Rizzla Skrevet 10. april 2009 Rapporter Del Skrevet 10. april 2009 Hei, jeg sitter med en acer bærbar pc som har blitt infisert av stuff. Fant trojane hester og kunne ikke komme skikkelig på nett (redirect til localhost el 127.0.0.1) Nå har jeg kørt en masse programmer og lurer på om det er mer jeg bør gjøre? Er denne pc nå friskmeldt eller bør jeg gi den en dag sykemelding til?? MBAM: Malwarebytes' Anti-Malware 1.36 Databaseversjon: 1961 Windows 6.0.6001 Service Pack 1 10.04.2009 17:29:23 mbam-log-2009-04-10 (17-29-23).txt Skanntype: Full Skann (C:\|D:\|) Objekter skannet: 163028 Tid tilbakelagt: 2 hour(s), 46 minute(s), 9 second(s) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 0 Registerverdier infisert: 0 Registerfiler infisert: 0 Mapper infisert: 0 Filer infisert: 0 Minneprosesser infisert: (Ingen mistenkelige filer funnet) Minnemoduler infisert: (Ingen mistenkelige filer funnet) Registernøkler infisert: (Ingen mistenkelige filer funnet) Registerverdier infisert: (Ingen mistenkelige filer funnet) Registerfiler infisert: (Ingen mistenkelige filer funnet) Mapper infisert: (Ingen mistenkelige filer funnet) Filer infisert: (Ingen mistenkelige filer funnet) ComboFix: ComboFix 09-04-04.01 - Bruker 2009-04-10 17:32:52.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.1919.894 [GMT 1:00] Kjører fra: c:\users\Bruker\Desktop\ComboFix.exe AV: Norman Security Suite ver. 7.00 *On-access scanning disabled* (Updated) FW: Personlig brannmur *disabled* . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\tmp.reg . ((((((((((((((((((((((((((( Filer Opprettet Fra 2009-03-10 til 2009-04-10 ))))))))))))))))))))))))))))))))) . 2009-04-10 12:42 . 2009-04-10 12:42 d-------- C:\VundoFix Backups 2009-04-10 12:28 . 2009-04-10 12:28 d-------- c:\program files\Secunia 2009-04-10 12:25 . 2008-11-06 02:03 d-------- C:\SDFix 2009-04-10 11:57 . 2009-04-10 11:57 d-------- c:\program files\Norton Security Scan 2009-04-10 11:26 . 2009-04-10 11:26 d-------- c:\users\Bruker\AppData\Roaming\SUPERAntiSpyware.com 2009-04-10 11:26 . 2009-04-10 11:26 d-------- c:\program files\SUPERAntiSpyware 2009-04-10 11:26 . 2009-04-10 11:26 d-------- c:\progra~2\SUPERAntiSpyware.com 2009-04-10 11:25 . 2009-04-10 11:25 d-------- c:\program files\Common Files\Wise Installation Wizard 2009-04-10 11:18 . 2009-04-10 11:18 d-------- c:\program files\CCleaner 2009-04-10 06:09 . 2009-04-10 06:42 d-------- c:\users\Bruker\DoctorWeb 2009-03-25 20:07 . 2009-03-25 20:07 d-------- c:\progra~2\SPAMfighter 2009-03-24 23:12 . 2009-03-24 23:12 d-------- c:\progra~2\Office Genuine Advantage 2009-03-24 22:56 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-03-24 22:56 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-03-24 22:56 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-03-24 22:56 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-03-24 22:56 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-03-24 22:56 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-03-24 22:56 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-03-24 22:56 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-03-24 22:50 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-03-24 22:50 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-03-24 22:50 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-03-24 22:49 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-03-24 22:49 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-03-24 19:14 . 2009-03-24 19:14 d-------- c:\windows\System32\Adobe 2009-03-24 12:03 . 2009-03-24 12:03 7,808 --a------ c:\windows\System32\drivers\psi_mf.sys 2009-03-17 17:09 . 2009-04-10 12:33 410,984 --a------ c:\windows\System32\deploytk.dll 2009-03-15 20:28 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-15 20:28 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-15 20:28 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll 2009-03-15 20:28 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-15 20:28 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-15 20:28 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-10 12:43 --------- d-----w c:\users\Bruker\AppData\Roaming\OpenOffice.org2 2009-04-10 12:43 --------- d-----w c:\program files\Norman 2009-04-10 11:33 --------- d-----w c:\program files\Java 2009-04-10 10:57 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-04-06 14:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 14:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-03-17 15:53 --------- d-----w c:\program files\Windows Mail 2009-03-16 23:20 --------- d-----w c:\progra~2\Microsoft Help 2009-02-13 02:10 --------- d-----w c:\program files\Google 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2008-01-18 04:28 174 --sha-w c:\program files\desktop.ini 2007-12-26 19:18 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-12-26 19:18 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-12-26 19:18 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( SnapShot@2009-04-10_11.14.40.79 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-10 16:32:35 6,438,912 ----a-w c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT + 2009-04-10 10:57:40 29,184 ----a-r c:\windows\Installer\{6FF543AB-99B3-4120-902C-70A38314ABD8}\Icon3FADAA191.exe + 2009-04-10 10:26:37 18,944 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe + 2009-04-10 10:26:38 65,024 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe - 2009-04-10 10:51:41 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-04-10 12:43:25 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-04-10 10:51:41 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-04-10 12:43:25 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-04-10 10:13:36 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2009-04-10 12:45:08 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2009-04-10 12:45:08 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-04-10 10:13:30 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-04-10 16:35:52 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-04-10 16:35:52 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-04-10 10:08:55 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-04-10 16:24:07 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-04-10 10:08:55 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-04-10 16:24:07 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-04-10 10:08:55 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-04-10 16:24:07 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-03-17 16:08:51 144,792 ----a-w c:\windows\System32\java.exe + 2009-04-10 11:33:55 144,792 ----a-w c:\windows\System32\java.exe - 2009-03-17 16:08:51 144,792 ----a-w c:\windows\System32\javaw.exe + 2009-04-10 11:33:55 144,792 ----a-w c:\windows\System32\javaw.exe - 2009-03-17 16:08:51 148,888 ----a-w c:\windows\System32\javaws.exe + 2009-04-10 11:33:55 148,888 ----a-w c:\windows\System32\javaws.exe - 2009-03-24 22:07:26 6,553,600 ----a-w c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT + 2009-04-10 12:56:55 6,553,600 ----a-w c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT - 2009-04-10 10:54:04 46,180 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-04-10 12:45:26 46,180 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-03-24 22:01:37 201,264,159 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2009-04-10 12:56:40 202,828,800 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin . -- Snapshot resatt til dagens dato -- . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-07 39408] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-26 161328] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-03-26 1057328] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784] "ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-23 815104] "ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2006-12-12 106496] "ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2007-09-22 37232] "ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2007-09-22 33136] "PowerForPhone"="c:\program files\PowerForPhone\PowerForPhone.exe" [2007-01-15 778240] "NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 2658304] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2009-02-11 187504] "NPCTray"="c:\program files\Norman\npc\bin\npc_tray.exe" [2007-09-17 126008] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-10 148888] "RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 c:\windows\RtHDVCpl.exe] c:\users\Bruker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-09-11 393216] c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{722176B6-D34F-4847-A3F0-F8E071925EB5}"= UDP:d:\limewire\LimeWire.exe:LimeWire "{4D10C10E-EAFF-4570-BF90-ADB93842E4D3}"= TCP:d:\limewire\LimeWire.exe:LimeWire "{349AE32F-28C0-4778-AFCA-8CE817BA9C4F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{8F912A39-A212-4BC0-8B25-554FD4870F23}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{199AFA71-4D42-4462-BF23-14E85CDC7DF0}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{81D684EA-A344-4965-9039-087CC4F7198F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{6D19F1B3-728F-4C9E-9915-5D5D0CEE8B3B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{75CB9224-9EEB-4C25-9B6D-8756AA0F6C20}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) "DoNotAllowExceptions"= 1 (0x1) P2 NPFSvc32;Norman Personal Firewall Service;c:\program files\Norman\Npf\Bin\npfsvc32.exe [2008-09-19 597104] R1 ALE_NF;Norman Firewall ALE driver;c:\windows\System32\drivers\ale_nf.sys [2008-01-15 42552] R1 NPROSEC;Norman Security driver;c:\program files\Norman\Ngs\Bin\nprosec.sys [2008-01-15 53816] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944] R2 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2007-12-22 20448] R2 NPROSECSVC;Norman Security service;c:\program files\Norman\Ngs\Bin\nprosec.exe [2008-01-15 121912] R2 NVOY;Norman Resource Provider;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-01-15 126008] R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-02-07 24576] R3 Atc002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller;c:\windows\System32\drivers\L260x86.sys [2006-12-13 25600] R3 NPC;Norman Parental Control;c:\program files\Norman\Npc\Bin\npcsvc32.exe [2008-01-15 416880] R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-01-15 183352] R3 NUAA;Norman User Activity Agent;c:\program files\Norman\Npc\Bin\nuaa.exe [2008-01-15 117816] R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2007-12-22 154680] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408] R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\System32\drivers\StkCMini.sys [2007-02-13 1245056] S1 NGS;Norman General Security Driver;c:\program files\Norman\Ngs\Bin\ngs.sys [2007-12-27 22712] S3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2007-12-21 19512] S3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\nvc\bin\Nvcoas.exe [2007-12-21 195640] S3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [2009-03-24 7808] --- Andre tjenester/drivere lastet i minnet --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static] msiexec /fums {6173A4FC-D42D-69A6-52CA-A30496389760} /qb . . ------- Tilleggsskanning ------- . IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: c:\program files\Norman\npc\bin\nlf.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-10 17:36:01 Windows 6.0.6001 Service Pack 1 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** . Tidspunkt ferdig: 2009-04-10 17:38:53 ComboFix-quarantined-files.txt 2009-04-10 16:38:50 ComboFix2.txt 2009-04-10 10:17:04 Pre-Run: 35 406 712 832 byte ledig Post-Run: 35,389,353,984 byte ledig 219 --- E O F --- 2009-04-10 12:58:47 Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:43:59, on 10.04.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Program Files\Norman\Npm\Bin\Elogsvc.exe C:\Program Files\Norman\Ngs\bin\NPROSEC.EXE C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Norman\Npm\Bin\Zanda.exe C:\Program Files\Norman\npm\bin\nvoy.exe C:\Windows\system32\svchost.exe C:\Program Files\Norman\npf\bin\npfsvc32.exe C:\Program Files\ATK Hotkey\ASLDRSrv.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\ASUS\ATK Media\DMedia.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\ASUSTPE.exe C:\Windows\ASScrPro.exe C:\Program Files\ATK Hotkey\Hcontrol.exe C:\Program Files\ATKOSD2\ATKOSD2.exe C:\Program Files\Wireless Console 2\wcourier.exe C:\Program Files\P4G\BatteryLife.exe C:\Program Files\ASUS\Splendid\ACMON.exe C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Norman\Npm\Bin\Zlh.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Windows\System32\ACEngSvr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\ATK Hotkey\ATKOSD.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN C:\Windows\system32\svchost.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Windows\system32\svchost.exe C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe C:\Windows\system32\svchost.exe C:\Windows\System32\StkCSrv.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE C:\Program Files\Norman\Npm\bin\NJEEVES.EXE C:\Program Files\Norman\npc\bin\npcsvc32.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Norman\nse\bin\NSESVC.EXE C:\Program Files\Norman\npc\bin\nuaa.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Norman\Nvc\Bin\Nip.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Norman\npf\bin\npfuser.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\conime.exe C:\Windows\system32\notepad.exe C:\Windows\Explorer.exe C:\Hijackthis\run.exe C:\Windows\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [sMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ASUSTPE] C:\Windows\system32\ASUSTPE.exe O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH O4 - HKLM\..\Run: [NPCTray] C:\Program Files\Norman\npc\bin\npc_tray.exe /LOAD O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Elogsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Parental Control (NPC) - Norman ASA - C:\Program Files\Norman\npc\bin\npcsvc32.exe O23 - Service: Norman Personal Firewall Service (NPFSvc32) - Norman ASA - C:\Program Files\Norman\npf\bin\npfsvc32.exe O23 - Service: Norman Security service (NPROSECSVC) - Norman ASA - C:\Program Files\Norman\Ngs\bin\NPROSEC.EXE O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE O23 - Service: Norman User Activity Agent (NUAA) - Norman ASA - C:\Program Files\Norman\npc\bin\nuaa.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE O23 - Service: Norman Resource Provider (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe -- End of file - 12780 bytes SAS: SUPERAntiSpyware Skannlogg http://www.superantispyware.com Laget 04/10/2009 på 12:11 PM Applikasjon-versjon : 4.26.1000 Core Rules Databaseversjon : 3838 Trace Rules DatabaseVersjon: 1794 Skanntype : Komplett skann Total skanntid : 00:38:00 Minne-elementer skannet : 869 Minnetrusler oppdaget : 0 Registerelementer skannet : 7720 Registertrusler oppdaget : 0 Filer skannet : 27652 Filtrusler oppdaget : 0 Lenke til kommentar
snippsat Skrevet 10. april 2009 Rapporter Del Skrevet 10. april 2009 Ser bra ut,virker nettet nå? Lenke til kommentar
Rizzla Skrevet 10. april 2009 Forfatter Rapporter Del Skrevet 10. april 2009 Ser bra ut,virker nettet nå? jepp, men vil være 100% sikker på at den er helt ren.. Lenke til kommentar
snippsat Skrevet 10. april 2009 Rapporter Del Skrevet 10. april 2009 Ja sett igjennom combofix loggen og det ser greit ut. Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc. Sjekk om software er oppdatert Secunia Surf trygt. Lenke til kommentar
Rizzla Skrevet 10. april 2009 Forfatter Rapporter Del Skrevet 10. april 2009 Jepp, har kjørt secunia.. Er det noe norbit vil legge til? Lenke til kommentar
Bruker-158599 Skrevet 10. april 2009 Rapporter Del Skrevet 10. april 2009 (endret) ok. Endret 31. juli 2010 av riskake90 Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå