[Løst]"Thumbs.db" dukker opp i diverse mapper. Logger vedlagt

SteinarN · 8. januar 2009

Jeg har tidligere hatt diverse malware på min laptop. Jeg har fått fjernet det meste men det ser ut som noe er igjen. Måten jeg ser det på er at det er ei fil, "Thumbs.db", som dukker opp på mystisk vis i alle mapper som inneholder bilder i allefall og som er umulig å fjerne. Hvis jeg sletter fila og går ut av mappa så er fila der igjen neste gang jeg åpner mappa :hmm:

Jeg har fulgt instruksjonene i en glimrende tråd her inne og legger ved disse loggene.

Hvis noen har anledning å se på de så blir jeg veldig takknemlig

Combofix

ComboFix 09-01-07.03 - Administrator 2009-01-08 17:51:22.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.1015.633 [GMT 1:00]

Kjører fra: c:\documents and settings\Administrator\Skrivebord\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\_000006_.tmp.dll

E:\Autorun.inf

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-08 til 2009-01-08 )))))))))))))))))))))))))))))))))

.

2009-01-08 17:30 . 2009-01-08 17:30 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2009-01-08 17:30 . 2009-01-08 17:30 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2009-01-08 17:30 . 2009-01-08 17:30 <DIR> d-------- c:\documents and settings\Administrator\Programdata\Malwarebytes

2009-01-08 17:30 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-08 17:30 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-31 14:45 . 2001-01-05 13:42 351,232 --a------ c:\windows\system32\ibmgr.cpl

2008-12-31 14:45 . 2001-01-05 13:41 346,624 --a------ c:\windows\system32\gds32.dll

2008-12-31 14:43 . 2008-12-31 14:43 <DIR> d-------- c:\programfiler\Fellesfiler\Borland Shared

2008-12-31 14:42 . 2008-12-31 14:42 <DIR> d-------- c:\programfiler\Common Files

2008-12-31 14:39 . 2008-12-31 14:39 <DIR> d-------- c:\programfiler\Carrier

2008-12-31 14:37 . 2003-12-09 11:13 184,320 --a------ c:\windows\system32\DCUninst.exe

2008-12-31 14:37 . 1998-06-23 23:00 164,144 --a------ c:\windows\system32\comct232.ocx

2008-12-31 14:37 . 2002-10-11 15:27 69,731 --a------ c:\windows\system32\drivers\LEVELII.SYS

2008-12-31 14:37 . 2000-05-01 09:28 25,110 --a------ c:\windows\system32\InsLvlII.exe

2008-12-31 14:37 . 2003-08-08 09:22 7,718 --a------ c:\windows\uninstdc.isu

2008-12-11 18:20 . 2008-12-11 19:29 <DIR> d-------- c:\programfiler\Fellesfiler\Nokia

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-03 13:47 --------- d-----w c:\documents and settings\Administrator\Programdata\LimeWire

2008-12-31 13:37 --------- d-----w c:\programfiler\Fellesfiler\Carrier Shared

2008-12-27 16:07 --------- d-----w c:\documents and settings\Administrator\Programdata\OpenOffice.org2

2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll

2008-12-11 18:08 --------- d-----w c:\programfiler\Nokia

2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys

2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll

2008-10-23 13:01 283,648 ------w c:\windows\system32\dllcache\gdi32.dll

2008-10-16 13:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe

2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll

2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe

2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll

2008-10-15 17:01 332,800 ------w c:\windows\system32\dllcache\netapi32.dll

2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe

2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\programfiler\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"SynTPEnh"="c:\programfiler\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761948]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]

"QlbCtrl"="c:\programfiler\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-05-08 131072]

"Cpqset"="c:\programfiler\HPQ\Default Settings\cpqset.exe" [2006-01-26 172094]

"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-09 806912]

"LVCOMS"="c:\programfiler\Fellesfiler\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-28 1261336]

"Adobe Photo Downloader"="c:\programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]

"MsmqIntCert"="mqrt.dll" [2007-07-06 c:\windows\system32\mqrt.dll]

"AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 c:\windows\AGRSMMSG.exe]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

