rundll.exe bruker 50% av prosssoren

cuhuy · 3. desember 2008

hei... Jeg merka at min pc begynte å gå tregere for 2-3 dager siden, da jeg kikka på prosesser på oppgavebehandlin, så la jeg merke til at prosessen rundll.exe bruker 50% av prosessen min. Åssen for jeg fjernet dette?

snippsat · 3. desember 2008

Last ned HijackThis legg i egen mappe på skrivebordet.

Start programmet og velg "Trykk scan og save log"

Post HijackThis.txt

cuhuy · 3. desember 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:11:01, on 03.12.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\TBPanel.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\Common Files\System\rundll.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Winamp\winamp.exe

C:\Windows\system32\rundll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\rundll32.exe

C:\Program Files\Microsoft Office\Office12\WINWORD.EXE

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O1 - Hosts: ::1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {C5E0E6F2-1AA2-4840-B24A-FCB03F1D6F9C} - C:\Windows\system32\fcCTlmND.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [GAINWARD] C:\Windows\TBPanel.exe /A

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Windows Update] C:\Program Files\Common Files\System\rundll.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXNfCUM.dll,#1

O4 - HKLM\..\Run: [4896561a] rundll32.exe "C:\Windows\system32\ksvfflsp.dll",b

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [steam] "c:\program files\steam\steam.exe" -silent

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Startup: Need for Speed™ Undercover Registration.lnk = C:\Program Files\EA Games\Need for Speed Undercover\Support\EAregister.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.tvlution.com/KooPlayer.ocx

O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab

O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.euchannels.net/UKooPlayer.ocx

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br...018/flashax.cab

O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe - Stanford University - C:\Program Files\EA Games\Need for Speed Undercover\FAH.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Mesppanger - Unknown owner - c:\Recyclers\svchost.exe (file missing)

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

snippsat · 3. desember 2008

Du har mye malware,dette er problemet.

Last ned MBAM til skrivebordet.

Velg Norsk språkdrakt-->kjør hurtig systemskann.

Når MBAM er ferdig åpner den en logg,den poster du.

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

cuhuy · 3. desember 2008

Malwarebytes' Anti-Malware 1.30

Database versjon: 1306

Windows 6.0.6001 Service Pack 1

03.12.2008 20:40:32

mbam-log-2008-12-03 (20-40-28).txt

Skanntype: Rask Skann

Objekter skannet: 50196

Tid tilbakelagt: 13 minute(s), 51 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 1

Registernøkler infisert: 11

Registerverdier infisert: 3

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 3

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

C:\Windows\System32\byXNfCUM.dll (Trojan.Vundo) -> No action taken.

Registernøkler infisert:

HKEY_CLASSES_ROOT\pk.ie (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\pk.ie.1 (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{1e1b2878-88ff-11d3-8d96-d7acac95951a} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{1e1b2879-88ff-11d3-8d96-d7acac95951a} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\Typelib\{1e1b286c-88ff-11d3-8d96-d7acac95951a} (Trojan.BHO) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1e1b2879-88ff-11d3-8d96-d7acac95951a} (Trojan.BHO) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update (Backdoor.Bot) -> No action taken.

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

(Ingen mistenkelige filer funnet)

Filer infisert:

C:\Windows\System32\byXNfCUM.dll (Trojan.Vundo) -> No action taken.

C:\Program Files\Common Files\System\rundll.exe (Backdoor.Bot) -> No action taken.

C:\Windows\System32\mlJAtSmK.dll (Trojan.Vundo) -> No action taken.

__________________________________________________________________________________________

ComboFix 08-12-02.02 - Huy Tran 2008-12-03 20:43:52.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.995 [GMT 1:00]

Kjører fra: c:\users\Huy Tran\Desktop\ComboFix.exe

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Recyclers

c:\windows\system32\DNmlTCcf.ini

c:\windows\System32\DNmlTCcf.ini2

c:\windows\system32\mlJAtSmK.dll

c:\windows\system32\pslffvsk.ini

c:\windows\Tasks\ztdbgqne.job

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-03 til 2008-12-03 )))))))))))))))))))))))))))))))))

.

2008-12-03 19:52 . 2008-12-03 19:52 <DIR> d-------- c:\users\Huy Tran\AppData\Roaming\Malwarebytes

2008-12-03 19:52 . 2008-12-03 19:52 <DIR> d-------- c:\users\All Users\Malwarebytes

2008-12-03 19:52 . 2008-12-03 19:52 <DIR> d-------- c:\programdata\Malwarebytes

2008-12-03 19:52 . 2008-12-03 20:40 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-12-03 19:52 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2008-12-03 19:52 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2008-12-03 19:09 . 2008-12-03 19:09 <DIR> d-------- c:\program files\Trend Micro

2008-12-03 18:24 . 2008-12-03 20:47 39,424 --a------ c:\windows\System32\byXNfCUM.dll

2008-12-03 18:22 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg

2008-12-03 18:20 . 2008-12-03 18:20 <DIR> d-------- c:\program files\ESET

2008-12-03 00:31 . 2008-12-03 00:31 <DIR> d-------- c:\users\huy\appdata

2008-12-03 00:31 . 2008-12-03 00:31 <DIR> d-------- c:\users\huy

2008-12-03 00:23 . 2008-12-03 00:23 <DIR> d--h-c--- c:\users\All Users\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}

2008-12-03 00:23 . 2008-12-03 00:23 <DIR> d--h-c--- c:\programdata\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}

2008-12-03 00:02 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll

2008-12-03 00:02 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe

2008-12-03 00:02 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe

2008-12-03 00:02 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll

2008-12-03 00:02 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll

2008-12-03 00:02 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll

2008-12-03 00:02 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl

2008-12-03 00:02 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll

2008-12-02 23:56 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll

2008-12-02 23:56 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll

2008-12-02 23:56 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll

2008-12-02 23:55 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll

2008-12-02 23:55 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll

2008-12-02 23:42 . 2008-12-02 23:42 <DIR> dr-h----- C:\AHCache

2008-12-02 23:07 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss

2008-12-02 23:06 . 2008-12-02 23:06 <DIR> d--h----- c:\program files\Temp

2008-12-02 23:06 . 2008-12-02 23:06 <DIR> d-------- c:\program files\Realtek

2008-12-02 22:59 . 2008-12-02 22:59 <DIR> d-------- C:\Drivers

2008-12-02 22:59 . 2008-03-26 11:15 53,248 --a------ c:\windows\System32\CSVer.dll

2008-12-02 22:58 . 2008-12-02 22:58 <DIR> d-------- C:\Intel

2008-12-02 22:49 . 2008-12-02 22:52 <DIR> d-------- c:\users\All Users\DriverScanner

2008-12-02 22:49 . 2008-12-02 22:52 <DIR> d-------- c:\programdata\DriverScanner

2008-12-02 22:48 . 2008-12-02 22:49 <DIR> d--h-c--- c:\users\All Users\{D5ABFFAD-D592-4F98-B02B-587125B4801F}

2008-12-02 22:48 . 2008-12-02 22:49 <DIR> d--h-c--- c:\programdata\{D5ABFFAD-D592-4F98-B02B-587125B4801F}

2008-12-02 20:59 . 2008-12-02 22:49 <DIR> d-------- c:\users\Huy Tran\AppData\Roaming\Uniblue

2008-12-02 20:59 . 2008-12-02 20:59 <DIR> d--h-c--- c:\users\All Users\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2008-12-02 20:59 . 2008-12-02 20:59 <DIR> d--h-c--- c:\programdata\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2008-12-02 20:59 . 2008-12-03 00:23 <DIR> d-------- c:\program files\Uniblue

2008-12-01 06:45 . 2008-12-01 06:45 410,976 --a------ c:\windows\System32\deploytk.dll

2008-11-29 11:37 . 2008-11-29 11:37 <DIR> d-------- c:\program files\EA Games

2008-11-28 17:41 . 2008-11-28 17:41 <DIR> d-------- c:\program files\KAZAA

2008-11-28 17:41 . 2008-11-28 17:41 <DIR> d-------- C:\My Downloads

2008-11-28 17:37 . 2008-11-30 01:39 <DIR> d-------- c:\users\All Users\avg8

2008-11-28 17:37 . 2008-11-30 01:39 <DIR> d-------- c:\programdata\avg8

2008-11-28 17:37 . 2008-11-28 17:37 <DIR> d-------- c:\program files\AVG

2008-11-26 08:48 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll

2008-11-26 08:48 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll

2008-11-26 08:48 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll

2008-11-26 08:48 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll

2008-11-26 08:48 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll

2008-11-20 23:05 . 2006-10-26 19:56 32,592 --a------ c:\windows\System32\msonpmon.dll

2008-11-20 23:04 . 2008-11-20 23:37 <DIR> d-------- c:\program files\Microsoft Works

2008-11-20 22:59 . 2008-11-20 22:59 <DIR> d-------- c:\program files\Microsoft Visual Studio 8

2008-11-20 22:54 . 2008-11-20 22:54 <DIR> dr-h----- C:\MSOCache

2008-11-20 16:54 . 2008-11-20 17:01 <DIR> d-------- c:\users\All Users\Sports Interactive

2008-11-20 16:54 . 2008-11-20 17:01 <DIR> d-------- c:\programdata\Sports Interactive

2008-11-20 16:45 . 2008-11-20 16:45 <DIR> d-------- c:\program files\Sports Interactive

2008-11-20 16:26 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll

2008-11-20 16:26 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll

2008-11-20 16:26 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll

2008-11-20 16:26 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll

2008-11-20 16:26 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll

2008-11-20 16:26 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe

2008-11-20 16:26 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll

2008-11-20 16:26 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll

2008-11-20 16:26 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

2008-11-20 07:03 . 2008-11-20 07:03 <DIR> d-------- c:\users\Huy Tran\AppData\Roaming\U3

2008-11-19 15:41 . 2008-11-19 15:41 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-11-15 01:07 . 2008-11-15 01:07 <DIR> d-------- c:\program files\HVS Games

2008-11-15 01:07 . 1996-02-02 20:58 284,160 --a------ c:\windows\uninst.exe

2008-11-13 16:20 . 2008-11-13 16:20 203,540 --a------ c:\windows\System32\nvapps.xml

2008-11-12 10:04 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll

2008-11-12 10:04 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll

2008-11-12 09:59 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys

2008-11-05 19:14 . 2008-11-05 19:14 <DIR> d-------- c:\windows\System32\xlive

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-03 19:50 --------- d-----w c:\program files\Steam

2008-12-03 17:21 --------- d-----w c:\users\Huy Tran\AppData\Roaming\Azureus

2008-12-03 15:43 --------- d-----w c:\program files\Warcraft III

2008-12-02 23:10 --------- d---a-w c:\programdata\TEMP

2008-12-02 22:12 --------- d-----w c:\program files\Common Files\Steam

2008-12-02 22:06 319,456 ----a-w c:\windows\DIFxAPI.dll

2008-12-02 22:06 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-01 05:45 --------- d-----w c:\program files\Java

2008-11-30 16:03 --------- d-----w c:\users\Huy Tran\AppData\Roaming\SopCast

2008-11-30 00:36 --------- d-----w c:\programdata\Avg7

2008-11-30 00:19 --------- d-----w c:\programdata\NVIDIA

2008-11-29 11:02 --------- d-----w c:\program files\DAEMON Tools Pro

2008-11-28 12:44 --------- d-----w c:\program files\Bonjour

2008-11-27 20:58 --------- d-----w c:\users\Huy Tran\AppData\Roaming\LimeWire

2008-11-21 14:38 --------- d-----w c:\program files\Azureus

2008-11-20 22:38 --------- d-----w c:\programdata\Microsoft Help

2008-11-20 22:37 --------- d-----w c:\program files\MSBuild

2008-11-20 16:09 --------- d-----w c:\users\Huy Tran\AppData\Roaming\Sports Interactive

2008-11-16 23:37 --------- d-----w c:\users\Huy Tran\AppData\Roaming\InstallShield

2008-11-12 13:54 7,611,360 ----a-w c:\windows\system32\drivers\nvlddmkm.sys

2008-11-12 13:54 4,160 ----a-w c:\windows\system32\drivers\nvBridge.kmd

2008-10-31 16:35 --------- d-----w c:\program files\Common Files\Apple

2008-10-31 16:34 --------- d-----w c:\program files\Apple Software Update

2008-10-24 11:25 --------- d-----w c:\program files\DivX

2008-10-20 21:00 --------- d--h--w c:\users\Huy Tran\AppData\Roaming\ijjigame

2008-10-17 16:08 --------- d-----w c:\program files\Windows Mail

2008-10-05 05:03 --------- d-----w c:\program files\EA Sports

2008-10-04 20:20 --------- d-----w c:\program files\WC3Banlist

2008-09-27 13:48 127,034 ------r c:\windows\bwUnin-8.1.1.50-8876480SL.exe

2008-09-20 17:42 22,328 ----a-w c:\users\Huy Tran\AppData\Roaming\PnkBstrK.sys

2008-09-18 14:57 53,744 ----a-w c:\users\Huy Tran\AppData\Roaming\GDIPFONTCACHEV1.DAT

2008-04-24 17:22 174 --sha-w c:\program files\desktop.ini

2007-09-06 15:45 219,952 ----a-w c:\users\Huy Tran\utorrent.exe

2007-04-05 21:13 30,601 ----a-w c:\users\Huy Tran\x.exe

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]

"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1688872]

"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]

"GAINWARD"="c:\windows\TBPanel.exe" [2006-11-24 2162688]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]

"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2008-09-06 413696]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13675040]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 92704]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-10-02 6335008]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 c:\windows\KHALMNPR.Exe]

c:\users\Huy Tran\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Need for SpeedT Undercover Registration.lnk - c:\program files\EA Games\Need for Speed Undercover\Support\EAregister.exe [2008-10-22 4369408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup