[Løst]Hjelp med nok et CI: viruus

pettsorg · 9. januar 2009

Har forsøkt å følge veiledningen til norbat.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:33:18, on 09.01.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\hp\support\hpsysdrv.exe

C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\system32\schtasks.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Norman\Npm\Bin\Zlh.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\system32\jusched.exe

C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Elertz\Elertz.exe

C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\hp\kbd\kbd.exe

C:\Program Files\Norman\Nvc\Bin\Nip.exe

C:\Program Files\Norman\Nvc\Bin\cclaw.exe

C:\Windows\Explorer.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe

C:\Users\Sørgård\test.exe.exe

C:\Windows\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O1 - Hosts: ::1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: UltraEdit Toolbar - {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - C:\PROGRA~1\UE_TOO~1\UE_TOO~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: UltraEdit Toolbar - {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - C:\PROGRA~1\UE_TOO~1\UE_TOO~1.DLL

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE

O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [sunJavaUpdateReg] "C:\Windows\system32\jureg.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"

O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"

O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Recordpad] "C:\Program Files\NCH Swift Sound\Recordpad\recordpad.exe" -logon

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [option heck] "C:\ProgramData\Cdromskipskip.7bzzcf"

O4 - Startup: Elertz.lnk = C:\Program Files\Elertz\Elertz.exe

O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe

O4 - Startup: OneNote 2007 Screen Clipper og Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype add-on - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Sørgård\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O13 - Gopher Prefix:

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe

O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\Windows\system32\ezNTSvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdiserv.exe

O23 - Service: lxdi_device - - C:\Windows\system32\lxdicoms.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\Bin\Njeeves.exe

O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe

O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE

O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Nvcsched.exe

O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--

End of file - 11633 bytes

----------------------------------------------------------------------------------------------------------------

ComboFix 09-01-08.01 - Sørgård 2009-01-09 16:57:45.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.2046.968 [GMT 1:00]

Kjører fra: c:\users\Sørgård\ComboFix.exe

* Resident AV is active

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-09 til 2009-01-09 )))))))))))))))))))))))))))))))))

.

2009-01-09 16:10 . 2009-01-09 16:10 401,720 --a------ c:\users\Sørgård\test.exe.exe

2009-01-08 22:07 . 2009-01-08 22:07 2,913,557 -ra------ c:\users\Sørgård\ComboFix.exe

2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\Malwarebytes

2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\users\All Users\Malwarebytes

2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\programdata\Malwarebytes

2009-01-06 21:17 . 2009-01-06 21:17 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-06 21:17 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2009-01-06 21:17 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2008-12-24 13:11 . 2008-12-24 13:11 <DIR> d-------- c:\program files\Microsoft IntelliPoint

2008-12-23 12:23 . 2008-12-23 12:23 <DIR> d-------- c:\program files\ue_toolbar

2008-12-23 12:22 . 2008-12-23 12:22 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\IDMComp

2008-12-23 12:21 . 2008-12-23 12:25 <DIR> d-------- c:\program files\IDM Computer Solutions

2008-12-19 18:47 . 2008-12-25 21:43 <DIR> d-------- c:\users\Sørgård\Pictures

2008-12-13 03:03 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll

2008-12-11 15:39 . 2008-12-11 15:39 <DIR> d-------- c:\windows\System32\Adobe

2008-12-10 19:02 . 2008-12-10 19:02 <DIR> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2

2008-12-10 18:56 . 2008-12-10 18:56 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\Mozilla

2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\users\Sørgård\AppData\Roaming\com.elertz.stage.9AF4EE1EA9AB71EAD9D48655BC2ADB5C2C8D7DBB.1

2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\program files\Elertz

2008-12-10 16:20 . 2008-12-10 16:20 <DIR> d-------- c:\program files\Common Files\Adobe AIR

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-09 16:00 8,126,464 --sha-w c:\users\Sørgård\ntuser.dat