BTTray.lnk - c:\programfiler\WIDCOMM\Bluetooth-programvare\BTTray.exe [2006-01-18 581693]

Logitech Desktop Messenger.lnk - c:\programfiler\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-11-24 169472]

Logitech SetPoint.lnk - c:\programfiler\Logitech\SetPoint\SetPoint.exe [2007-03-28 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start-meny^Programmer^Oppstart^OpenOffice.org 2.4.lnk]

path=c:\documents and settings\Administrator\Start-meny\Programmer\Oppstart\OpenOffice.org 2.4.lnk

backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^DataDECT.lnk]

path=c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\DataDECT.lnk

backup=c:\windows\pss\DataDECT.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

--a------ 2005-06-06 22:46 57344 c:\programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 21:16 39792 c:\programfiler\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]

--a------ 2002-12-10 18:32 155648 c:\programfiler\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]

--a------ 2002-12-10 18:31 61440 c:\programfiler\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

--a------ 2007-11-24 19:19 20480 c:\programfiler\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Scheduler]

--a------ 2006-02-15 16:43 892928 c:\windows\SMINST\Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2008-06-10 03:27 144784 c:\programfiler\Java\jre1.6.0_07\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\WINDOWS\\SMINST\\Scheduler.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\Messenger\\msmsgs.exe"=

"c:\\Programfiler\\MSN Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\MSN Messenger\\livecall.exe"=

"c:\\Programfiler\\LimeWire\\LimeWire.exe"=

"c:\\Programfiler\\Mozilla Firefox\\firefox.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgemc.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-13 97928]

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2006-02-28 87808]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-10-21 36352]

R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-13 875288]

R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-13 231704]

R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-08-13 76040]

R4 MCT10 Service;MCT10 Service;c:\programfiler\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe [2008-05-08 192512]

S3 DFSTR2K;DATAFAB based USB Mass Storage Driver;c:\windows\system32\drivers\DfStor2K.sys [2008-08-06 37972]

S3 PcCGoCls;PcCGoCls;c:\windows\system32\drivers\pccgocls.sys [2004-10-26 33510]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

.

- - - - TOMME PEKERE FJERNET - - - -

MSConfigStartUp-Nokia Tray Application - c:\programfiler\Fellesfiler\Nokia\NCLTools\NclTray.exe

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.startsiden.no/

uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/

IE: Send til &Bluetooth - c:\programfiler\WIDCOMM\Bluetooth-programvare\btsendto_ie_ctx.htm

FF - ProfilePath - c:\documents and settings\Administrator\Programdata\Mozilla\Firefox\Profiles\hj8y6tts.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.startsiden.no/

FF - plugin: c:\programfiler\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----

c:\programfiler\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no");

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-08 17:52:57

Windows 5.1.2600 Service Pack 2 NTFS

skanner skjulte prosesser ...

skanner skjulte autostart-oppføringer ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\programfiler\HPQ\Default Settings\cpqset.exe??????]????p????|?????? ??4B??????????????hB??????]?

skanner skjulte filer ...

skanning vellykket

skjulte filer: 0

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

- - - - - - - > 'winlogon.exe'(972)

c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(1076)

c:\windows\system32\avgrsstx.dll

.

Tidspunkt ferdig: 2009-01-08 17:53:52

ComboFix-quarantined-files.txt 2009-01-08 16:53:48

Pre-Run: 21 000 151 040 byte ledig

Post-Run: 22,942,924,800 byte ledig

WindowsXP-KB310994-SP2-Pro-BootDisk-NOR.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

180 --- E O F --- 2008-12-18 02:00:40

Malwarebytes

Malwarebytes' Anti-Malware 1.32

Databaseversjon: 1631

Windows 5.1.2600 Service Pack 2

08.01.2009 17:37:27

mbam-log-2009-01-08 (17-37-27).txt

Skanntype: Rask Skann

Objekter skannet: 50212

Tid tilbakelagt: 5 minute(s), 47 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 1

Registerverdier infisert: 0

Registerfiler infisert: 1

Mapper infisert: 0

Filer infisert: 0

Minneprosesser infisert: