Logger til HJT, Combofix, MBAM som trenger en skjekk

[Pizzaen]

Hei Har lastet utrolig mye jeg ikke er sikker på i det siste så vill være helt sikker på at det ikke er noe i bakrunnen som driver og fanger opp tastetrykkene mine. Så her er noen logger:

 

MBAM

 

 

Malwarebytes' Anti-Malware 1.28

Database versjon: 1202

Windows 5.1.2600 Service Pack 3

 

24.09.2008 19:30:23

mbam-log-2008-09-24 (19-30-23).txt

 

Skanntype: Rask Skann

Objekter skannet: 49683

Tid tilbakelagt: 4 minute(s), 42 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

 

Combofix:

 

ComboFix 08-09-24.01 - Vegard 2008-09-24 19:37:28.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.486 [GMT 2:00]

Running from: C:\Documents and Settings\Vegard\Skrivebord\Combofix.exe

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Documents and Settings\Vegard\Programdata\.#\MBX@D7C@202C548.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@D7C@202C558.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@D7C@202C578.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@D7C@202DD68.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@D7C@202FB18.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@E74@202C548.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@E74@202C558.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@E74@202C578.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@E74@202DD68.###

C:\Documents and Settings\Vegard\Programdata\.#\MBX@E74@202FB18.###

 

.

((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 )))))))))))))))))))))))))))))))

.

 

2008-09-24 19:24 . 2008-09-24 19:24 <DIR> d-------- C:\Programfiler\Malwarebytes' Anti-Malware

2008-09-24 19:24 . 2008-09-24 19:24 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\Malwarebytes

2008-09-24 19:24 . 2008-09-24 19:24 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Malwarebytes

2008-09-24 19:24 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-09-24 19:24 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-09-24 19:10 . 2008-09-24 19:35 <DIR> dr-h----- C:\Documents and Settings\Vegard\Siste

2008-09-24 19:07 . 2008-09-24 19:07 <DIR> d-------- C:\Programfiler\Avira

2008-09-24 18:12 . 2008-09-24 18:51 <DIR> d-------- C:\Programfiler\SUPERAntiSpyware

2008-09-24 18:11 . 2008-09-24 18:11 <DIR> d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard

2008-09-24 18:10 . 2008-09-24 18:10 <DIR> d-------- C:\Programfiler\Tall Emu

2008-09-24 18:10 . 2008-09-24 19:44 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\OnlineArmor

2008-09-24 18:10 . 2008-09-24 18:10 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\OnlineArmor

2008-09-24 18:10 . 2008-04-17 05:25 80,584 --a------ C:\WINDOWS\system32\drivers\OADriver.sys

2008-09-24 18:10 . 2008-04-17 05:25 32,456 --a------ C:\WINDOWS\system32\drivers\OAmon.sys

2008-09-24 18:10 . 2008-04-17 05:25 28,872 --a------ C:\WINDOWS\system32\drivers\oanet.sys

2008-09-23 16:54 . 2008-09-23 16:54 <DIR> d-------- C:\Programfiler\TeamViewer3

2008-09-23 16:47 . 2008-09-23 16:47 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\TeamViewer

2008-09-23 16:46 . 2008-09-23 16:46 <DIR> d-------- C:\Documents and Settings\Vegard\temp

2008-09-22 21:45 . 2008-09-23 14:42 <DIR> d-------- C:\Programfiler\Incomplete

2008-09-22 11:45 . 2008-05-21 20:25 23,352 --a------ C:\WINDOWS\system32\drivers\pnpcap.sys

2008-09-22 11:44 . 2008-09-22 11:44 <DIR> d-------- C:\Programfiler\Pure Networks

2008-09-22 11:44 . 2008-09-22 11:44 <DIR> d-------- C:\Programfiler\Fellesfiler\Pure Networks Shared

2008-09-22 11:44 . 2008-09-22 11:45 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Pure Networks

2008-09-22 11:44 . 2008-05-16 06:10 25,272 --a------ C:\WINDOWS\system32\drivers\purendis.sys

2008-09-22 11:44 . 2008-05-16 06:10 23,992 --a------ C:\WINDOWS\system32\drivers\pnarp.sys

2008-09-20 20:21 . 2008-09-20 21:59 <DIR> d-------- C:\Documents and Settings\Mamma\Programdata\dvdcss

2008-09-20 20:11 . 2008-09-20 20:11 <DIR> d-------- C:\Documents and Settings\Mamma\Programdata\Windows Search

2008-09-20 20:01 . 2008-09-20 20:01 <DIR> d-------- C:\Documents and Settings\Mamma\Programdata\vlc

2008-09-18 14:59 . 2008-09-18 14:59 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll

2008-09-18 14:59 . 2008-09-18 14:59 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll

2008-09-18 14:58 . 2007-09-07 14:55 12,744 --a------ C:\WINDOWS\system32\drivers\Entech64.sys

2008-09-18 14:58 . 2007-09-07 14:55 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd

2008-09-18 14:58 . 2001-11-19 20:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys

2008-09-18 14:56 . 2008-09-18 14:56 <DIR> d-------- C:\Programfiler\Futuremark

2008-09-17 21:52 . 2008-09-17 21:52 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Avg8

2008-09-17 20:19 . 2008-09-17 20:19 <DIR> d-------- C:\WINDOWS\system32\Futuremark

2008-09-17 20:19 . 2008-09-17 20:19 <DIR> d-------- C:\Programfiler\Fellesfiler\Futuremark Shared

2008-09-17 20:19 . 2008-05-29 12:33 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys

2008-09-17 20:13 . 2008-09-18 15:58 <DIR> d-------- C:\Programfiler\RivaTuner v2.11

2008-09-17 20:12 . 2008-09-17 20:12 <DIR> d--h----- C:\WINDOWS\PIF

2008-09-16 15:55 . 2008-09-16 15:55 <DIR> d-------- C:\Documents and Settings\Vegard\SystemRequirementsLab

2008-09-16 15:48 . 2008-09-16 15:48 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\LogMeIn

2008-09-16 10:05 . 2008-09-16 10:05 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\vlc

2008-09-15 19:15 . 2008-09-20 20:19 <DIR> dr-h----- C:\Documents and Settings\Mamma\Siste

2008-09-13 17:09 . 2008-09-13 17:09 52,664 --ah----- C:\WINDOWS\system32\mlfcache.dat

2008-09-13 14:36 . 2008-09-13 14:36 250 --a------ C:\WINDOWS\gmer.ini

2008-09-12 11:49 . 2008-09-12 11:49 <DIR> d-------- C:\Programfiler\Microsoft Silverlight

2008-09-12 11:28 . 2008-09-12 11:28 268 --ah----- C:\sqmdata01.sqm

2008-09-12 11:28 . 2008-09-12 11:28 244 --ah----- C:\sqmnoopt01.sqm

2008-09-12 09:25 . 2008-09-23 21:36 <DIR> d-------- C:\Programfiler\mIRC

2008-09-12 09:25 . 2008-09-24 17:58 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\mIRC

2008-09-11 21:17 . 2008-09-11 21:18 <DIR> d-------- C:\Programfiler\iTunes

2008-09-11 21:17 . 2008-09-11 21:17 <DIR> d-------- C:\Programfiler\iPod

2008-09-11 21:17 . 2008-09-11 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-09-11 21:16 . 2008-09-11 21:16 <DIR> d-------- C:\Programfiler\QuickTime

2008-09-07 14:53 . 2008-09-07 14:53 <DIR> d-------- C:\Documents and Settings\Mamma\Programdata\ESET

2008-09-07 14:53 . 2008-09-07 14:53 <DIR> d-------- C:\Documents and Settings\Mamma\Programdata\ATI

2008-09-07 14:52 . 2008-08-28 16:14 <DIR> dr------- C:\Documents and Settings\Mamma\Start-meny

2008-09-07 14:52 . 2008-08-28 16:14 <DIR> d--h----- C:\Documents and Settings\Mamma\Skrivere

2008-09-07 14:52 . 2008-09-21 20:02 <DIR> d-------- C:\Documents and Settings\Mamma\Skrivebord

2008-09-07 14:52 . 2008-09-20 20:21 <DIR> dr-h----- C:\Documents and Settings\Mamma\Programdata

2008-09-07 14:52 . 2008-09-07 14:53 <DIR> dr------- C:\Documents and Settings\Mamma\Mine dokumenter

2008-09-07 14:52 . 2008-08-28 14:38 <DIR> d--h----- C:\Documents and Settings\Mamma\Maler

2008-09-07 14:52 . 2008-09-24 19:40 <DIR> d--h----- C:\Documents and Settings\Mamma\Lokale innstillinger

2008-09-07 14:52 . 2008-09-07 14:53 <DIR> dr------- C:\Documents and Settings\Mamma\Favoritter

2008-09-07 14:52 . 2008-08-28 16:14 <DIR> d--h----- C:\Documents and Settings\Mamma\AndrMask

2008-09-07 14:52 . 2008-09-16 21:16 <DIR> d-------- C:\Documents and Settings\Mamma

2008-09-06 21:34 . 2008-09-06 21:34 <DIR> d-------- C:\Programfiler\Audacity

2008-09-06 17:00 . 2008-09-24 19:41 <DIR> d--hs---- C:\Documents and Settings\Vegard\Programdata\.#

2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx

2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

2008-09-06 11:35 . 2008-09-06 11:35 <DIR> d-------- C:\Programfiler\Defraggler

2008-09-06 11:08 . 2008-09-06 11:08 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\Launchy

2008-09-05 12:17 . 2008-09-05 12:18 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

2008-08-31 19:54 . 2008-08-31 19:54 <DIR> d-------- C:\WINDOWS\Sun

2008-08-31 14:52 . 2008-08-31 16:06 <DIR> d-------- C:\Programfiler\Fellesfiler\AOL

2008-08-31 14:52 . 2008-08-31 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Viewpoint

2008-08-31 14:52 . 2008-08-31 14:55 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\AOL OCP

2008-08-31 14:52 . 2008-08-31 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\AOL

2008-08-31 14:52 . 2008-08-31 14:54 470 --ah----- C:\IPH.PH

2008-08-31 12:55 . 2008-08-31 12:55 317 --a------ C:\WINDOWS\game.ini

2008-08-31 12:46 . 2008-08-31 12:46 <DIR> d--hs---- C:\WINDOWS\ftpcache

2008-08-31 12:34 . 2008-08-31 12:34 <DIR> d-------- C:\Programfiler\DAMN NFO Viewer

2008-08-29 17:24 . 2008-08-29 17:24 <DIR> d-------- C:\Documents and Settings\Vegard\.thumbnails

2008-08-29 17:23 . 2008-09-23 18:34 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\gtk-2.0

2008-08-29 17:19 . 2008-08-29 17:19 <DIR> d-------- C:\Programfiler\GIMP-2.0

2008-08-29 17:19 . 2008-09-23 18:34 <DIR> d-------- C:\Documents and Settings\Vegard\.gimp-2.4

2008-08-29 13:52 . 2008-09-23 14:42 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\LimeWire

2008-08-29 12:31 . 2008-09-22 17:29 116 --a------ C:\WINDOWS\NeroDigital.ini

2008-08-29 12:17 . 2008-08-29 12:17 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\Windows Search

2008-08-29 11:42 . 2000-03-03 21:16 7,424 -ra------ C:\WINDOWS\system32\drivers\MMIOPORT.SYS

2008-08-29 11:39 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe

2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe

2008-08-29 10:17 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll

2008-08-29 10:17 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll

2008-08-29 10:17 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\WINDOWS\system32\dnssd.dll

2008-08-28 21:13 . 2008-08-28 21:13 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\FLEXnet

2008-08-28 20:42 . 2008-08-28 20:42 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\ESET

2008-08-28 20:39 . 2008-08-28 20:39 <DIR> d-------- C:\Programfiler\ESET

2008-08-28 20:39 . 2008-08-28 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\ESET

2008-08-28 20:36 . 2008-08-28 20:36 <DIR> d-------- C:\Programfiler\Safari

2008-08-28 20:36 . 2008-08-28 20:36 <DIR> d-------- C:\Programfiler\Apple Software Update

2008-08-28 17:56 . 2008-08-28 17:56 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\Ahead

2008-08-28 17:55 . 2008-08-28 17:55 <DIR> d-------- C:\Programfiler\Nero

2008-08-28 17:55 . 2008-08-28 17:55 <DIR> d-------- C:\Programfiler\Fellesfiler\Ahead

2008-08-28 17:46 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll

2008-08-28 17:44 . 2008-08-28 17:44 <DIR> d-------- C:\Programfiler\Microsoft Works

2008-08-28 17:43 . 2008-08-28 17:43 <DIR> d-------- C:\Programfiler\Microsoft.NET

2008-08-28 17:41 . 2008-08-28 17:41 <DIR> d-------- C:\Programfiler\Microsoft Visual Studio 8

2008-08-28 17:40 . 2008-08-28 17:44 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-08-28 17:40 . 2008-08-28 17:40 <DIR> dr-h----- C:\MSOCache

2008-08-28 17:40 . 2008-09-12 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Microsoft Help

2008-08-28 17:11 . 2008-09-24 18:12 <DIR> d-------- C:\Documents and Settings\Vegard\Programdata\SUPERAntiSpyware.com

2008-08-28 17:11 . 2008-08-28 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\SUPERAntiSpyware.com

2008-08-28 15:59 . 2008-08-28 17:44 <DIR> d-------- C:\Programfiler\MSBuild

2008-08-28 15:57 . 2008-08-28 15:57 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2008-08-28 15:57 . 2008-08-28 15:57 <DIR> d-------- C:\Programfiler\Reference Assemblies

2008-08-28 15:57 . 2007-09-27 10:48 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe

2008-08-28 15:57 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2008-08-28 15:51 . 2008-08-28 15:51 0 --a------ C:\WINDOWS\nsreg.dat

2008-08-28 15:49 . 2008-08-28 15:49 <DIR> d-------- C:\Programfiler\Realtek Sound Manager

2008-08-28 15:49 . 2008-08-28 15:49 <DIR> d-------- C:\Programfiler\Realtek AC97

2008-08-28 15:49 . 2008-08-28 15:49 <DIR> d-------- C:\Programfiler\AvRack

2008-08-28 15:48 . 2008-09-18 14:56 <DIR> d--h----- C:\Programfiler\InstallShield Installation Information

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-24 17:46 --------- d-----w C:\Documents and Settings\Vegard\Programdata\uTorrent

2008-09-24 17:44 --------- d-----w C:\Programfiler\Steam

2008-09-24 17:07 --------- d-----w C:\Documents and Settings\All Users\Programdata\Avira

2008-09-23 12:42 --------- d-----w C:\Programfiler\LimeWire

2008-09-11 19:16 --------- d-----w C:\Programfiler\Bonjour

2008-09-06 19:58 --------- d---a-w C:\Documents and Settings\All Users\Programdata\TEMP

2008-09-06 09:54 --------- d-----w C:\Programfiler\GCFScape

2008-08-31 14:06 --------- d-----w C:\Programfiler\DAEMON Tools Lite

2008-08-30 09:47 --------- d-----w C:\Documents and Settings\Vegard\Programdata\Apple Computer

2008-08-28 19:04 --------- d-----w C:\Programfiler\Unlocker

2008-08-28 15:04 --------- d-----w C:\Programfiler\Fellesfiler\Adobe

2008-08-28 14:58 --------- d-----w C:\Documents and Settings\All Users\Programdata\Apple Computer

2008-08-28 14:56 --------- d-----w C:\Programfiler\Fraps

2008-08-28 14:56 --------- d-----w C:\Programfiler\Fellesfiler\Macrovision Shared

2008-08-28 14:52 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-08-28 14:52 --------- d-----w C:\Documents and Settings\Vegard\Programdata\DAEMON Tools

2008-08-28 14:47 --------- d-----w C:\Programfiler\Windows Live

2008-08-28 14:45 --------- dcsh--w C:\Programfiler\Fellesfiler\WindowsLiveInstaller

2008-08-28 14:45 --------- d-----w C:\Programfiler\Red Kawa

2008-08-28 14:45 --------- d-----w C:\Documents and Settings\All Users\Programdata\WLInstaller

2008-08-28 14:44 --------- d-----w C:\Programfiler\CodeStuff

2008-08-28 14:42 --------- d-----w C:\Programfiler\Fellesfiler\Apple

2008-08-28 14:42 --------- d-----w C:\Documents and Settings\All Users\Programdata\Apple

2008-08-28 14:41 --------- d-----w C:\Programfiler\VideoLAN

2008-08-28 14:40 --------- d-----w C:\Programfiler\uTorrent

2008-08-28 14:40 --------- d-----w C:\Programfiler\Java

2008-08-28 14:40 --------- d-----w C:\Programfiler\Globe Software

2008-08-28 14:40 --------- d-----w C:\Programfiler\CCleaner

2008-08-28 14:39 --------- d-----w C:\Programfiler\Fellesfiler\Java

2008-08-28 14:32 --------- d-----w C:\Documents and Settings\Vegard\Programdata\ATI

2008-08-28 14:32 --------- d-----w C:\Documents and Settings\All Users\Programdata\ATI

2008-08-28 14:29 --------- d-----w C:\Programfiler\Windows Desktop Search

2008-08-28 14:29 --------- d-----w C:\Documents and Settings\Vegard\Programdata\Windows Desktop Search

2008-08-28 14:23 --------- d-----w C:\Documents and Settings\All Users\Programdata\Office Genuine Advantage

2008-08-28 14:20 --------- d-----w C:\Programfiler\ATI Technologies

2008-08-28 12:42 --------- d-----w C:\Programfiler\microsoft frontpage

2008-08-28 12:40 --------- d-----w C:\Programfiler\Fellesfiler\Tjenester

2008-08-28 12:40 --------- d-----w C:\Programfiler\Elektroniske tjenester

2008-08-28 12:38 --------- d-----w C:\Programfiler\Windows Media Connect 2

2008-08-01 06:38 3,266,560 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys

2008-08-01 05:40 9,928,704 ----a-w C:\WINDOWS\system32\atioglxx.dll

2008-08-01 04:58 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll

2008-08-01 04:33 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll

2008-08-01 04:32 311,296 ----a-w C:\WINDOWS\system32\ati2dvag.dll

2008-08-01 04:23 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll

2008-08-01 04:23 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll

2008-08-01 04:22 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll

2008-08-01 04:22 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe

2008-08-01 04:22 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll

2008-08-01 04:21 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe

2008-08-01 04:19 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL

2008-08-01 04:10 3,917,568 ----a-w C:\WINDOWS\system32\ati3duag.dll

2008-08-01 03:59 2,183,552 ----a-w C:\WINDOWS\system32\ativvaxx.dll

2008-08-01 03:46 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll

2008-08-01 03:42 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll

2008-08-01 03:40 35,328 ----a-w C:\WINDOWS\system32\atiadlxx.dll

2008-08-01 03:40 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll

2008-08-01 03:39 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll

2008-08-01 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll

2008-08-01 03:34 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll

2008-07-31 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe

2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll

2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll

2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll

2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll

2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

"Steam"="c:\programfiler\steam\steam.exe" [2008-09-08 1271032]

"StatBar"="C:\Programfiler\Globe Software\StatBar\StatBar.exe" [2003-07-25 335872]

"uTorrent"="C:\Programfiler\uTorrent\uTorrent.exe" [2008-08-28 267056]

"SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-24 1576176]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]

"OnlineArmor GUI"="C:\Programfiler\Tall Emu\Online Armor\oaui.exe" [2008-04-17 5545536]

"avgnt"="C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"SoundMan"="SOUNDMAN.EXE" [2005-10-24 C:\WINDOWS\soundman.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

 

C:\Documents and Settings\Vegard\Start-meny\Programmer\Oppstart\

iTunes.lnk - C:\Programfiler\iTunes\iTunes.exe [2008-09-08 14228264]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Programfiler\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "C:\PROGRA~1\TALLEM~1\ONLINE~1\oaevent.dll" [2008-04-17 671432]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-09-24 18:51 352256 C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programfiler\\uTorrent\\uTorrent.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"C:\\Programfiler\\iTunes\\iTunes.exe"=

"C:\\Programfiler\\mIRC\\mirc.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"67:UDP"= 67:UDP:DHCP Discovery Service

 

R1 OADevice;OADriver;C:\WINDOWS\system32\drivers\OADriver.sys [2008-04-17 80584]

R1 OAmon;OAmon;C:\WINDOWS\system32\drivers\OAmon.sys [2008-04-17 32456]

R1 OAnet;OAnet;C:\WINDOWS\system32\drivers\OAnet.sys [2008-04-17 28872]

R2 pnpcap;Pure Networks Packet Capture Driver;C:\WINDOWS\system32\DRIVERS\pnpcap.sys [2008-05-21 23352]

R2 SvcOnlineArmor;Online Armor;C:\Programfiler\Tall Emu\Online Armor\oasrv.exe [2008-04-17 5435968]

S2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Programfiler\Viewpoint\Common\ViewpointService.exe [ ]

S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [ ]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

\Shell\AutoRun\command - F:\Setup.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7cb9d28-7505-11dd-a567-806d6172696f}]

\Shell\AutoRun\command - J:\Setup.exe

.

Contents of the 'Scheduled Tasks' folder

.

- - - - ORPHANS REMOVED - - - -

 

HKLM-Run-NWEReboot - (no file)

Notify-WgaLogon - (no file)

 

 

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Documents and Settings\Vegard\Programdata\Mozilla\Firefox\Profiles\5shtfd9y.default\

FF -: plugin - C:\Documents and Settings\Vegard\Programdata\Mozilla\Firefox\Profiles\5shtfd9y.default\extensions\[email protected]\plugins\npRACtrl.dll

FF -: plugin - C:\Programfiler\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - C:\Programfiler\Mozilla Firefox\plugins\npViewpoint.dll

FF -: plugin - C:\Programfiler\Viewpoint\Viewpoint Media Player\npViewpoint.dll

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-24 19:44:44

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\mchInjDrv]

"ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp"

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\ati2evxx.exe

C:\WINDOWS\system32\ati2evxx.exe

C:\Programfiler\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\searchindexer.exe

C:\Programfiler\Fellesfiler\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\system32\imapi.exe

.

**************************************************************************

.

Completion time: 2008-09-24 19:50:14 - machine was rebooted

ComboFix-quarantined-files.txt 2008-09-24 17:50:00

 

Pre-Run: 32 459 218 944 byte ledig

Post-Run: 32,468,439,040 byte ledig

 

323 --- E O F --- 2008-09-06 01:00:17

 

 

 

HJT:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:02:04, on 24.09.2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Tall Emu\Online Armor\oasrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Programfiler\Fellesfiler\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Tall Emu\Online Armor\oaui.exe

C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\programfiler\steam\steam.exe

C:\Programfiler\Globe Software\StatBar\StatBar.exe

C:\Programfiler\iTunes\iTunes.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\Programfiler\Globe Software\StatBar\StatBar.exe

C:\Documents and Settings\Vegard\Skrivebord\Ny mappe\fdssfdfsd.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.no

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programfiler\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [startCCC] "C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [OnlineArmor GUI] "C:\Programfiler\Tall Emu\Online Armor\oaui.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - HKCU\..\Run: [statBar] C:\Programfiler\Globe Software\StatBar\StatBar.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Programfiler\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: iTunes.lnk = ?

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.ftwtv.com/UKooPlayer.ocx

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programfiler\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programfiler\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programfiler\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Programfiler\Fellesfiler\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Programfiler\Tall Emu\Online Armor\oasrv.exe

O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Programfiler\Viewpoint\Common\ViewpointService.exe (file missing)

 

--

End of file - 7517 bytes

 

 

[norbat]

Ser ikke noe malware i de loggene. Pc'n kjører ok?

[Pizzaen]

Ser ikke noe malware i de loggene. Pc'n kjører ok?

 

Ja, er ikke at pc'n kjører dårlig eller noe, men har lastet ned noe tull i går som jeg ikke vet var helt sikkert så derfor tenkte jeg at det var lurt og ta en skjekk Men så Combofix fjernet noe, hva var det?

 

Edit: Har enda en pc jeg skulle ha skjekket, skall jeg lage en ny tråd eller bruke denne?

Endret 24. september 2008 av Pizzaen