Hej har kommit ett konstigt fel på datorn.. Webläsaren dör så fort jag ska försöka ladda ner eller öppna en länk som innehåller spyware. Har försökt att ladde ner adaware men det går inte då stänger den ner webläsaren både firefox och explore.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:33:08, on 2010-01-24Platform: Windows Vista (WinNT 6.00.1904)MSIE: Internet Explorer v7.00 (7.00.6000.16916)Boot mode: NormalRunning processes:CWindows\system32\Dwm.exeCWindows\Explo
rer.EXECWindows\system32\taskeng.exeCProgram Files\Common Files\microsoft shared\DAO\NYDATOR-DATOR\SVCHOST.EXECProgram Files\Java\jre6\bin\jusched.exeCProgram Files\Windows Live\Messenger\msnmsgr.exeCProgram Files\Personal\bin\Personal.exeCProgram Files\Common Files\Symantec Shared\ccSvcHst.exeCProgram Files\Mozilla Firefox\firefox.exeCProgram Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - CProgram Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - CPROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dllO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - CProgram Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllO2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - CProgram Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - CProgram Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - CProgram Files\Windows Live\Toolbar\wltcore.dllO3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - CProgram Files\Windows Live\Toolbar\wltcore.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [ccApp] "CProgram Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [User Themes] CProgram Files\Common Files\microsoft shared\DAO\NYDATOR-DATOR\SVCHOST.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] "CProgram Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "CProgram Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "CProgram Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Adobe ARM] "CProgram Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKCU\..\Run: [msnmsgr] "CProgram Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJÄNST&#39O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJÄNST&#39O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NÄTVERKSTJÄNST&#39O4 - Global Startup: BankID säkerhetsprogram.lnk = CProgram Files\Personal\bin\Personal.exeO4 - Global Startup: Microsoft Office.lnk = CProgram Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xportera till Microsoft Excel - res://CPROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: Blogga detta - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - CProgram Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &Blogga detta i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - CProgram Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: Betway Casino - {3063c161-2f7e-4225-ba73-08bc8f64c67e} - CBetway\Casino\casinogame.exeO9 - Extra button: Betway.com Poker - {4CBB5C71-1BA0-49ca-93CD-159AF8AA0CC9} - CBetway\Poker\MPPoker.exeO9 - Extra button: Casino Classic - {02577FFA-4CA0-4C47-88C7-9CB891FE4B8E} - CMicrogaming\Casino\CasinoClassic\casinogame.exe (HKCU)O9 - Extra button: Mummys Gold Casino - {0CA711BF-6769-4A79-B876-CCADF491F69B} - CMicrogaming\Casino\MummysGoldCasino\casinogame.e
xe (HKCU)O9 - Extra button: Lucky Nugget Casino - {1EB67987-0BF5-40F5-82F3-C1F72E736C3E} - CMicrogaming\Casino\LuckyNugget\casinogame.exe (HKCU)O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/g
p.cabO23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - CWindows\system32\agrsmsvc.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - CProgram Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - CProgram Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - CProgram Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - CProgram Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: LiveUpdate - Symantec Corporation - CProgram Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - CProgram Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Core LC - Unknown owner - CPROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe-
-End of file - 6102 bytes

Jag klickade på länken och körde progamet och sen tryckte på y. datorn startade om och problem kvarstår..

jaha du mennar såå..
nej har ingen anning om den filen.
12:32:01:654 1508 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:2512:32:01:654 1508 =================================================
===============================12:32:01:654 1508 SystemInfo:12:32:01:654 1508 OS Version: 6.0.6000 ServicePack: 0.012:32:01:654 1508 Product type: Workstation12:32:01:654 1508 ComputerName: NYDATOR-DATOR12:32:01:654 1508 UserName: NyDator12:32:01:654 1508 Windows directory: CWindows12:32:01:654 1508 Processor architecture: Intel x8612:32:01:654 1508 Number of processors: 112:32:01:654 1508 Page size: 0x100012:32:01:722 1508 Boot type: Normal boot12:32:01:722 1508 =================================================
===============================12:32:01:729 1508 UnloadDriverW: NtUnloadDriver error 212:32:01:729 1508 ForceUnloadDriverW: UnloadDriverW(klmd21) error 212:32:01:732 1508 MyNtCreateFileW: NtCreateFile(\??\CWindows\system32\drivers\klmd.s
ys) returned status 0000000012:32:12:959 1508 UtilityInit: KLMD drop and load success12:32:12:959 1508 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)12:32:12:959 1508 UtilityInit: KLMD open success12:32:12:959 1508 UtilityInit: Initialize success12:32:12:959 1508 12:32:12:959 1508 Scanning Services ...12:32:12:962 1508 CreateRegParser: Registry parser init started12:32:12:962 1508 CreateRegParser: DisableWow64Redirection error12:32:12:962 1508 wfopen_ex: Trying to open file CWindows\system32\config\system12:32:12:962 1508 MyNtCreateFileW: NtCreateFile(\??\CWindows\system32\config\system) returned status C000004312:32:12:962 1508 wfopen_ex: MyNtCreateFileW error 32 (C0000043)12:32:12:962 1508 wfopen_ex: Trying to KLMD file open12:32:12:962 1508 KLMD_CreateFileW: Trying to open file CWindows\system32\config\system12:32:12:962 1508 wfopen_ex: File opened ok (Flags 2)12:32:12:972 1508 CreateRegParser: HIVE_ADAPTER(CWindows\system32\config\system) init success: 130D5E812:32:12:972 1508 wfopen_ex: Trying to open file CWindows\system32\config\software12:32:12:974 1508 MyNtCreateFileW: NtCreateFile(\??\CWindows\system32\config\softwar
e) returned status C000004312:32:12:974 1508 wfopen_ex: MyNtCreateFileW error 32 (C0000043)12:32:12:974 1508 wfopen_ex: Trying to KLMD file open12:32:12:974 1508 KLMD_CreateFileW: Trying to open file CWindows\system32\config\software12:32:12:974 1508 wfopen_ex: File opened ok (Flags 2)12:32:12:974 1508 CreateRegParser: HIVE_ADAPTER(CWindows\system32\config\software) init success: 130D61012:32:12:974 1508 CreateRegParser: EnableWow64Redirection error12:32:12:974 1508 CreateRegParser: RegParser init completed12:32:13:612 1508 GetAdvancedServicesInfo: Raw services enum returned 414 services12:32:13:617 1508 ScanTDL2Services: Exact detect Tdsshbecr (h: 0)12:32:13:617 1508 RegNode HKLM\SYSTEM\ControlSet001\services\Tdsshbecr infected by TDSS rootkit ... 12:32:13:619 1508 will be deleted on reboot12:32:13:619 1508 DeleteTDL2Service: SafeBoot Minimal doesn't infected12:32:13:619 1508 DeleteTDL2Service: SafeBoot Network doesn't infected12:32:13:637 1508 RegNode HKLM\SYSTEM\ControlSet003\services\Tdsshbecr infected by TDSS rootkit ... 12:32:13:639 1508 will be deleted on reboot12:32:13:657 1508 DeleteTDL2Service: SafeBoot Minimal doesn't infected12:32:13:659 1508 DeleteTDL2Service: SafeBoot Network doesn't infected12:32:13:659 1508 File CWindows\system32\DRIVERS\shbecr.sys infected by TDSS rootkit ... 12:32:13:659 1508 will be deleted on reboot12:32:13:659 1508 ScanTDL2Services: DeleteEvilService(Tdsshbecr) success12:32:13:662 1508 fclose_ex: Trying to close file CWindows\system32\config\system12:32:13:667 1508 fclose_ex: Trying to close file CWindows\system32\config\software12:32:13:667 1508 12:32:13:667 1508 Scanning Kernel memory ...12:32:13:669 1508 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk12:32:13:669 1508 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 841CD14812:32:13:669 1508 DetectCureTDL3: KLMD_GetDeviceObjectList returned 1 DevObjects12:32:13:669 1508 12:32:13:669 1508 DetectCureTDL3: DEVICE_OBJECT: 841EC51012:32:13:669 1508 KLMD_GetLowerDeviceObject: Trying to get lower device object for 841EC51012:32:13:669 1508 DetectCureTDL3: DEVICE_OBJECT: 840BFBB012:32:13:669 1508 KLMD_GetLowerDeviceObject: Trying to get lower device object for 840BFBB012:32:13:669 1508 KLMD_ReadMem: Trying to ReadMemory 0x840BFBB0[0x38]12:32:13:669 1508 DetectCureTDL3: DRIVER_OBJECT: 840ADBE812:32:13:669 1508 KLMD_ReadMem: Trying to ReadMemory 0x840ADBE8[0xA8]12:32:13:669 1508 KLMD_ReadMem: Trying to ReadMemory 0x840C5040[0x1A]12:32:13:669 1508 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi12:32:13:669 1508 DetectCureTDL3: IrpHandler (0) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (1) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (2) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (3) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (4) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (5) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (6) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (7) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler ( addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (9) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (10) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (11) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (12) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (13) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (14) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (15) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (16) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (17) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (1 addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (19) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (20) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (21) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (22) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (23) addr: 840451F812:32:13:669 1508 DetectCureTDL3: IrpHandler (24) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (25) addr: 8181D1D912:32:13:669 1508 DetectCureTDL3: IrpHandler (26) addr: 8181D1D912:32:13:669 1508 TDL3_FileDetect: Processing driver: atapi12:32:13:669 1508 TDL3_FileDetect: Processing driver file: CWindows\system32\drivers\atapi.sys12:32:13:669 1508 KLMD_CreateFileW: Trying to open file CWindows\system32\drivers\atapi.sys12:32:13:682 1508 TDL3_FileDetect: CWindows\system32\drivers\atapi.sys - Verdict: Clean12:32:13:682 1508 UtilityBootReinit: Reboot required for cure complete..12:32:13:684 1508 MyNtCreateFileW: NtCreateFile(\??\CWindows\system32\drivers\klmdb.
sys) returned status 0000000012:32:13:697 1508 UtilityBootReinit: KLMD drop success12:32:13:697 1508 KLMD_ApplyPendList: Pending buffer(5EFB_6044, 424) dropped successfully12:32:13:697 1508 UtilityBootReinit: Cure on reboot scheduled successfully12:32:13:697 1508 12:32:13:697 1508 Completed12:32:13:699 1508 12:32:13:699 1508 Results:12:32:13:699 1508 Memory objects infected / cured / cured on reboot: 0 / 0 / 012:32:13:699 1508 Registry objects infected / cured / cured on reboot: 2 / 0 / 212:32:13:699 1508 File objects infected / cured / cured on reboot: 1 / 0 / 112:32:13:699 1508 12:32:13:712 1508 MyNtCreateFileW: NtCreateFile(\??\CWindows\system32\drivers\klmd.s
ys) returned status 0000000012:32:13:712 1508 UtilityDeinit: KLMD(ARK) unloaded successfully