pettsorg Skrevet 9. januar 2009 Del Skrevet 9. januar 2009 Har forsøkt å følge veiledningen til norbat. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:33:18, on 09.01.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\schtasks.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Norman\Npm\Bin\Zlh.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Windows\system32\jusched.exe C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Elertz\Elertz.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\hp\kbd\kbd.exe C:\Program Files\Norman\Nvc\Bin\Nip.exe C:\Program Files\Norman\Nvc\Bin\cclaw.exe C:\Windows\Explorer.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe C:\Users\Sørgård\test.exe.exe C:\Windows\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: UltraEdit Toolbar - {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - C:\PROGRA~1\UE_TOO~1\UE_TOO~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: UltraEdit Toolbar - {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - C:\PROGRA~1\UE_TOO~1\UE_TOO~1.DLL O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [sunJavaUpdateReg] "C:\Windows\system32\jureg.exe" O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe" O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [option heck] "C:\ProgramData\Cdromskipskip.7bzzcf" O4 - Startup: Elertz.lnk = C:\Program Files\Elertz\Elertz.exe O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe O4 - Startup: OneNote 2007 Screen Clipper og Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype add-on - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Sørgård\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O13 - Gopher Prefix: O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\Windows\system32\ezNTSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdiserv.exe O23 - Service: lxdi_device - - C:\Windows\system32\lxdicoms.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\Bin\Njeeves.exe O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Nvcsched.exe O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- End of file - 11633 bytes ---------------------------------------------------------------------------------------------------------------- ComboFix 09-01-08.01 - Sørgård 2009-01-09 16:57:45.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.2046.968 [GMT 1:00] Kjører fra: c:\users\Sørgård\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-09 til 2009-01-09 ))))))))))))))))))))))))))))))))) . 2009-01-09 16:10 . 2009-01-09 16:10 401,720 --a------ c:\users\Sørgård\test.exe.exe 2009-01-09 16:10 . 2009-01-09 16:10 401,720 --a------ c:\users\Sørgård\test.exe.exe 2009-01-08 22:07 . 2009-01-08 22:07 2,913,557 -ra------ c:\users\Sørgård\ComboFix.exe 2009-01-08 22:07 . 2009-01-08 22:07 2,913,557 -ra------ c:\users\Sørgård\ComboFix.exe 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\All Users\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\programdata\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-06 21:17 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-01-06 21:17 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-12-24 13:11 . 2008-12-24 13:11 <DIR> d-------- c:\program files\Microsoft IntelliPoint 2008-12-23 12:23 . 2008-12-23 12:23 <DIR> d-------- c:\program files\ue_toolbar 2008-12-23 12:22 . 2008-12-23 12:22 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\IDMComp 2008-12-23 12:21 . 2008-12-23 12:25 <DIR> d-------- c:\program files\IDM Computer Solutions 2008-12-19 18:47 . 2008-12-25 21:43 <DIR> d-------- c:\users\Sørgård\Pictures 2008-12-19 18:47 . 2008-12-25 21:43 <DIR> d-------- c:\users\Sørgård\Pictures 2008-12-13 03:03 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll 2008-12-11 15:39 . 2008-12-11 15:39 <DIR> d-------- c:\windows\System32\Adobe 2008-12-10 19:02 . 2008-12-10 19:02 <DIR> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2 2008-12-10 18:56 . 2008-12-10 18:56 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\Mozilla 2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\com.elertz.stage.9AF4EE1EA9AB71EAD9D48655BC2ADB5C2C8D7DBB.1 2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\program files\Elertz 2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\program files\Common Files\Adobe AIR . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-09 16:00 8,126,464 --sha-w c:\users\Sørgård\ntuser.dat 2009-01-09 16:00 8,126,464 --sha-w c:\users\Sørgård\ntuser.dat 2009-01-09 15:58 --------- d-----w c:\users\Sørgård\AppData\Roaming\uTorrent 2009-01-09 15:10 401,720 ----a-w c:\users\Sørgård\test.exe.exe 2009-01-09 15:10 401,720 ----a-w c:\users\Sørgård\test.exe.exe 2009-01-08 21:07 2,913,557 ----a-r c:\users\Sørgård\ComboFix.exe 2009-01-08 21:07 2,913,557 ----a-r c:\users\Sørgård\ComboFix.exe 2009-01-08 17:25 --------- d-----w c:\program files\Norman 2009-01-06 20:17 --------- d-----w c:\users\Sørgård\AppData\Roaming\Malwarebytes 2009-01-06 19:17 --------- d-----w c:\program files\NCH Software 2009-01-06 19:16 --------- d-----w c:\programdata\NCH Software 2009-01-02 10:04 --------- d-----w c:\programdata\IntraSoftMeal 2009-01-02 10:04 --------- d-----w c:\programdata\Admin Inter 1 Mags 2008-12-29 20:58 --------- d-----w c:\programdata\TrackMania 2008-12-29 20:39 --------- d-----w c:\program files\Common Files\Steam 2008-12-28 17:29 --------- d-----w c:\program files\EasyBits For Kids 2008-12-23 11:23 --------- d-----w c:\program files\Google 2008-12-23 11:22 --------- d-----w c:\users\Sørgård\AppData\Roaming\IDMComp 2008-12-22 20:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\LimeWire 2008-12-13 02:06 --------- d-----w c:\programdata\Microsoft Help 2008-12-10 17:56 --------- d-----w c:\users\Sørgård\AppData\Roaming\Mozilla 2008-12-10 15:20 --------- d-----w c:\users\Sørgård\AppData\Roaming\com.elertz.stage.9AF4EE1EA9AB71EAD9D48655BC2ADB5C2C8D7DBB.1 2008-12-10 15:19 --------- d-----w c:\users\Sørgård\AppData\Roaming\Adobe 2008-12-06 17:33 --------- d-----w c:\programdata\Lx_cats 2008-11-30 12:07 --------- d-----w c:\users\Sørgård\AppData\Roaming\Google 2008-11-30 00:08 --------- d-----w c:\programdata\WindowsSearch 2008-11-28 22:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\Ahead 2008-11-28 21:37 --------- d-----w c:\users\Sørgård\AppData\Roaming\Nero 2008-11-24 16:49 --------- d-----w c:\users\Sørgård\AppData\Roaming\fretsonfire 2008-11-24 16:48 --------- d-----w c:\program files\Frets on Fire 2008-11-22 16:40 --------- d---a-w c:\programdata\TEMP 2008-11-16 13:58 --------- d-----w c:\programdata\Yahoo! Companion 2008-11-16 13:57 --------- d-----w c:\users\Sørgård\AppData\Roaming\Yahoo! 2008-11-16 13:57 --------- d-----w c:\program files\Yahoo! 2008-11-16 13:57 --------- d-----w c:\program files\DivX 2008-11-16 13:57 --------- d-----w c:\program files\Common Files\PX Storage Engine 2008-11-16 13:34 --------- d-----w c:\users\Sørgård\AppData\Roaming\NCH Swift Sound 2008-11-16 13:34 --------- d-----w c:\programdata\NCH Swift Sound 2008-11-16 13:33 --------- d-----w c:\users\Sørgård\AppData\Roaming\Recordpad 2008-11-16 13:33 --------- d-----w c:\program files\NCH Swift Sound 2008-11-16 12:16 --------- d-----w c:\users\Sørgård\AppData\Roaming\NCH Software 2008-11-09 09:27 --------- d-----w c:\program files\Common Files\Adobe 2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll 2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll 2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe 2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\System32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\System32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\System32\DivX.dll 2008-10-22 15:21 21,248 ----a-w c:\windows\Help\OEM\scripts\HPScript.exe 2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll 2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll 2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll 2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe 2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll 2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll 2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll 2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll 2008-10-16 13:08 162,064 ----a-w c:\windows\System32\wuwebv.dll 2008-10-16 12:56 31,232 ----a-w c:\windows\System32\wuapp.exe 2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll 2008-08-06 10:33 174 --sha-w c:\program files\desktop.ini 2008-04-14 21:46 352 ----a-w c:\users\Sørgård\AppData\Roaming\wklnhst.dat 2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-04-16 19:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-09-24 19:17 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-08_22.15.04,15 ))))))))))))))))))))))))))))))))))))))))) . - 2009-01-08 21:14:21 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-01-09 06:16:39 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-01-09 06:16:39 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-01-08 21:01:11 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-01-09 13:11:03 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-01-09 13:11:03 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-01-09 13:11:03 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-01-08 21:10:25 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-01-09 15:57:32 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-01-09 15:57:32 262,144 ---ha-w c:\windows\System32\config\systemprofile\ntuser.dat.LOG1 . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "option heck"="c:\programdata\Cdromskipskip.7bzzcf" [X] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2008-08-28 267056] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 c:\windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176] "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-01 185896] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8473120] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-28 81920] "lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864] "lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264] "FaxCenterServer"="c:\program files\\Lexmark Fax Solutions\fm3032.exe" [2007-07-16 311984] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2008-11-16 577540] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736] "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168] c:\users\S›rg†rd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Elertz.lnk - c:\program files\Elertz\Elertz.exe [2008-12-10 95232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{E54729E8-BB3D-4270-9D49-7389EA579090}"= "c:\windows\system32\EZUPBH~1.DLL" [2007-12-30 49152] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{A2B307A1-BC0E-4C91-83DA-9F6338F17EE4}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{9D3427D2-E6E0-458D-A2B7-8377E995A096}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "TCP Query User{B88DA5D7-3C24-4352-9129-C4AA4DF84F6F}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{B103764B-EF0A-4673-ABD5-792A0AB20CF1}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "{8F6E84AC-BED9-45D5-AEEA-B95BFC08FA19}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{7DF8E849-08CE-4D4D-AD4A-8A56F34CA80A}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "UDP Query User{2E236115-168C-4ED9-B994-181FF429FDD3}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "TCP Query User{9592B6F2-C9F8-445E-9A9D-CF4F53D468AD}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{AA678E1C-BFA9-4BFF-BEA6-1D8A8C9FC180}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{1782493F-C3E2-4AE1-AABF-88EE0BED3F38}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{AD12179C-9E9B-4838-9A42-B90BEEFA9CC6}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher "{DB025AB4-402D-4CB7-AF65-E973575C3051}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{8EACF0C2-C809-436D-BA75-FFBF8E86DF3A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{1B32DF02-9B31-45BD-AFE2-DE763464195E}c:\\users\\public\\favorites\\soldat\\soldat.exe"= UDP:c:\users\public\favorites\soldat\soldat.exe:Soldat "UDP Query User{BEAAD2A3-A381-4ACB-88FB-076C69159FC9}c:\\users\\public\\favorites\\soldat\\soldat.exe"= TCP:c:\users\public\favorites\soldat\soldat.exe:Soldat "TCP Query User{81B11C73-572A-4F06-B35A-4C7E5EBC99B4}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{697047D6-75C4-4679-95D8-53A8C81C9F6B}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{FC5818B1-A0E5-4401-A0AE-D28782374CEF}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2 "UDP Query User{78FEEBD9-CBB4-4607-AE65-737BD24C9CE9}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2 "TCP Query User{0408E632-481D-4C68-8382-1237075D158E}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= UDP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe "UDP Query User{8E808690-BB2B-40C3-89E3-90826E83B708}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= TCP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe "{A47B7D02-FAF6-42AB-8461-897068015047}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{D8EEBBC3-ACCA-4DAB-B0D3-2FE8475FB58F}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{81A6D47C-C00F-4770-B2A0-2C0355D9D829}"= UDP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System "{283F98D2-EC56-4259-975D-DDE54E08B524}"= TCP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System "{389081A5-99F7-44F7-91A2-E5A8EA8EA165}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor "{0D0EC6D2-9BCD-4043-9C23-898A41387C1A}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor "{7931F36E-BC06-4890-8748-152369856518}"= UDP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio "{F68767D5-66F2-44CD-9A7A-40C14B997693}"= TCP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio "{B6876E4C-656F-4376-9064-05D6EAA37D31}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader "{EA8ABF52-AB62-4587-883E-D802D313B8B7}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader "{CF6C747E-8B06-4DE5-A91C-1BE8479FA9AB}"= UDP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software "{74B87CC5-E929-4B3D-A505-3AAC7DD4AB1C}"= TCP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software "{3DC666A0-4DC2-4226-883B-401C6AF2660B}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor "{B1823633-7EC3-4F4A-B671-76C52345D453}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor "{C2EC2842-AD06-4778-AC8F-D447BF7ED30D}"= UDP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe: "{131F209F-CF15-403B-AC15-26696C27085B}"= TCP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe: "{FBAB35E3-79C6-43EE-8DD7-C97362567535}"= UDP:c:\windows\System32\lxdicfg.exe:Printer Communication System "{95F16687-EBCE-421F-90BF-7C98A215D1D0}"= TCP:c:\windows\System32\lxdicfg.exe:Printer Communication System "{F1B1D1A8-41F8-4F4B-A324-7E417C17FE35}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface "{33DA2F52-FB00-4D84-8B1B-DF9D1AA9210E}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface "{5688B4D1-BA88-4035-908D-714F38FA0E13}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable "{6722AC72-ECC7-48B0-964E-B90CF862A394}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable "TCP Query User{0E9BDF17-3C7C-44CE-9647-AF084D4D5022}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= UDP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application "UDP Query User{E121DDDE-FB98-4298-AD74-87841AC7EDEE}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= TCP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application "TCP Query User{F9DDAE83-247E-438F-89EE-5B5C9604ECE1}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "UDP Query User{B22390F0-A589-4810-9E3E-B92E99423C4F}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "TCP Query User{66E39694-3207-4C62-9019-E9869869698C}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2 "UDP Query User{D76FE665-7B16-4808-9E40-4AB77B6410CE}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2 "{1226765F-0639-480F-89CA-DB5D64224A24}"= UDP:86:BroadCam Web Server "TCP Query User{862C6833-395A-498E-8659-5DF9A11E9FF8}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever "UDP Query User{4C27CCBF-36DD-4F8F-BC7E-1C3254152F29}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever "TCP Query User{946DB024-A0FF-47DB-B48B-6BE9084F77E9}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= UDP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor "UDP Query User{7CDBF0F9-6A61-4004-8995-1111B2165FB0}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= TCP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-01-06 38496] R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\System32\drivers\netr73.sys [2008-02-26 493568] R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-30 322616] R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-04 19512] R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-06-30 191544] R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2008-11-06 154680] R4 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-09-24 554352] R4 ezntsvc;EasyBits Magic Desktop Services for Windows NT;c:\windows\System32\ezntsvc.exe [2007-12-30 33792] R4 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-09-24 198240] R4 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?] R4 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdiserv.exe [2007-06-11 99248] R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2008-03-01 20448] R4 NVOY;Norman's Very Own supplY of resources;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-11-06 121912] --- Other Services/Drivers In Memory --- *NewlyCreated* - MBAMSWISSARMY *Deregistered* - mchInjDrv [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{503454b0-b6f6-11dc-a3b4-806e6f6e6963}] \shell\AutoRun\command - E:\Autorun.exe . . ------- Tilleggsskanning ------- . uStart Page = hxxp://www.startsiden.no/ mStart Page = hxxp://www.yahoo.com IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Sørgård\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk FF - ProfilePath - ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.color_management.mode", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.color_management.rendering_intent", 0); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.downloadable_fonts.enabled", true); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.downloadable_fonts.enforce_same_site_origin", true); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("javascript.options.jit.content", true); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("javascript.options.jit.chrome", false); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("layout.css.visited_links_enabled", true); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("ui.panel.default_level_parent", false); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("image.cache.size", 5242880); c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("image.cache.timeweight", 500); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.search.sources", 3); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.restrict.history", "^"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.restrict.tag", "+"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.match.title", "#"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.match.url", "@"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.search.cache.enabled", true); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ctrlTab.previews", true); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ctrlTab.recentlyUsedLimit", 7); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("privacy.sanitize.timeSpan", 0); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.up", "cmd_scrollTop"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.down", "cmd_scrollBottom"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.out", "cmd_fullZoomEnlarge"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.in", "cmd_fullZoomReduce"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.out.shift", "cmd_fullZoomReset"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.in.shift", "cmd_fullZoomReset"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.twist.right", "Browser:NextTab"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.twist.left", "Browser:PrevTab"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 17:00:31 Windows 6.0.6001 Service Pack 1 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** . --------------------- DLL'er Lastet Av Kjørende Prosesser --------------------- - - - - - - - > 'Explorer.exe'(5708) c:\program files\Norman\nvc\bin\Niphk.dll . Tidspunkt ferdig: 2009-01-09 17:02:50 ComboFix-quarantined-files.txt 2009-01-09 16:02:46 ComboFix2.txt 2009-01-08 21:16:53 Pre-Run: 295 352 819 712 byte ledig Post-Run: 295,323,590,656 byte ledig 316 --- E O F --- 2009-01-08 18:21:45 ----------------------------------------------------------------------------------------------------------------- Malwarebytes' Anti-Malware 1.32 Databaseversjon: 1625 Windows 6.0.6001 Service Pack 1 06.01.2009 23:07:07 mbam-log-2009-01-06 (23-07-07).txt Skanntype: Rask Skann Objekter skannet: 57360 Tid tilbakelagt: 8 minute(s), 16 second(s) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 30 Registerverdier infisert: 3 Registerfiler infisert: 0 Mapper infisert: 1 Filer infisert: 4 Minneprosesser infisert: (Ingen mistenkelige filer funnet) Minnemoduler infisert: (Ingen mistenkelige filer funnet) Registernøkler infisert: HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. Registerverdier infisert: Lenke til kommentar
raWrz Skrevet 9. januar 2009 Del Skrevet 9. januar 2009 kan du gi meg ressen av Mbam loggen ? Lenke til kommentar
pettsorg Skrevet 11. januar 2009 Forfatter Del Skrevet 11. januar 2009 (endret) kan du gi meg ressen av Mbam loggen ? Prøver igjen: Malwarebytes' Anti-Malware 1.32 Databaseversjon: 1625 Windows 6.0.6001 Service Pack 1 06.01.2009 23:07:07 mbam-log-2009-01-06 (23-07-07).txt Skanntype: Rask Skann Objekter skannet: 57360 Tid tilbakelagt: 8 minute(s), 16 second(s) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 30 Registerverdier infisert: 3 Registerfiler infisert: 0 Mapper infisert: 1 Filer infisert: 4 Minneprosesser infisert: (Ingen mistenkelige filer funnet) Minnemoduler infisert: (Ingen mistenkelige filer funnet) Registernøkler infisert: HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. Registerverdier infisert: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully. Registerfiler infisert: (Ingen mistenkelige filer funnet) Mapper infisert: C:\Program Files\PC-Cleaner (Rogue.PC-Cleaner) -> Quarantined and deleted successfully. Filer infisert: C:\Users\Sørgård\AppData\Local\Temp\tmp0000c1b8 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\Sørgård\AppData\Local\Temp\tmp00013add (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Users\Sørgård\AppData\Local\Temp\bx18dxv.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\Sørgård\AppData\Local\Temp\nyps4.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. Endret 11. januar 2009 av pettsorg Lenke til kommentar
norbat Skrevet 11. januar 2009 Del Skrevet 11. januar 2009 Og hvordan går det med problemet etter at du har kjørt disse programmene? Lenke til kommentar
pettsorg Skrevet 20. januar 2009 Forfatter Del Skrevet 20. januar 2009 (endret) Og hvordan går det med problemet etter at du har kjørt disse programmene? Har vært bortreist så jeg svarer litt sent. Fikk akkurat nå en ny popup. Det ser ut til å ha blitt redusert i antall, men noe kommer fortsatt. Redigering: Og mens jeg la inn dette fikk jeg en til, så jeg redigerer det inn nå. Endret 20. januar 2009 av pettsorg Lenke til kommentar
r2d290 Skrevet 20. januar 2009 Del Skrevet 20. januar 2009 Ettersom det har gått en tid: ny MBAM og combofix-logg Lenke til kommentar
pettsorg Skrevet 20. januar 2009 Forfatter Del Skrevet 20. januar 2009 (endret) Ettersom det har gått en tid: ny MBAM og combofix-logg Malwarebytes' Anti-Malware 1.32 Databaseversjon: 1625 Windows 6.0.6001 Service Pack 1 20.01.2009 18:46:42 mbam-log-2009-01-20 (18-46-42).txt Skanntype: Rask Skann Objekter skannet: 51099 Tid tilbakelagt: 3 minute(s), 13 second(s) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 0 Registerverdier infisert: 0 Registerfiler infisert: 0 Mapper infisert: 0 Filer infisert: 0 Minneprosesser infisert: (Ingen mistenkelige filer funnet) Minnemoduler infisert: (Ingen mistenkelige filer funnet) Registernøkler infisert: (Ingen mistenkelige filer funnet) Registerverdier infisert: (Ingen mistenkelige filer funnet) Registerfiler infisert: (Ingen mistenkelige filer funnet) Mapper infisert: (Ingen mistenkelige filer funnet) Filer infisert: (Ingen mistenkelige filer funnet) ComboFix 09-01-19.05 - Sørgård 2009-01-20 18:24:53.3 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.2046.1018 [GMT 1:00] Kjører fra: c:\users\Sørgård\Downloads\ComboFix.exe AV: Norman Security Suite ver. 7.00 *On-access scanning enabled* (Updated) * Opprettet nytt gjenopprettingspunkt . ((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-20 til 2009-01-20 ))))))))))))))))))))))))))))))))) . 2009-01-15 17:11 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-09 16:10 . 2009-01-09 16:10 401,720 --a------ c:\users\Sørgård\test.exe.exe 2009-01-09 16:10 . 2009-01-09 16:10 401,720 --a------ c:\users\Sørgård\test.exe.exe 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\All Users\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\programdata\Malwarebytes 2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-06 21:17 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-01-06 21:17 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-12-24 13:11 . 2008-12-24 13:11 <DIR> d-------- c:\program files\Microsoft IntelliPoint 2008-12-23 12:23 . 2008-12-23 12:23 <DIR> d-------- c:\program files\ue_toolbar 2008-12-23 12:22 . 2008-12-23 12:22 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\IDMComp 2008-12-23 12:21 . 2008-12-23 12:25 <DIR> d-------- c:\program files\IDM Computer Solutions . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-20 17:28 8,126,464 --sha-w c:\users\Sørgård\ntuser.dat 2009-01-20 17:28 8,126,464 --sha-w c:\users\Sørgård\ntuser.dat 2009-01-20 17:25 --------- d-----w c:\users\Sørgård\AppData\Roaming\uTorrent 2009-01-20 08:06 --------- d-----w c:\program files\Norman 2009-01-12 20:17 --------- d-----w c:\program files\EasyBits For Kids 2009-01-09 15:10 401,720 ----a-w c:\users\Sørgård\test.exe.exe 2009-01-09 15:10 401,720 ----a-w c:\users\Sørgård\test.exe.exe 2009-01-06 20:17 --------- d-----w c:\users\Sørgård\AppData\Roaming\Malwarebytes 2009-01-06 19:17 --------- d-----w c:\program files\NCH Software 2009-01-06 19:16 --------- d-----w c:\programdata\NCH Software 2009-01-02 10:04 --------- d-----w c:\programdata\IntraSoftMeal 2009-01-02 10:04 --------- d-----w c:\programdata\Admin Inter 1 Mags 2008-12-29 20:58 --------- d-----w c:\programdata\TrackMania 2008-12-29 20:39 --------- d-----w c:\program files\Common Files\Steam 2008-12-23 11:23 --------- d-----w c:\program files\Google 2008-12-23 11:22 --------- d-----w c:\users\Sørgård\AppData\Roaming\IDMComp 2008-12-22 20:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\LimeWire 2008-12-13 02:06 --------- d-----w c:\programdata\Microsoft Help 2008-12-10 18:02 --------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 2 2008-12-10 17:56 --------- d-----w c:\users\Sørgård\AppData\Roaming\Mozilla 2008-12-10 15:20 --------- d-----w c:\users\Sørgård\AppData\Roaming\com.elertz.stage.9AF4EE1EA9AB71EAD9D48655BC2ADB5C2C8D7DBB.1 2008-12-10 15:20 --------- d-----w c:\program files\Elertz 2008-12-10 15:20 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-12-10 15:19 --------- d-----w c:\users\Sørgård\AppData\Roaming\Adobe 2008-12-06 17:33 --------- d-----w c:\programdata\Lx_cats 2008-11-30 12:07 --------- d-----w c:\users\Sørgård\AppData\Roaming\Google 2008-11-30 00:08 --------- d-----w c:\programdata\WindowsSearch 2008-11-28 22:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\Ahead 2008-11-28 21:37 --------- d-----w c:\users\Sørgård\AppData\Roaming\Nero 2008-11-24 16:49 --------- d-----w c:\users\Sørgård\AppData\Roaming\fretsonfire 2008-11-24 16:48 --------- d-----w c:\program files\Frets on Fire 2008-11-22 16:40 --------- d---a-w c:\programdata\TEMP 2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll 2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll 2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe 2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx0c.dll 2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx07.dll 2008-10-28 22:35 815,104 ----a-w c:\windows\System32\divx_xx0a.dll 2008-10-28 22:35 802,816 ----a-w c:\windows\System32\divx_xx11.dll 2008-10-28 22:35 684,032 ----a-w c:\windows\System32\DivX.dll 2008-10-22 15:21 21,248 ----a-w c:\windows\Help\OEM\scripts\HPScript.exe 2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll 2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll 2008-08-06 10:33 174 --sha-w c:\program files\desktop.ini 2008-04-14 21:46 352 ----a-w c:\users\Sørgård\AppData\Roaming\wklnhst.dat 2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-04-16 19:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-09-24 19:17 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-08_22.15.04,15 ))))))))))))))))))))))))))))))))))))))))) . - 2000-08-31 07:00:00 28,672 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 07:00:00 29,696 ----a-w c:\windows\NIRCMD.exe - 2009-01-08 17:25:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-01-20 08:06:03 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-01-08 17:25:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-01-20 08:06:03 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-01-08 21:14:21 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-01-20 08:45:51 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-01-20 08:45:51 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-01-08 21:14:26 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-01-20 08:07:30 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-01-20 08:07:30 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-01-08 14:30:58 1,377,672 ----a-w c:\windows\SoftwareDistribution\Download\Install\mpas-d.exe - 2009-01-08 21:01:11 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-01-20 15:45:28 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-01-20 15:45:28 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-01-20 15:45:28 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-01-08 21:10:25 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-01-20 17:24:37 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2009-01-20 17:24:37 262,144 ---ha-w c:\windows\System32\config\systemprofile\ntuser.dat.LOG1 - 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\System32\mrt.exe + 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\System32\mrt.exe - 2009-01-08 17:30:49 101,052 ----a-w c:\windows\System32\perfc009.dat + 2009-01-20 08:13:10 101,052 ----a-w c:\windows\System32\perfc009.dat - 2009-01-08 17:30:49 76,272 ----a-w c:\windows\System32\perfc014.dat + 2009-01-20 08:13:10 76,272 ----a-w c:\windows\System32\perfc014.dat - 2009-01-08 17:30:49 586,980 ----a-w c:\windows\System32\perfh009.dat + 2009-01-20 08:13:10 586,980 ----a-w c:\windows\System32\perfh009.dat - 2009-01-08 17:30:49 452,096 ----a-w c:\windows\System32\perfh014.dat + 2009-01-20 08:13:10 452,096 ----a-w c:\windows\System32\perfh014.dat - 2008-12-19 02:07:01 6,553,600 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat + 2009-01-15 22:28:48 6,553,600 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat - 2009-01-08 17:27:58 10,744 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3169459540-1163011044-1678974105-1000_UserData.bin + 2009-01-20 08:07:50 10,768 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3169459540-1163011044-1678974105-1000_UserData.bin - 2009-01-08 17:27:58 56,814 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-01-20 08:07:50 56,916 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-01-08 17:27:57 52,866 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-01-20 08:07:49 53,076 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-01-04 12:42:26 244,346 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin + 2009-01-10 13:45:53 244,812 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin - 2008-12-19 02:00:44 156,139,213 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2009-01-15 16:06:35 156,166,755 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2008-12-16 03:14:37 290,304 ----a-w c:\windows\winsxs\x86_microsoft-windows-smbserver-v1_31bf3856ad364e35_6.0.6000.16789_none_d7c3afd4f985c7a2\srv.sys + 2008-12-16 03:07:02 290,816 ----a-w c:\windows\winsxs\x86_microsoft-windows-smbserver-v1_31bf3856ad364e35_6.0.6000.20976_none_d8551d94129dfc9d\srv.sys + 2008-12-16 02:42:39 288,768 ----a-w c:\windows\winsxs\x86_microsoft-windows-smbserver-v1_31bf3856ad364e35_6.0.6001.18185_none_d9a5ed52f6aff337\srv.sys + 2008-12-16 01:53:56 288,768 ----a-w c:\windows\winsxs\x86_microsoft-windows-smbserver-v1_31bf3856ad364e35_6.0.6001.22331_none_da619a780fa89f17\srv.sys . -- Snapshot resatt til dagens dato -- . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "option heck"="c:\programdata\Cdromskipskip.7bzzcf" [X] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2008-08-28 267056] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 c:\windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176] "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-01 185896] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8473120] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-28 81920] "lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864] "lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264] "FaxCenterServer"="c:\program files\\Lexmark Fax Solutions\fm3032.exe" [2007-07-16 311984] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2008-11-16 577540] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736] "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168] c:\users\S›rg†rd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Elertz.lnk - c:\program files\Elertz\Elertz.exe [2008-12-10 95232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{E54729E8-BB3D-4270-9D49-7389EA579090}"= "c:\windows\system32\EZUPBH~1.DLL" [2007-12-30 49152] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{A2B307A1-BC0E-4C91-83DA-9F6338F17EE4}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{9D3427D2-E6E0-458D-A2B7-8377E995A096}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "TCP Query User{B88DA5D7-3C24-4352-9129-C4AA4DF84F6F}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{B103764B-EF0A-4673-ABD5-792A0AB20CF1}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "{8F6E84AC-BED9-45D5-AEEA-B95BFC08FA19}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{7DF8E849-08CE-4D4D-AD4A-8A56F34CA80A}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "UDP Query User{2E236115-168C-4ED9-B994-181FF429FDD3}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "TCP Query User{9592B6F2-C9F8-445E-9A9D-CF4F53D468AD}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{AA678E1C-BFA9-4BFF-BEA6-1D8A8C9FC180}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{1782493F-C3E2-4AE1-AABF-88EE0BED3F38}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{AD12179C-9E9B-4838-9A42-B90BEEFA9CC6}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher "{DB025AB4-402D-4CB7-AF65-E973575C3051}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{8EACF0C2-C809-436D-BA75-FFBF8E86DF3A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{1B32DF02-9B31-45BD-AFE2-DE763464195E}c:\\users\\public\\favorites\\soldat\\soldat.exe"= UDP:c:\users\public\favorites\soldat\soldat.exe:Soldat "UDP Query User{BEAAD2A3-A381-4ACB-88FB-076C69159FC9}c:\\users\\public\\favorites\\soldat\\soldat.exe"= TCP:c:\users\public\favorites\soldat\soldat.exe:Soldat "TCP Query User{81B11C73-572A-4F06-B35A-4C7E5EBC99B4}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{697047D6-75C4-4679-95D8-53A8C81C9F6B}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{FC5818B1-A0E5-4401-A0AE-D28782374CEF}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2 "UDP Query User{78FEEBD9-CBB4-4607-AE65-737BD24C9CE9}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2 "TCP Query User{0408E632-481D-4C68-8382-1237075D158E}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= UDP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe "UDP Query User{8E808690-BB2B-40C3-89E3-90826E83B708}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= TCP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe "{A47B7D02-FAF6-42AB-8461-897068015047}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{D8EEBBC3-ACCA-4DAB-B0D3-2FE8475FB58F}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{81A6D47C-C00F-4770-B2A0-2C0355D9D829}"= UDP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System "{283F98D2-EC56-4259-975D-DDE54E08B524}"= TCP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System "{389081A5-99F7-44F7-91A2-E5A8EA8EA165}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor "{0D0EC6D2-9BCD-4043-9C23-898A41387C1A}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor "{7931F36E-BC06-4890-8748-152369856518}"= UDP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio "{F68767D5-66F2-44CD-9A7A-40C14B997693}"= TCP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio "{B6876E4C-656F-4376-9064-05D6EAA37D31}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader "{EA8ABF52-AB62-4587-883E-D802D313B8B7}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader "{CF6C747E-8B06-4DE5-A91C-1BE8479FA9AB}"= UDP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software "{74B87CC5-E929-4B3D-A505-3AAC7DD4AB1C}"= TCP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software "{3DC666A0-4DC2-4226-883B-401C6AF2660B}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor "{B1823633-7EC3-4F4A-B671-76C52345D453}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor "{C2EC2842-AD06-4778-AC8F-D447BF7ED30D}"= UDP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe: "{131F209F-CF15-403B-AC15-26696C27085B}"= TCP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe: "{FBAB35E3-79C6-43EE-8DD7-C97362567535}"= UDP:c:\windows\System32\lxdicfg.exe:Printer Communication System "{95F16687-EBCE-421F-90BF-7C98A215D1D0}"= TCP:c:\windows\System32\lxdicfg.exe:Printer Communication System "{F1B1D1A8-41F8-4F4B-A324-7E417C17FE35}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface "{33DA2F52-FB00-4D84-8B1B-DF9D1AA9210E}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface "{5688B4D1-BA88-4035-908D-714F38FA0E13}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable "{6722AC72-ECC7-48B0-964E-B90CF862A394}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable "TCP Query User{0E9BDF17-3C7C-44CE-9647-AF084D4D5022}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= UDP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application "UDP Query User{E121DDDE-FB98-4298-AD74-87841AC7EDEE}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= TCP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application "TCP Query User{F9DDAE83-247E-438F-89EE-5B5C9604ECE1}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "UDP Query User{B22390F0-A589-4810-9E3E-B92E99423C4F}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2 "TCP Query User{66E39694-3207-4C62-9019-E9869869698C}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2 "UDP Query User{D76FE665-7B16-4808-9E40-4AB77B6410CE}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2 "{1226765F-0639-480F-89CA-DB5D64224A24}"= UDP:86:BroadCam Web Server "TCP Query User{862C6833-395A-498E-8659-5DF9A11E9FF8}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever "UDP Query User{4C27CCBF-36DD-4F8F-BC7E-1C3254152F29}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever "TCP Query User{946DB024-A0FF-47DB-B48B-6BE9084F77E9}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= UDP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor "UDP Query User{7CDBF0F9-6A61-4004-8995-1111B2165FB0}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= TCP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\System32\drivers\netr73.sys [2008-02-26 493568] R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-30 322616] R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-04 19512] R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-06-30 191544] R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2008-11-06 154680] R4 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-09-24 554352] R4 ezntsvc;EasyBits Magic Desktop Services for Windows NT;c:\windows\System32\ezntsvc.exe [2007-12-30 33792] R4 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-09-24 198240] R4 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?] R4 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdiserv.exe [2007-06-11 99248] R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2008-03-01 20448] R4 NVOY;Norman's Very Own supplY of resources;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-11-06 121912] --- Andre tjenester/drivere lastet i minnet --- *Deregistered* - mchInjDrv [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{503454b0-b6f6-11dc-a3b4-806e6f6e6963}] \shell\AutoRun\command - E:\Autorun.exe . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) 2009-01-12 c:\windows\Tasks\HPCeeScheduleForSørgård.job - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-05-17 15:55] . . ------- Tilleggsskanning ------- . uStart Page = hxxp://www.startsiden.no/ mStart Page = hxxp://www.yahoo.com IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Sørgård\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk FF - ProfilePath - ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-20 18:28:23 Windows 6.0.6001 Service Pack 1 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** . --------------------- DLL'er Lastet Av Kjørende Prosesser --------------------- - - - - - - - > 'Explorer.exe'(1308) c:\program files\Norman\nvc\bin\Niphk.dll . Tidspunkt ferdig: 2009-01-20 18:30:56 ComboFix-quarantined-files.txt 2009-01-20 17:30:52 ComboFix2.txt 2009-01-09 16:02:52 ComboFix3.txt 2009-01-08 21:16:53 Pre-Run: 294 019 170 304 byte ledig Post-Run: 293,991,141,376 byte ledig 300 --- E O F --- 2009-01-20 08:11:23 Endret 22. januar 2009 av pettsorg Lenke til kommentar
Stifi Skrevet 21. januar 2009 Del Skrevet 21. januar 2009 Helt seriøst. Legg loggen inn i spoiler. Lenke til kommentar
pettsorg Skrevet 21. januar 2009 Forfatter Del Skrevet 21. januar 2009 Helt seriøst. Legg loggen inn i spoiler. Hva betyr det? Lenke til kommentar
raWrz Skrevet 21. januar 2009 Del Skrevet 21. januar 2009 [*spolier]LOGG HER [*/spoiler] UNTEN * Lenke til kommentar
pettsorg Skrevet 22. januar 2009 Forfatter Del Skrevet 22. januar 2009 (endret) [*spolier]LOGG HER [*/spoiler] UNTEN * Takk, da lærte jeg noe nytt og nyttig i dag også. Venter da bare på hjelp til å løse problemet. Endret 22. januar 2009 av pettsorg Lenke til kommentar
norbat Skrevet 24. januar 2009 Del Skrevet 24. januar 2009 Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt. Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "option heck"=- Hvis du fortsatt får popups, hva står det på dem? Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå