Virus og problemer med ComboFix, hjelp!

putetrekk · 17. november 2008

Fikk beskjed på pcn min i går om at den var infisert av alt mulig rart som kunne komme til å slette alt av dokumenter og andre ting som ligger på pcn. Har Norman Security Suite, så tok et søk med den, uten å finne noen infiserte filer på dataen. Deretter gikk jeg inn på denne siden og følgte veiledningen: hjelp til å få fjernet malware. å laste ned mbam gikk greit, den fant endel infiserte filer, og fikk opp dette notatet:

(legger det i spoiler så det ikke tar så stor plass, ja jeg er helt ny på forumbruk.. :cool: )

Malwarebytes' Anti-Malware 1.30

Database versjon: 1403

Windows 6.0.6001 Service Pack 1

17.11.2008 11:23:13

mbam-log-2008-11-17 (11-23-13).txt

Skanntype: Rask Skann

Objekter skannet: 47705

Tid tilbakelagt: 8 minute(s), 39 second(s)

Minneprosesser infisert: 1

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 1

Registerfiler infisert: 0

Mapper infisert: 2

Filer infisert: 5

Minneprosesser infisert:

C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus2008) -> Unloaded process successfully.

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

Registerverdier infisert:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\71634219477101454857867984268821 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Filer infisert:

C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

C:\Users\Mari\Desktop\Antivirus 2009.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Men, her kommer nemlig problemet. Når jeg skal laste ned ComboFix går alt fin først, helt til programmet liksom skal være nedlastet, så kommer denne beskjeden opp:

"You cannot rename ComboFix as ComboFix[1]

Please use another name, preferbaly made up of alphanumeric characters"

Kan noen vær så snill å hjelpe meg med akkurat hva jeg skal gjøre? Har Absolut alle eksamensnotatene mine innpå der, så det ville være superkatastrofe om de forsvant. Tørr jo ikke å laste de over på en annen hard-disck i fare for at de er "smittet" av viruset og vil ta det med seg til det som ligger på den discken...

r2d290 · 17. november 2008

I steden for å velge lagre når du klikker Combofix-linken, så velger du Åpne. Combofix burde starte da.

putetrekk · 17. november 2008

Tusen takk, da fikk jeg i alle fall til det

Her er i alle fall loggene:

Mbam:

Malwarebytes' Anti-Malware 1.30

Database versjon: 1403

Windows 6.0.6001 Service Pack 1

17.11.2008 11:23:13

mbam-log-2008-11-17 (11-23-13).txt

Skanntype: Rask Skann

Objekter skannet: 47705

Tid tilbakelagt: 8 minute(s), 39 second(s)

Minneprosesser infisert: 1

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 1

Registerfiler infisert: 0

Mapper infisert: 2

Filer infisert: 5

Minneprosesser infisert:

C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus2008) -> Unloaded process successfully.

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

Registerverdier infisert:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\71634219477101454857867984268821 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Filer infisert:

C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

C:\Users\Mari\Desktop\Antivirus 2009.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.

C:\Users\Mari\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

ComboFix

ComboFix 08-11-16.05 - Mari 2008-11-17 14:04:27.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.288 [GMT 1:00]

Running from: c:\users\Mari\Desktop\ComboFix.exe

* Created a new restore point

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\ieupdates.exe.tmp

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_nsesvc

((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))

.

2008-11-17 11:12 . 2008-11-17 11:12 <DIR> d-------- c:\users\Mari\AppData\Roaming\Malwarebytes

2008-11-17 11:12 . 2008-11-17 11:12 <DIR> d-------- c:\users\All Users\Malwarebytes

2008-11-17 11:12 . 2008-11-17 11:12 <DIR> d-------- c:\programdata\Malwarebytes

2008-11-17 11:12 . 2008-11-17 11:12 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-11-17 11:12 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2008-11-17 11:12 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2008-11-15 01:49 . 2008-11-15 01:49 244 --ah----- C:\sqmnoopt00.sqm

2008-11-15 01:49 . 2008-11-15 01:49 232 --ah----- C:\sqmdata00.sqm

2008-11-14 12:39 . 2008-11-14 12:41 <DIR> d-------- c:\program files\Picasa2

2008-11-14 12:37 . 2008-11-14 12:37 <DIR> d-------- c:\users\All Users\eSellerate

2008-11-14 12:37 . 2008-11-14 12:37 <DIR> d-------- c:\programdata\eSellerate

2008-11-14 12:36 . 2008-11-14 12:36 <DIR> d-------- c:\program files\Western Digital

2008-11-14 12:32 . 2008-11-14 12:36 <DIR> d---s---- c:\users\All Users\Memeo

2008-11-14 12:32 . 2008-11-14 12:36 <DIR> d---s---- c:\programdata\Memeo

2008-11-14 12:32 . 2008-11-14 12:50 <DIR> d-------- c:\program files\Memeo

2008-11-14 12:29 . 2008-11-14 12:29 <DIR> d-------- c:\program files\Western Digital Technologies

2008-11-12 15:21 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll

2008-11-12 15:13 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys

2008-11-12 15:07 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll

2008-11-08 20:29 . 2008-11-08 20:29 <DIR> d-------- C:\games

2008-11-05 14:17 . 2008-11-05 14:17 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-11-05 14:13 . 2008-11-05 14:13 <DIR> d-------- c:\program files\LG Electronics

2008-11-05 14:13 . 2008-01-09 10:22 110,464 --a------ c:\windows\System32\drivers\lgmcmdm.sys

2008-11-05 14:13 . 2008-01-09 10:22 109,952 --a------ c:\windows\System32\drivers\lgmcunic.sys

2008-11-05 14:13 . 2008-01-09 10:22 104,448 --a------ c:\windows\System32\drivers\lgmcmgmt.sys

2008-11-05 14:13 . 2008-01-09 10:22 100,480 --a------ c:\windows\System32\drivers\lgmcobex.sys

2008-11-05 14:13 . 2008-01-09 10:22 83,584 --a------ c:\windows\System32\drivers\lgmcbus.sys

2008-11-05 14:13 . 2008-01-09 10:22 25,344 --a------ c:\windows\System32\drivers\lgmcnd5.sys

2008-11-05 14:13 . 2008-01-09 10:22 14,976 --a------ c:\windows\System32\drivers\lgmcmdfl.sys

2008-11-05 14:13 . 2008-01-09 10:22 12,160 --a------ c:\windows\System32\drivers\lgmcwhnt.sys

2008-11-05 14:13 . 2008-01-09 10:22 12,160 --a------ c:\windows\System32\drivers\lgmcwh.sys

2008-11-05 14:13 . 2008-01-09 10:22 12,160 --a------ c:\windows\System32\drivers\lgmccmnt.sys

2008-11-05 14:13 . 2008-01-09 10:22 12,160 --a------ c:\windows\System32\drivers\lgmccm.sys

2008-11-05 14:13 . 2008-01-09 10:22 10,496 --a------ c:\windows\System32\drivers\lgmccr.sys

2008-11-05 14:09 . 2007-11-08 16:26 1,164,728 --a------ c:\windows\System32\NMSDVDXU.dll

2008-11-05 14:09 . 2005-09-26 22:55 419,240 --a------ c:\windows\System32\Vsflex7L.ocx

2008-11-05 14:09 . 2000-05-22 00:00 244,416 --a------ c:\windows\System32\Msflxgrd.ocx

2008-11-05 14:08 . 2008-11-05 14:08 <DIR> d-------- c:\users\Mari\AppData\Roaming\LG Electronics

2008-11-05 14:08 . 2008-11-05 21:42 <DIR> d-------- c:\program files\LG PC Suite II

2008-11-05 14:03 . 2008-11-05 14:03 <DIR> d-------- c:\users\Mari\AppData\Roaming\InstallShield

2008-10-31 22:57 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll

2008-10-31 22:57 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll

2008-10-31 22:57 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax

2008-10-31 22:57 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax

2008-10-31 22:57 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax

2008-10-29 03:34 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll

2008-10-29 03:34 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll

2008-10-29 03:34 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll

2008-10-26 13:58 . 2008-04-26 09:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys

2008-10-25 14:49 . 2008-10-25 14:49 <DIR> d-------- C:\PerfLogs

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-17 13:14 --------- d-----w c:\program files\Norman

2008-11-16 22:48 --------- d-----w c:\users\Mari\AppData\Roaming\uTorrent

2008-11-14 12:53 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-02 12:39 --------- d-----w c:\program files\bwin

2008-10-25 14:01 174 --sha-w c:\program files\desktop.ini

2008-10-25 13:51 --------- d-----w c:\program files\Windows Sidebar

2008-10-25 13:51 --------- d-----w c:\program files\Windows Photo Gallery

2008-10-25 13:51 --------- d-----w c:\program files\Windows Mail

2008-10-25 13:51 --------- d-----w c:\program files\Windows Journal

2008-10-25 13:51 --------- d-----w c:\program files\Windows Defender

2008-10-25 13:51 --------- d-----w c:\program files\Windows Collaboration

2008-10-25 13:51 --------- d-----w c:\program files\Windows Calendar

2008-10-25 10:40 82,432 ----a-w c:\windows\System32\axaltocm.dll

2008-10-25 10:40 101,888 ----a-w c:\windows\System32\ifxcardm.dll

2008-10-24 16:35 --------- d-----w c:\program files\Microsoft Silverlight

2008-10-08 12:57 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-10-08 12:57 --------- d-----w c:\program files\iTunes

2008-10-08 12:56 --------- d-----w c:\program files\iPod

2008-10-04 13:01 --------- d-----w c:\users\Mari\AppData\Roaming\Nokia

2008-10-04 12:15 --------- d-----w c:\users\Mari\AppData\Roaming\PC Suite

2008-10-04 12:15 --------- d-----w c:\programdata\PC Suite

2008-10-04 12:07 --------- d-----w c:\program files\Common Files\PCSuite

2008-10-04 12:07 --------- d-----w c:\program files\Common Files\Nokia

2008-10-04 12:06 --------- d-----w c:\program files\Nokia

2008-10-04 12:03 --------- d-----w c:\program files\DIFX

2008-10-04 12:00 --------- d-----w c:\program files\PC Connectivity Solution

2008-10-04 11:52 --------- d-----w c:\programdata\Installations

2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll

2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll

2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe

2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe

2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys

2008-09-05 20:16 1,900,544 ----a-w c:\windows\System32\usbaaplrc.dll

2008-08-29 08:18 87,336 ----a-w c:\windows\System32\dns-sd.exe

2008-08-29 07:53 61,440 ----a-w c:\windows\System32\dnssd.dll

2008-05-15 14:16 1,668 ----a-w c:\users\Mari\AppData\Roaming\wklnhst.dat

2008-07-10 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-07-10 19:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-07-10 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-19 192000]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 68856]

"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-01-18 17920]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-07 159744]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-04-08 77824]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-12 3444736]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-08 1838592]

"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-11-01 189736]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]

"NPCTray"="c:\program files\Norman\npc\bin\npc_tray.exe" [2007-09-17 126008]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-11-12 405504]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 366400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

c:\users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Memeo AutoBackup Launcher.lnk - c:\users\Mari\AppData\Roaming\Microsoft\Installer\{39A908FD-7322-41AE-B374-C7A076B2FC97}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe [2008-11-14 73728]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-04-08 50688]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2007-09-07 1180952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{C82359E2-3AB1-48F9-B59A-E052BDFEAD58}"= c:\program files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect

"{BB304EF9-1C8D-4DDC-80C6-F47463DEA486}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program

"{729A6148-0F9C-429F-AED8-CE008C62FE4F}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine

"{FC79B298-2F91-46E1-BC11-F608D04D97E5}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server

"{861AFD73-7A1F-4D8F-BDDE-D6019B15BCA1}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"{BA85E8A2-6CB7-497C-A8CD-5EDECF5EB32D}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{21D0490F-8595-460A-9CE9-3C217FFF474F}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{A46CEDFF-EFBA-4FE5-82A7-51A6F486FF13}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{E0030398-E2B4-4E6F-8C11-D14C9258D4A2}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{583C99B4-19D6-4D51-9158-2E134F9E9C2E}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{D6C830B6-FE03-4433-AAC4-0C18A40702AA}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"{8139DFD5-6E62-46E3-9AE9-72624B13F9D7}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24efd4ee-b0bc-11dd-8170-001d09493a6a}]

\shell\AutoRun\command - g:\wd_windows_tools\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{812576bb-0aed-11dd-9eac-001d09493a6a}]

\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a540494e-2d39-11dd-83a3-001d09493a6a}]

\shell\AutoRun\command - f:\wd_windows_tools\setup.exe

.

Contents of the 'Scheduled Tasks' folder

2008-04-16 c:\windows\Tasks\Se etter oppdateringer for Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-Wdf01000.sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.sol.no/

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

LSP: c:\program files\Norman\npc\bin\nlf.dll

c:\program files\Samsung\Samsung PC Studio 3\UNICOWS.DLL - c:\windows\Downloaded Program Files\IPSUploader4.ocx

O16 -: {CAC677B6-4963-4305-9066-0BD135CD9233}

hxxps://asp.photoprintit.de/microsite/5026/defaults/activex/ips/IPSUploader4.cab

c:\windows\Downloaded Program Files\IPSUploader4.inf

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-17 14:17:39

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\users\Mari\AppData\Local\Temp\Cab5E74.tmp 27023 bytes

c:\users\Mari\AppData\Local\Temp\Tar5EA4.tmp 0 bytes

c:\users\Mari\AppData\Local\Microsoft\Windows\WER\ReportQueue\store.lock 0 bytes

scan completed successfully

hidden files: 3

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Norman\Npm\Bin\elogsvc.exe

c:\program files\Norman\Ngs\Bin\nprosec.exe

c:\windows\System32\audiodg.exe

c:\program files\Norman\Npm\Bin\Zanda.exe

c:\program files\Norman\Npm\Bin\nvoy.exe

c:\program files\Norman\Npf\Bin\npfsvc32.exe

c:\windows\System32\WLTRYSVC.EXE

c:\windows\System32\wlanext.exe

c:\windows\System32\BCMWLTRY.EXE

c:\windows\System32\AEstSrv.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

c:\windows\System32\stacsv.exe

c:\windows\System32\drivers\XAudio.exe

c:\program files\Norman\Npm\Bin\nvcsched.exe

c:\program files\Norman\Npm\Bin\Njeeves.exe

c:\program files\Norman\Npc\Bin\npcsvc32.exe

c:\program files\Norman\Npc\Bin\nuaa.exe

c:\program files\Norman\nvc\bin\Nvcoas.exe

c:\windows\System32\conime.exe

c:\program files\Norman\Npf\Bin\npfuser.exe

c:\program files\Memeo\AutoBackup\MemeoLauncher.exe

c:\windows\System32\igfxsrvc.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Norman\nvc\bin\Nip.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Norman\nvc\bin\CClaw.exe

c:\program files\PC Connectivity Solution\ServiceLayer.exe

c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe

c:\program files\DellTPad\ApMsgFwd.exe

c:\program files\DellTPad\hidfind.exe

c:\program files\DellTPad\ApntEx.exe

c:\windows\System32\consent.exe

.

**************************************************************************

.

Completion time: 2008-11-17 14:35:23 - machine was rebooted

ComboFix-quarantined-files.txt 2008-11-17 13:33:55

Pre-Run: 31 974 232 064 byte ledig

Post-Run: 32,112,803,840 byte ledig

257 --- E O F --- 2008-11-15 00:37:55

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:41:29, on 17.11.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe