[Løst]trojaner og annet skitt

ungkar1 · 6. desember 2008

hei.

er på mormors pc og ho har fått virus. jeg har fått slettet alt(tror jeg) men ville bare sjekke her først.

combofix:

ComboFix 08-12-05.06 - Hildur Sagen 2008-12-06 13:47:58.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT 1:00]

Kjører fra: c:\documents and settings\Hildur Sagen\Desktop\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Downloaded Program Files\setup.inf

c:\windows\system32\audiosrv32.dll

c:\windows\system32\avifile32.dll

c:\windows\system32\ccfgnt32.dll

c:\windows\system32\mww10241.dll

c:\windows\system32\mww37562.dll

c:\windows\system32\ww10241.dll

c:\windows\system32\ww37562.dll

C:\xcrashdump.dat

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PACKET

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-06 til 2008-12-06 )))))))))))))))))))))))))))))))))

.

2008-12-06 13:20 . 2008-12-06 13:20 0 --a------ c:\windows\system32\2E2.tmp

2008-12-06 12:50 . 2008-12-06 12:50 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-12-06 12:50 . 2008-12-06 12:50 <DIR> d-------- c:\documents and settings\Hildur Sagen\Application Data\Malwarebytes

2008-12-06 12:50 . 2008-12-06 12:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-06 12:50 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-06 12:50 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-06 12:49 . 2008-12-06 12:49 0 --a------ c:\windows\system32\2E0.tmp

2008-12-06 12:49 . 2008-12-06 12:49 0 --a------ c:\windows\system32\2DD.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2DA.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2D6.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2D3.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2D0.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2CC.tmp

2008-12-06 12:48 . 2008-12-06 12:48 0 --a------ c:\windows\system32\2C8.tmp

2008-12-06 12:47 . 2008-12-06 12:47 0 --a------ c:\windows\system32\2C4.tmp

2008-12-06 12:47 . 2008-12-06 12:47 0 --a------ c:\windows\system32\2C1.tmp

2008-12-06 12:47 . 2008-12-06 12:47 0 --a------ c:\windows\system32\2BE.tmp

2008-12-06 12:47 . 2008-12-06 12:47 0 --a------ c:\windows\system32\2B8.tmp

2008-12-06 12:47 . 2008-12-06 12:47 0 --a------ c:\windows\system32\2B2.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\2AE.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\2A9.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\2A6.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\2A2.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\29C.tmp

2008-12-06 12:46 . 2008-12-06 12:46 0 --a------ c:\windows\system32\298.tmp

2008-12-06 12:45 . 2008-12-06 12:45 0 --a------ c:\windows\system32\293.tmp

2008-12-06 12:45 . 2008-12-06 12:45 0 --a------ c:\windows\system32\28D.tmp

2008-12-06 12:45 . 2008-12-06 12:45 0 --a------ c:\windows\system32\287.tmp

2008-12-06 12:45 . 2008-12-06 12:45 0 --a------ c:\windows\system32\280.tmp

2008-12-06 12:45 . 2008-12-06 12:45 0 --a------ c:\windows\system32\27A.tmp

2008-12-06 12:44 . 2008-12-06 12:44 0 --a------ c:\windows\system32\274.tmp

2008-12-06 12:44 . 2008-12-06 12:44 0 --a------ c:\windows\system32\269.tmp

2008-12-06 12:44 . 2008-12-06 12:44 0 --a------ c:\windows\system32\258.tmp

2008-12-06 12:44 . 2008-12-06 12:44 0 --a------ c:\windows\system32\242.tmp

2008-12-06 12:44 . 2008-12-06 12:44 0 --a------ c:\windows\system32\210.tmp

2008-12-06 12:33 . 2008-12-06 12:38 <DIR> d-------- c:\program files\Auslogics

2008-12-06 12:33 . 2008-12-06 12:33 <DIR> d-------- c:\documents and settings\Hildur Sagen\Application Data\Auslogics

2008-12-06 12:23 . 2008-12-06 12:23 <DIR> d-------- c:\program files\CCleaner

2008-12-06 12:17 . 2008-12-06 12:17 0 --a------ c:\windows\system32\2BA.tmp

2008-12-06 12:17 . 2008-12-06 12:17 0 --a------ c:\windows\system32\2B7.tmp

2008-12-06 12:17 . 2008-12-06 12:17 0 --a------ c:\windows\system32\2B3.tmp

2008-12-06 12:17 . 2008-12-06 12:17 0 --a------ c:\windows\system32\2B1.tmp

2008-12-06 12:17 . 2008-12-06 12:17 0 --a------ c:\windows\system32\2AF.tmp

2008-12-06 12:16 . 2008-12-06 12:16 0 --a------ c:\windows\system32\2AA.tmp

2008-12-06 12:16 . 2008-12-06 12:16 0 --a------ c:\windows\system32\2AD.tmp

2008-12-06 10:18 . 2008-12-06 10:18 0 --a------ c:\windows\system32\2A0.tmp

2008-12-06 10:17 . 2008-12-06 10:17 0 --a------ c:\windows\system32\29E.tmp

2008-12-06 10:17 . 2008-12-06 10:17 0 --a------ c:\windows\system32\29B.tmp

2008-12-06 10:17 . 2008-12-06 10:17 0 --a------ c:\windows\system32\295.tmp

2008-12-06 10:17 . 2008-12-06 10:17 0 --a------ c:\windows\system32\292.tmp

2008-12-06 10:17 . 2008-12-06 10:17 0 --a------ c:\windows\system32\28F.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\28C.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\289.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\285.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\282.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\27F.tmp

2008-12-06 10:16 . 2008-12-06 10:16 0 --a------ c:\windows\system32\27C.tmp

2008-12-06 10:15 . 2008-12-06 10:15 0 --a------ c:\windows\system32\279.tmp

2008-12-06 10:15 . 2008-12-06 10:15 0 --a------ c:\windows\system32\276.tmp

2008-12-06 10:15 . 2008-12-06 10:15 0 --a------ c:\windows\system32\272.tmp

2008-12-06 10:15 . 2008-12-06 10:15 0 --a------ c:\windows\system32\26C.tmp

2008-12-06 10:15 . 2008-12-06 10:15 0 --a------ c:\windows\system32\264.tmp

2008-12-06 10:14 . 2008-12-06 10:14 0 --a------ c:\windows\system32\25C.tmp

2008-12-06 10:14 . 2008-12-06 10:14 0 --a------ c:\windows\system32\254.tmp

2008-12-06 10:14 . 2008-12-06 10:14 0 --a------ c:\windows\system32\24A.tmp

2008-12-06 10:14 . 2008-12-06 10:14 0 --a------ c:\windows\system32\23C.tmp

2008-12-06 10:14 . 2008-12-06 10:14 0 --a------ c:\windows\system32\22D.tmp

2008-12-05 21:36 . 2008-12-05 21:36 0 --a------ c:\windows\system32\220.tmp

2008-12-05 21:36 . 2008-12-05 21:36 0 --a------ c:\windows\system32\1F5.tmp

2008-12-04 18:24 . 2008-12-04 18:24 0 --a------ c:\windows\system32\326.tmp

2008-12-04 18:24 . 2008-12-04 18:24 0 --a------ c:\windows\system32\324.tmp

2008-12-04 18:23 . 2008-12-04 18:23 0 --a------ c:\windows\system32\322.tmp

2008-12-04 18:22 . 2008-12-04 18:22 0 --a------ c:\windows\system32\320.tmp

2008-12-04 18:22 . 2008-12-04 18:22 0 --a------ c:\windows\system32\31D.tmp

2008-12-04 18:21 . 2008-12-04 18:21 0 --a------ c:\windows\system32\31B.tmp

2008-12-04 18:20 . 2008-12-04 18:20 0 --a------ c:\windows\system32\319.tmp

2008-12-04 18:20 . 2008-12-04 18:20 0 --a------ c:\windows\system32\317.tmp

2008-12-04 18:19 . 2008-12-04 18:19 0 --a------ c:\windows\system32\315.tmp

2008-12-04 18:19 . 2008-12-04 18:19 0 --a------ c:\windows\system32\313.tmp

2008-12-04 18:18 . 2008-12-04 18:18 0 --a------ c:\windows\system32\311.tmp

2008-12-04 18:17 . 2008-12-04 18:17 0 --a------ c:\windows\system32\30F.tmp

2008-12-04 18:17 . 2008-12-04 18:17 0 --a------ c:\windows\system32\30D.tmp

2008-12-04 18:16 . 2008-12-04 18:16 0 --a------ c:\windows\system32\30B.tmp

2008-12-04 18:16 . 2008-12-04 18:16 0 --a------ c:\windows\system32\309.tmp

2008-12-04 18:15 . 2008-12-04 18:15 0 --a------ c:\windows\system32\307.tmp

2008-12-04 18:15 . 2008-12-04 18:15 0 --a------ c:\windows\system32\305.tmp

2008-12-04 18:15 . 2008-12-04 18:15 0 --a------ c:\windows\system32\302.tmp

2008-12-04 18:14 . 2008-12-04 18:14 0 --a------ c:\windows\system32\2FF.tmp

2008-12-04 18:13 . 2008-12-04 18:13 0 --a------ c:\windows\system32\2FD.tmp

2008-12-04 18:13 . 2008-12-04 18:13 0 --a------ c:\windows\system32\2FA.tmp

2008-12-04 18:12 . 2008-12-04 18:12 0 --a------ c:\windows\system32\2F8.tmp

2008-12-04 18:11 . 2008-12-04 18:11 0 --a------ c:\windows\system32\2F5.tmp

2008-12-04 18:11 . 2008-12-04 18:11 0 --a------ c:\windows\system32\2F3.tmp

2008-12-04 18:10 . 2008-12-04 18:10 0 --a------ c:\windows\system32\2EF.tmp

2008-12-04 18:10 . 2008-12-04 18:10 0 --a------ c:\windows\system32\2ED.tmp

2008-12-04 18:10 . 2008-12-04 18:10 0 --a------ c:\windows\system32\2EB.tmp

2008-12-04 18:09 . 2008-12-04 18:09 0 --a------ c:\windows\system32\2E8.tmp

2008-12-04 18:09 . 2008-12-04 18:09 0 --a------ c:\windows\system32\2E6.tmp

2008-12-04 18:02 . 2008-12-04 18:02 0 --a------ c:\windows\system32\2DE.tmp

2008-12-04 18:02 . 2008-12-04 18:02 0 --a------ c:\windows\system32\2DC.tmp

2008-12-04 18:01 . 2008-12-04 18:01 0 --a------ c:\windows\system32\2D9.tmp

2008-12-04 17:59 . 2008-12-04 17:59 0 --a------ c:\windows\system32\2D7.tmp

2008-12-04 17:58 . 2008-12-04 17:58 0 --a------ c:\windows\system32\2D5.tmp

2008-12-04 17:58 . 2008-12-04 17:58 0 --a------ c:\windows\system32\2D2.tmp

2008-12-04 17:58 . 2008-12-04 17:58 0 --a------ c:\windows\system32\2CF.tmp

2008-12-04 17:57 . 2008-12-04 17:57 0 --a------ c:\windows\system32\2CD.tmp

2008-12-04 17:56 . 2008-12-04 17:56 0 --a------ c:\windows\system32\2CB.tmp

2008-12-04 17:54 . 2008-12-04 17:54 0 --a------ c:\windows\system32\2C9.tmp

2008-12-04 17:53 . 2008-12-04 17:53 0 --a------ c:\windows\system32\2C7.tmp

2008-12-04 17:53 . 2008-12-04 17:53 0 --a------ c:\windows\system32\2C5.tmp

2008-12-04 17:51 . 2008-12-04 17:51 0 --a------ c:\windows\system32\2C2.tmp

2008-12-04 17:49 . 2008-12-04 17:49 0 --a------ c:\windows\system32\2BF.tmp

2008-12-04 17:48 . 2008-12-04 17:48 0 --a------ c:\windows\system32\2BD.tmp

2008-12-04 17:47 . 2008-12-04 17:47 0 --a------ c:\windows\system32\2BB.tmp

2008-12-04 17:47 . 2008-12-04 17:47 0 --a------ c:\windows\system32\2B9.tmp

2008-12-04 17:46 . 2008-12-04 17:46 0 --a------ c:\windows\system32\2B6.tmp

2008-12-04 17:45 . 2008-12-04 17:45 0 --a------ c:\windows\system32\2B4.tmp

2008-12-04 17:43 . 2008-12-04 17:43 0 --a------ c:\windows\system32\2AB.tmp

2008-12-04 17:43 . 2008-12-04 17:43 0 --a------ c:\windows\system32\2A8.tmp

2008-12-04 17:43 . 2008-12-04 17:43 0 --a------ c:\windows\system32\2A5.tmp

2008-12-04 17:43 . 2008-12-04 17:43 0 --a------ c:\windows\system32\2A3.tmp

2008-12-04 17:42 . 2008-12-04 17:42 0 --a------ c:\windows\system32\2A1.tmp

2008-12-04 17:42 . 2008-12-04 17:42 0 --a------ c:\windows\system32\299.tmp

2008-12-04 17:42 . 2008-12-04 17:42 0 --a------ c:\windows\system32\297.tmp

2008-12-04 17:40 . 2008-12-04 17:40 0 --a------ c:\windows\system32\294.tmp

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-18 16:59 --------- d-----w c:\documents and settings\All Users\Application Data\CanonIJPLM

2008-11-01 18:06 318,464 --sha-w c:\windows\system32\7E.tmp

2008-10-31 17:54 318,464 --sha-w c:\windows\system32\67.tmp

2008-10-31 17:54 318,464 --sha-w c:\windows\system32\66.tmp

2008-10-31 17:54 278,528 --sha-w c:\windows\system32\69.tmp

2008-10-31 17:53 318,464 --sha-w c:\windows\system32\65.tmp

2008-10-31 17:53 307,200 --sha-w c:\windows\system32\62.tmp

2008-10-31 17:52 318,464 --sha-w c:\windows\system32\5F.tmp

2008-10-31 17:52 278,528 --sha-w c:\windows\system32\5C.tmp

2008-10-31 17:51 98,304 --sha-w c:\windows\system32\58.tmp

2008-10-31 17:51 318,464 --sha-w c:\windows\system32\5A.tmp

2008-10-31 17:51 318,464 --sha-w c:\windows\system32\59.tmp

2008-10-31 17:51 318,464 --sha-w c:\windows\system32\57.tmp

2008-10-31 17:51 318,464 --sha-w c:\windows\system32\56.tmp

2008-10-31 17:51 318,464 --sha-w c:\windows\system32\55.tmp

2008-10-31 17:49 318,464 --sha-w c:\windows\system32\4F.tmp

2008-10-31 17:49 245,760 --sha-w c:\windows\system32\30.tmp

2008-10-30 16:46 318,464 --sha-w c:\windows\system32\4E.tmp

2008-10-30 16:46 318,464 --sha-w c:\windows\system32\4D.tmp

2008-10-30 16:46 318,464 --sha-w c:\windows\system32\4C.tmp

2008-10-30 16:46 318,464 --sha-w c:\windows\system32\4B.tmp

2008-10-30 16:46 318,464 --sha-w c:\windows\system32\4A.tmp

2008-10-30 16:45 318,464 --sha-w c:\windows\system32\49.tmp

2008-10-30 16:45 318,464 --sha-w c:\windows\system32\48.tmp

2008-10-30 16:45 318,464 --sha-w c:\windows\system32\46.tmp

2008-10-30 16:45 318,464 --sha-w c:\windows\system32\45.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\44.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\43.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\41.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\40.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\3F.tmp

2008-10-30 16:44 318,464 --sha-w c:\windows\system32\3E.tmp

2008-10-30 16:43 318,464 --sha-w c:\windows\system32\3D.tmp

2008-10-30 16:43 318,464 --sha-w c:\windows\system32\3C.tmp

2008-10-30 16:43 318,464 --sha-w c:\windows\system32\3B.tmp

2008-10-30 16:43 318,464 --sha-w c:\windows\system32\39.tmp

2008-10-30 16:43 299,008 --sha-w c:\windows\system32\3A.tmp

2008-10-30 16:42 318,464 --sha-w c:\windows\system32\36.tmp

2008-10-30 16:42 318,464 --sha-w c:\windows\system32\33.tmp

2008-10-30 16:42 290,816 --sha-w c:\windows\system32\31.tmp

2008-10-30 16:42 237,568 --sha-w c:\windows\system32\32.tmp

2008-10-30 16:42 172,032 --sha-w c:\windows\system32\34.tmp

2008-10-30 16:42 122,880 --sha-w c:\windows\system32\35.tmp

2008-10-30 16:41 318,464 --sha-w c:\windows\system32\2F.tmp

2008-10-30 16:41 249,856 --sha-w c:\windows\system32\23.tmp

2008-10-28 20:47 131,072 ----a-w c:\windows\system32\confmsp3232323232323232.dll

2008-10-28 20:42 131,072 ----a-w c:\windows\system32\comsvcs323232323232323232.dll

2008-10-28 20:39 131,072 ----a-w c:\windows\system32\comsnap32323232323232.dll

2008-10-28 20:31 131,072 ----a-w c:\windows\system32\compobj323232323232.dll

2008-10-28 20:29 131,072 ----a-w c:\windows\system32\compatUI32323232323232323232.dll

2008-10-28 20:19 131,072 ----a-w c:\windows\system32\comctl323232323232.dll

2008-10-28 20:16 131,072 ----a-w c:\windows\system32\colbact323232323232323232323232.dll

2008-10-28 20:15 131,072 ----a-w c:\windows\system32\CNMLM93323232323232323232.dll

2008-10-28 20:14 131,072 ----a-w c:\windows\system32\cnetcfg3232323232323232.dll

2008-10-28 20:13 131,072 ----a-w c:\windows\system32\CNC610L323232.dll

2008-10-28 20:12 131,072 ----a-w c:\windows\system32\CNC610I3232323232.dll

2008-10-28 20:11 131,072 ----a-w c:\windows\system32\CNC610C323232.dll

2008-10-28 20:10 131,072 ----a-w c:\windows\system32\cnbjmon32323232.dll

2008-10-28 20:09 131,072 ----a-w c:\windows\system32\cfgmgr323232.dll

2008-10-28 20:08 131,072 ----a-w c:\windows\system32\cfgbkend323232.dll

2008-10-28 20:07 131,072 ----a-w c:\windows\system32\cewmdm32.dll

2008-10-28 20:06 131,072 ----a-w c:\windows\system32\certcli3232.dll

2008-10-28 20:05 131,072 ----a-w c:\windows\system32\cdosys323232.dll

2008-10-28 20:04 131,072 ----a-w c:\windows\system32\cdmodem32.dll

2008-10-28 20:03 131,072 ----a-w c:\windows\system32\ccfgnt323232.dll

2008-10-28 20:02 131,072 ----a-w c:\windows\system32\catsrvut3232.dll

2008-10-28 20:01 131,072 ----a-w c:\windows\system32\catsrv323232.dll

2008-10-28 20:00 131,072 ----a-w c:\windows\system32\cards3232.dll

2008-10-28 19:57 131,072 ----a-w c:\windows\system32\cryptnet323232323232.dll

2008-10-28 19:55 131,072 ----a-w c:\windows\system32\cryptext32323232323232.dll

2008-10-28 19:51 131,072 ----a-w c:\windows\system32\cryptdlg32323232.dll

2008-10-28 19:48 131,072 ----a-w c:\windows\system32\crtdll323232323232.dll

2008-10-28 19:44 131,072 ----a-w c:\windows\system32\corpol3232323232323232.dll

2008-10-28 19:40 131,072 ----a-w c:\windows\system32\confmsp32323232323232.dll

2008-10-28 19:37 131,072 ----a-w c:\windows\system32\compstui323232.dll

2008-10-28 19:36 131,072 ----a-w c:\windows\system32\comrepl323232323232.dll

2008-10-28 19:36 131,072 ----a-w c:\windows\system32\CNC610O323232323232323232.dll

2008-10-28 19:35 131,072 ----a-w c:\windows\system32\cnvfat323232323232.dll

2008-10-28 19:34 131,072 ----a-w c:\windows\system32\comsvcs3232323232323232.dll

2008-10-28 19:34 131,072 ----a-w c:\windows\system32\CNC610I32323232.dll

2008-10-28 19:33 131,072 ----a-w c:\windows\system32\comdlg3232323232323232323232.dll

2008-10-28 19:33 131,072 ----a-w c:\windows\system32\clbcatq323232.dll

2008-10-28 19:32 131,072 ----a-w c:\windows\system32\CNC610O3232323232323232.dll

2008-10-28 19:31 131,072 ----a-w c:\windows\system32\compobj3232323232.dll

2008-10-28 19:31 131,072 ----a-w c:\windows\system32\cfgmgr3232.dll

2008-10-28 19:30 131,072 ----a-w c:\windows\system32\colbact3232323232323232323232.dll

2008-10-28 19:30 131,072 ----a-w c:\windows\system32\certmgr323232.dll

2008-10-28 19:29 131,072 ----a-w c:\windows\system32\cnvfat3232323232.dll

2008-10-28 19:29 131,072 ----a-w c:\windows\system32\cdfview323232.dll

2008-10-28 19:28 131,072 ----a-w c:\windows\system32\CNMLM933232323232323232.dll

2008-10-28 19:28 131,072 ----a-w c:\windows\system32\catsrvut32.dll

2008-10-28 19:27 131,072 ----a-w c:\windows\system32\cnetcfg32323232323232.dll

2008-10-28 19:26 131,072 ----a-w c:\windows\system32\comrepl3232323232.dll

2008-10-28 19:26 131,072 ----a-w c:\windows\system32\CNC610I323232.dll

2008-10-28 19:25 131,072 ----a-w c:\windows\system32\compobj32323232.dll

2008-10-28 19:25 131,072 ----a-w c:\windows\system32\ciodm3232.dll

2008-10-28 19:24 131,072 ----a-w c:\windows\system32\comctl3232323232.dll

2008-10-28 19:24 131,072 ----a-w c:\windows\system32\capesnpn3232.dll

2008-10-28 19:23 131,072 ----a-w c:\windows\system32\CNC610L3232.dll

2008-10-28 19:22 131,072 ----a-w c:\windows\system32\commdlg323232323232323232.dll

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-17 68856]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]

"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-23 1032192]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]

"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]

"OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]

"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-07-01 303104]

"MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2005-07-08 212992]

"MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 1117184]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-23 29744]

"MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 110592]

"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]

"VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 163840]

"MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-10-02 999424]

"Telenor Online Start"="c:\program files\Telenor\Online Start\Telenor.exe" [2006-11-30 178312]

"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]

"SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 c:\windows\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-12-22 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\4cd38e9f448]

2008-09-24 12:00 126976 c:\windows\system32\dmconfig32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\4cd38e9f486]

2008-10-22 15:52 131072 c:\windows\system32\dskquota32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

S0 wfnd;wfnd;c:\windows\system32\drivers\xqed.sys []

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-22 29744]

S3 MODRC;Hauppauge Nova-T IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-01-22 15104]

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

2008-12-06 c:\windows\Tasks\McAfee.com Scan for virus - Denne computer (D7LNWN2J-Hildur Sagen).job

- c:\program files\mcafee.com\vso\mcmnhdlr.exe [2005-07-08 19:18]

.

- - - - TOMME PEKERE FJERNET - - - -

Notify-WgaLogon - (no file)

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-06 13:52:36

Windows 5.1.2600 Service Pack 2 NTFS

skanner skjulte prosesser ...

skanner skjulte autostart-oppføringer ...

skanner skjulte filer ...

skanning vellykket

skjulte filer: 0

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

- - - - - - - > 'winlogon.exe'(668)

c:\windows\System32\dmconfig32.dll

c:\windows\System32\dskquota32.dll

c:\windows\system32\Ati2evxx.dll

c:\windows\System32\BCMLogon.dll

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\WLTRYSVC.EXE

c:\windows\system32\BCMWLTRY.EXE

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Canon\IJPLM\ijplmsvc.exe

c:\program files\McAfee.com\Agent\Mcdetect.exe

c:\progra~1\McAfee.com\VSO\McShield.exe

c:\progra~1\McAfee.com\Agent\McTskshd.exe

c:\progra~1\McAfee.com\VSO\oasclnt.exe

c:\program files\McAfee.com\VSO\mcvsshld.exe

c:\program files\McAfee.com\Agent\mcagent.exe

c:\progra~1\McAfee.com\VSO\McVSEscn.exe

c:\progra~1\McAfee.com\PERSON~1\MpfService.exe

c:\program files\ATI Technologies\ATI.ACE\CLI.exe

c:\program files\Dell\QuickSet\NicConfigSvc.exe

c:\progra~1\McAfee.com\PERSON~1\MpfAgent.exe

c:\progra~1\McAfee.com\VSO\mcvsftsn.exe

c:\program files\Messenger\msmsgs.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\ehome\ehmsas.exe

c:\program files\ATI Technologies\ATI.ACE\CLI.exe

c:\progra~1\McAfee\SPAMKI~1\MSKSrvr.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2008-12-06 13:57:29 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2008-12-06 12:57:25

Pre-Run: 62 115 405 824 bytes free

Post-Run: 62,049,914,880 byte ledig

WindowsXP-KB310994-SP2-Pro-BootDisk-NOR.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

378 --- E O F --- 2008-11-13 08:50:57

Mbam:

Malwarebytes' Anti-Malware 1.31

Databaseversjon: 1466

Windows 5.1.2600 Service Pack 2

06.12.2008 13:19:28

mbam-log-2008-12-06 (13-19-28).txt

Skanntype: Full Skann (C:\|)

Objekter skannet: 91851

Tid tilbakelagt: 26 minute(s), 56 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 2

Registernøkler infisert: 10

Registerverdier infisert: 2

Registerfiler infisert: 10

Mapper infisert: 0

Filer infisert: 43

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

C:\WINDOWS\system32\drmclien32.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\__c0079CAE.dat (Trojan.Agent) -> Delete on reboot.

Registernøkler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{121be1b7-52ef-3a81-b22a-67cba8e92737} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{121be1b7-52ef-3a81-b22a-67cba8e92737} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{7099b1bf-c586-3f0d-aef4-dde5bb5b391b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{a98f394e-d025-3e6f-8efe-5d39ad5313e8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{121be1b7-52ef-3a81-b22a-67cba8e92737} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{a70d9ac3-936b-341b-a871-7e15bb88df28} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{10e02a21-afa0-3317-b159-a346a4333b2e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1e2da2fc-367c-392c-a602-e6d1629e68b1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e2da2fc-367c-392c-a602-e6d1629e68b1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0079cae (Trojan.Vundo) -> Delete on reboot.

Registerverdier infisert:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f645dfd2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f3b854.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registerfiler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\cdm3232.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\cdm3232.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\clb3232.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\clb3232.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\drmclien32.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\drmclien32.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\dmutil32.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\dmutil32.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\basesrv32.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\basesrv32.dll -> Quarantined and deleted successfully.

Mapper infisert:

(Ingen mistenkelige filer funnet)

Filer infisert:

C:\WINDOWS\system32\mwb58139.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\mx69746.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wb58139.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mmx69746.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Hildur Sagen\Local Settings\Temp\_A00F645DFD2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Hildur Sagen\Local Settings\Temp\_A00F3B854.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cdm3232.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\clb3232.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drmclien32.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\dmutil32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\KB25555.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\KB49917.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0079CAE.dat (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\__c0095313.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00DF049.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00E90A0.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\basesrv32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0038F04.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0041A51.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00500B9.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c005619E.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c006051E.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00613C4.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0062FA9.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0095652.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00A9CA1.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00C5C4E.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00C5D77.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

hjt:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:10:20, on 06.12.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

c:\program files\mcafee.com\agent\mcdetect.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

c:\PROGRA~1\mcafee.com\vso\OasClnt.exe

c:\program files\mcafee.com\vso\mcvsshld.exe

c:\program files\mcafee.com\agent\mcagent.exe

c:\progra~1\mcafee.com\vso\mcvsescn.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Dell\QuickSet\quickset.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

C:\Program Files\Telenor\Online Start\Telenor.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

c:\progra~1\mcafee.com\vso\mcvsftsn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default....;l=no&s=gen

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.no/ig/dell?hl=no&client=dell-row&channel=no&ibd=0061222

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.no/ig/dell?hl=no&cli...amp;ibd=0061222

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll

O2 - BHO: FINBHO - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Program Files\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll

O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)

O20 - Winlogon Notify: 4cd38e9f448 - C:\WINDOWS\System32\dmconfig32.dll

O20 - Winlogon Notify: 4cd38e9f486 - C:\WINDOWS\System32\dskquota32.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe

O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 10277 bytes

raWrz · 6. desember 2008

*klippe*

Endret 6. desember 2008 av Submit

ungkar1 · 6. desember 2008

ny combofix:

ComboFix 08-12-05.06 - Hildur Sagen 2008-12-06 14:53:55.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.418 [GMT 1:00]

Kjører fra: c:\documents and settings\Hildur Sagen\Desktop\ComboFix.exe

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PACKET

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-06 til 2008-12-06 )))))))))))))))))))))))))))))))))

.

2008-12-06 14:19 . 2008-12-06 14:19 <DIR> d-------- c:\windows\LastGood.Tmp

2008-12-06 14:15 . 2008-12-06 14:14 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-06 14:15 . 2008-12-06 14:14 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-12-06 14:10 . 2008-12-06 14:10 <DIR> d-------- c:\program files\Trend Micro

2008-12-06 13:55 . 2008-12-06 13:55 <DIR> d--hs---- c:\windows\system32\GroupPolicyManifest