fastclick.net
10.18.250.4 ads.fastclick.net
10.18.250.4 ar.atwola.com
10.18.250.4 atdmt.com
10.18.250.4 avp.ch
10.18.250.4 avp.com
10.18.250.4 avp.ru
10.18.250.4 awaps.net
10.18.250.4 banner.fastclick.net
10.18.250.4 banners.fastclick.net
10.18.250.4 ca.com
10.18.250.4 click.atdmt.com
10.18.250.4 clicks.atdmt.com
10.18.250.4 customer.symantec.com
10.18.250.4 dispatch.mcafee.com
10.18.250.4 download.mcafee.com
10.18.250.4 downloads-us1.kaspersky-labs.com
10.18.250.4 downloads-us2.kaspersky-labs.com
10.18.250.4 downloads-us3.kaspersky-labs.com
10.18.250.4 downloads1.kaspersky-labs.com
10.18.250.4 downloads2.kaspersky-labs.com
10.18.250.4 downloads3.kaspersky-labs.com
10.18.250.4 downloads4.kaspersky-labs.com
10.18.250.4 engine.awaps.net
10.18.250.4 f-secure.com
10.18.250.4 fastclick.net
10.18.250.4 ftp.avp.ch
10.18.250.4 ftp.downloads1.kaspersky-labs.com
10.18.250.4 ftp.downloads2.kaspersky-labs.com
10.18.250.4 ftp.downloads3.kaspersky-labs.com
10.18.250.4 ftp.f-secure.com
10.18.250.4 ftp.kasperskylab.ru
10.18.250.4 ftp.sophos.com
10.18.250.4 ids.kaspersky-labs.com
10.18.250.4 kaspersky-labs.com
10.18.250.4 kaspersky.com
10.18.250.4 liveupdate.symantec.com
10.18.250.4 liveupdate.symantecliveupdate.com
10.18.250.4 mast.mcafee.com
10.18.250.4 mcafee.com
10.18.250.4 media.fastclick.net
10.18.250.4 my-etrust.com
10.18.250.4 nai.com
10.18.250.4 networkassociates.com
10.18.250.4 norton.com
10.18.250.4 phx.corporate-ir.net
10.18.250.4 rads.mcafee.com
10.18.250.4 secure.nai.com
10.18.250.4 securityresponse.symantec.com
10.18.250.4 service1.symantec.com
10.18.250.4 sophos.com
10.18.250.4 spd.atdmt.com
10.18.250.4 symantec.com
10.18.250.4 trendmicro.com
10.18.250.4 update.symantec.com
10.18.250.4 updates.symantec.com
10.18.250.4 updates1.kaspersky-labs.com
10.18.250.4 updates2.kaspersky-labs.com
10.18.250.4 updates3.kaspersky-labs.com
10.18.250.4 updates4.kaspersky-labs.com
10.18.250.4 updates5.kaspersky-labs.com
10.18.250.4 us.mcafee.com
10.18.250.4 vil.nai.com
10.18.250.4 viruslist.com
10.18.250.4 viruslist.ru
10.18.250.4 virusscan.jotti.org
10.18.250.4 virustotal.com
10.18.250.4 www.avp.ch
10.18.250.4 www.avp.com
10.18.250.4 www.avp.ru
10.18.250.4 www.awaps.net
10.18.250.4 www.ca.com
10.18.250.4 www.f-secure.com
10.18.250.4 www.fastclick.net
10.18.250.4 www.grisoft.com
10.18.250.4 www.kaspersky-labs.com
10.18.250.4 www.kaspersky.com
10.18.250.4 www.kaspersky.ru
10.18.250.4 www.mcafee.com
10.18.250.4 www.my-etrust.com
10.18.250.4 www.nai.com
10.18.250.4 www.networkassociates.com
10.18.250.4 www.sophos.com
10.18.250.4 www.symantec.com
10.18.250.4 www.trendmicro.com
10.18.250.4 www.viruslist.com
10.18.250.4 www.viruslist.ru
10.18.250.4 www.virustotal.com

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\shell.exe Deleted
C:\WINDOWS\system32\ctfmona.exe Deleted
C:\WINDOWS\system32\printer.exe Deleted
C:\WINDOWS\system32\spoolvs.exe Deleted
C:\DOKUME~1\HairFU\STARTM~1\PROGRA~1\AUTOST~1\findfast.exe Deleted
C:\DOKUME~1\ALLUSE~1\STARTM~1\PROGRA~1\AUTOST~1\autorun.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2A9671EE-52C1-4FE1-BAAF-691D581BC46A}: NameServer=192.169.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B03FABEE-A9FD-4A66-B905-CD4C6CD37BFC}: NameServer=192.169.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2A9671EE-52C1-4FE1-BAAF-691D581BC46A}: NameServer=192.169.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B03FABEE-A9FD-4A66-B905-CD4C6CD37BFC}: NameServer=192.169.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{29AD6F52-847F-447F-AF37-15A47A9231B9}: NameServer=192.169.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B03FABEE-A9FD-4A66-B905-CD4C6CD37BFC}: NameServer=192.169.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{2A9671EE-52C1-4FE1-BAAF-691D581BC46A}: NameServer=192.169.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B03FABEE-A9FD-4A66-B905-CD4C6CD37BFC}: NameServer=192.169.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End