2009-01-09 15:58 --------- d-----w c:\users\Sørgård\AppData\Roaming\uTorrent

2009-01-09 15:10 401,720 ----a-w c:\users\Sørgård\test.exe.exe

2009-01-08 21:07 2,913,557 ----a-r c:\users\Sørgård\ComboFix.exe

2009-01-08 17:25 --------- d-----w c:\program files\Norman

2009-01-06 20:17 --------- d-----w c:\users\Sørgård\AppData\Roaming\Malwarebytes

2009-01-06 19:17 --------- d-----w c:\program files\NCH Software

2009-01-06 19:16 --------- d-----w c:\programdata\NCH Software

2009-01-02 10:04 --------- d-----w c:\programdata\IntraSoftMeal

2009-01-02 10:04 --------- d-----w c:\programdata\Admin Inter 1 Mags

2008-12-29 20:58 --------- d-----w c:\programdata\TrackMania

2008-12-29 20:39 --------- d-----w c:\program files\Common Files\Steam

2008-12-28 17:29 --------- d-----w c:\program files\EasyBits For Kids

2008-12-23 11:23 --------- d-----w c:\program files\Google

2008-12-23 11:22 --------- d-----w c:\users\Sørgård\AppData\Roaming\IDMComp

2008-12-22 20:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\LimeWire

2008-12-13 02:06 --------- d-----w c:\programdata\Microsoft Help

2008-12-10 17:56 --------- d-----w c:\users\Sørgård\AppData\Roaming\Mozilla

2008-12-10 15:20 --------- d-----w c:\users\Sørgård\AppData\Roaming\com.elertz.stage.9AF4EE1EA9AB71EAD9D48655BC2ADB5C2C8D7DBB.1

2008-12-10 15:19 --------- d-----w c:\users\Sørgård\AppData\Roaming\Adobe

2008-12-06 17:33 --------- d-----w c:\programdata\Lx_cats

2008-11-30 12:07 --------- d-----w c:\users\Sørgård\AppData\Roaming\Google

2008-11-30 00:08 --------- d-----w c:\programdata\WindowsSearch

2008-11-28 22:13 --------- d-----w c:\users\Sørgård\AppData\Roaming\Ahead

2008-11-28 21:37 --------- d-----w c:\users\Sørgård\AppData\Roaming\Nero

2008-11-24 16:49 --------- d-----w c:\users\Sørgård\AppData\Roaming\fretsonfire

2008-11-24 16:48 --------- d-----w c:\program files\Frets on Fire

2008-11-22 16:40 --------- d---a-w c:\programdata\TEMP

2008-11-16 13:58 --------- d-----w c:\programdata\Yahoo! Companion

2008-11-16 13:57 --------- d-----w c:\users\Sørgård\AppData\Roaming\Yahoo!

2008-11-16 13:57 --------- d-----w c:\program files\Yahoo!

2008-11-16 13:57 --------- d-----w c:\program files\DivX

2008-11-16 13:57 --------- d-----w c:\program files\Common Files\PX Storage Engine

2008-11-16 13:34 --------- d-----w c:\users\Sørgård\AppData\Roaming\NCH Swift Sound

2008-11-16 13:34 --------- d-----w c:\programdata\NCH Swift Sound

2008-11-16 13:33 --------- d-----w c:\users\Sørgård\AppData\Roaming\Recordpad

2008-11-16 13:33 --------- d-----w c:\program files\NCH Swift Sound

2008-11-16 12:16 --------- d-----w c:\users\Sørgård\AppData\Roaming\NCH Software

2008-11-09 09:27 --------- d-----w c:\program files\Common Files\Adobe

2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll

2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll

2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll

2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll

2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll

2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll

2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll

2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe

2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx0c.dll

2008-10-28 22:36 823,296 ----a-w c:\windows\System32\divx_xx07.dll

2008-10-28 22:35 815,104 ----a-w c:\windows\System32\divx_xx0a.dll

2008-10-28 22:35 802,816 ----a-w c:\windows\System32\divx_xx11.dll

2008-10-28 22:35 684,032 ----a-w c:\windows\System32\DivX.dll

2008-10-22 15:21 21,248 ----a-w c:\windows\Help\OEM\scripts\HPScript.exe

2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll

2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll

2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll

2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe

2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll

2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll

2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll

2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll

2008-10-16 13:08 162,064 ----a-w c:\windows\System32\wuwebv.dll

2008-10-16 12:56 31,232 ----a-w c:\windows\System32\wuapp.exe

2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll

2008-08-06 10:33 174 --sha-w c:\program files\desktop.ini

2008-04-14 21:46 352 ----a-w c:\users\Sørgård\AppData\Roaming\wklnhst.dat

2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-04-16 19:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-04-16 19:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-09-24 19:17 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-09-24 19:17 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((( snapshot@2009-01-08_22.15.04,15 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-01-08 21:14:21 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat

+ 2009-01-09 06:16:39 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat

+ 2009-01-09 06:16:39 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1

- 2009-01-08 21:01:11 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-01-09 13:11:03 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-01-09 13:11:03 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-01-08 21:01:11 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-01-09 13:11:03 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-01-08 21:10:25 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat

+ 2009-01-09 15:57:32 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat

+ 2009-01-09 15:57:32 262,144 ---ha-w c:\windows\System32\config\systemprofile\ntuser.dat.LOG1

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"option heck"="c:\programdata\Cdromskipskip.7bzzcf" [X]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2008-08-28 267056]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-23 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]

"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-01 185896]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-28 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8473120]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-28 81920]

"lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864]

"lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264]

"FaxCenterServer"="c:\program files\\Lexmark Fax Solutions\fm3032.exe" [2007-07-16 311984]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2008-11-16 577540]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]

"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168]

c:\users\S›rg†rd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Elertz.lnk - c:\program files\Elertz\Elertz.exe [2008-12-10 95232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E54729E8-BB3D-4270-9D49-7389EA579090}"= "c:\windows\system32\EZUPBH~1.DLL" [2007-12-30 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{A2B307A1-BC0E-4C91-83DA-9F6338F17EE4}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{9D3427D2-E6E0-458D-A2B7-8377E995A096}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"TCP Query User{B88DA5D7-3C24-4352-9129-C4AA4DF84F6F}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent

"UDP Query User{B103764B-EF0A-4673-ABD5-792A0AB20CF1}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent

"{8F6E84AC-BED9-45D5-AEEA-B95BFC08FA19}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"TCP Query User{7DF8E849-08CE-4D4D-AD4A-8A56F34CA80A}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2

"UDP Query User{2E236115-168C-4ED9-B994-181FF429FDD3}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2

"TCP Query User{9592B6F2-C9F8-445E-9A9D-CF4F53D468AD}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{AA678E1C-BFA9-4BFF-BEA6-1D8A8C9FC180}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{1782493F-C3E2-4AE1-AABF-88EE0BED3F38}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher

"UDP Query User{AD12179C-9E9B-4838-9A42-B90BEEFA9CC6}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike\\hl.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike\hl.exe:Half-Life Launcher

"{DB025AB4-402D-4CB7-AF65-E973575C3051}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{8EACF0C2-C809-436D-BA75-FFBF8E86DF3A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"TCP Query User{1B32DF02-9B31-45BD-AFE2-DE763464195E}c:\\users\\public\\favorites\\soldat\\soldat.exe"= UDP:c:\users\public\favorites\soldat\soldat.exe:Soldat

"UDP Query User{BEAAD2A3-A381-4ACB-88FB-076C69159FC9}c:\\users\\public\\favorites\\soldat\\soldat.exe"= TCP:c:\users\public\favorites\soldat\soldat.exe:Soldat

"TCP Query User{81B11C73-572A-4F06-B35A-4C7E5EBC99B4}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent

"UDP Query User{697047D6-75C4-4679-95D8-53A8C81C9F6B}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent

"TCP Query User{FC5818B1-A0E5-4401-A0AE-D28782374CEF}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2

"UDP Query User{78FEEBD9-CBB4-4607-AE65-737BD24C9CE9}c:\\program files\\valve\\steam\\steamapps\\hunt411\\day of defeat source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\day of defeat source\hl2.exe:hl2

"TCP Query User{0408E632-481D-4C68-8382-1237075D158E}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= UDP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe

"UDP Query User{8E808690-BB2B-40C3-89E3-90826E83B708}c:\\users\\sørgård\\desktop\\call of duty 1\\codmp.exe"= TCP:c:\users\sørgård\desktop\call of duty 1\codmp.exe:codmp.exe

"{A47B7D02-FAF6-42AB-8461-897068015047}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)

"{D8EEBBC3-ACCA-4DAB-B0D3-2FE8475FB58F}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

"{81A6D47C-C00F-4770-B2A0-2C0355D9D829}"= UDP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System

"{283F98D2-EC56-4259-975D-DDE54E08B524}"= TCP:c:\windows\System32\lxdicoms.exe:Lexmark Communications System

"{389081A5-99F7-44F7-91A2-E5A8EA8EA165}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor

"{0D0EC6D2-9BCD-4043-9C23-898A41387C1A}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe:Lexmark Device Monitor

"{7931F36E-BC06-4890-8748-152369856518}"= UDP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio

"{F68767D5-66F2-44CD-9A7A-40C14B997693}"= TCP:c:\program files\Lexmark 3500-4500 Series\App4R.exe:Lexmark Imaging Studio

"{B6876E4C-656F-4376-9064-05D6EAA37D31}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader

"{EA8ABF52-AB62-4587-883E-D802D313B8B7}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader

"{CF6C747E-8B06-4DE5-A91C-1BE8479FA9AB}"= UDP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software

"{74B87CC5-E929-4B3D-A505-3AAC7DD4AB1C}"= TCP:c:\program files\Lexmark Fax Solutions\FaxCtr.exe:Fax software

"{3DC666A0-4DC2-4226-883B-401C6AF2660B}"= UDP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor

"{B1823633-7EC3-4F4A-B671-76C52345D453}"= TCP:c:\program files\Lexmark 3500-4500 Series\lxdimon.exe:Device Monitor

"{C2EC2842-AD06-4778-AC8F-D447BF7ED30D}"= UDP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe:

"{131F209F-CF15-403B-AC15-26696C27085B}"= TCP:c:\users\Sørgård\AppData\Local\Temp\lxdi\wireless\NORWEGAN\lxdiwpss.exe:

"{FBAB35E3-79C6-43EE-8DD7-C97362567535}"= UDP:c:\windows\System32\lxdicfg.exe:Printer Communication System

"{95F16687-EBCE-421F-90BF-7C98A215D1D0}"= TCP:c:\windows\System32\lxdicfg.exe:Printer Communication System

"{F1B1D1A8-41F8-4F4B-A324-7E417C17FE35}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface

"{33DA2F52-FB00-4D84-8B1B-DF9D1AA9210E}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdipswx.exe:Printer Status Window Interface

"{5688B4D1-BA88-4035-908D-714F38FA0E13}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable

"{6722AC72-ECC7-48B0-964E-B90CF862A394}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxditime.exe:Lexmark Connect Time Executable

"TCP Query User{0E9BDF17-3C7C-44CE-9647-AF084D4D5022}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= UDP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application

"UDP Query User{E121DDDE-FB98-4298-AD74-87841AC7EDEE}c:\\program files\\lexmark 3500-4500 series\\lxdiamon.exe"= TCP:c:\program files\lexmark 3500-4500 series\lxdiamon.exe:Device Monitor Application

"TCP Query User{F9DDAE83-247E-438F-89EE-5B5C9604ECE1}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2

"UDP Query User{B22390F0-A589-4810-9E3E-B92E99423C4F}c:\\program files\\valve\\steam\\steamapps\\hunt411\\counter-strike source\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\counter-strike source\hl2.exe:hl2

"TCP Query User{66E39694-3207-4C62-9019-E9869869698C}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= UDP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2

"UDP Query User{D76FE665-7B16-4808-9E40-4AB77B6410CE}c:\\program files\\valve\\steam\\steamapps\\hunt411\\synergy\\hl2.exe"= TCP:c:\program files\valve\steam\steamapps\hunt411\synergy\hl2.exe:hl2

"{1226765F-0639-480F-89CA-DB5D64224A24}"= UDP:86:BroadCam Web Server

"TCP Query User{862C6833-395A-498E-8659-5DF9A11E9FF8}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever

"UDP Query User{4C27CCBF-36DD-4F8F-BC7E-1C3254152F29}c:\\program files\\valve\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\valve\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever

"TCP Query User{946DB024-A0FF-47DB-B48B-6BE9084F77E9}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= UDP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor

"UDP Query User{7CDBF0F9-6A61-4004-8995-1111B2165FB0}c:\\program files\\idm computer solutions\\ultraedit-32\\uedit32.exe"= TCP:c:\program files\idm computer solutions\ultraedit-32\uedit32.exe:UltraEdit-32 Professional Text/Hex Editor

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-01-06 38496]

R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\System32\drivers\netr73.sys [2008-02-26 493568]

R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-30 322616]

R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-04 19512]

R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-06-30 191544]

R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2008-11-06 154680]

R4 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-09-24 554352]

R4 ezntsvc;EasyBits Magic Desktop Services for Windows NT;c:\windows\System32\ezntsvc.exe [2007-12-30 33792]

R4 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-09-24 198240]

R4 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]

R4 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdiserv.exe [2007-06-11 99248]

R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2008-03-01 20448]

R4 NVOY;Norman's Very Own supplY of resources;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-11-06 121912]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBAMSWISSARMY

*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{503454b0-b6f6-11dc-a3b4-806e6f6e6963}]

\shell\AutoRun\command - E:\Autorun.exe

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.startsiden.no/

mStart Page = hxxp://www.yahoo.com

IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Sørgård\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk

FF - ProfilePath -

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.color_management.mode", 2);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.color_management.rendering_intent", 0);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.downloadable_fonts.enabled", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("gfx.downloadable_fonts.enforce_same_site_origin", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("javascript.options.jit.content", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("javascript.options.jit.chrome", false);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("layout.css.visited_links_enabled", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("ui.panel.default_level_parent", false);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("image.cache.size", 5242880);

c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("image.cache.timeweight", 500);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.search.sources", 3);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.restrict.history", "^");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.restrict.tag", "+");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.match.title", "#");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.match.url", "@");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.search.cache.enabled", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ctrlTab.previews", true);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ctrlTab.recentlyUsedLimit", 7);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("privacy.sanitize.timeSpan", 0);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.up", "cmd_scrollTop");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.swipe.down", "cmd_scrollBottom");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.out", "cmd_fullZoomEnlarge");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.in", "cmd_fullZoomReduce");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.out.shift", "cmd_fullZoomReset");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.pinch.in.shift", "cmd_fullZoomReset");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.twist.right", "Browser:NextTab");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.gesture.twist.left", "Browser:PrevTab");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-09 17:00:31

Windows 6.0.6001 Service Pack 1 NTFS

skanner skjulte prosesser ...

skanner skjulte autostart-oppføringer ...

skanner skjulte filer ...

skanning vellykket

skjulte filer: 0

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

- - - - - - - > 'Explorer.exe'(5708)

c:\program files\Norman\nvc\bin\Niphk.dll

.

Tidspunkt ferdig: 2009-01-09 17:02:50

ComboFix-quarantined-files.txt 2009-01-09 16:02:46

ComboFix2.txt 2009-01-08 21:16:53

Pre-Run: 295 352 819 712 byte ledig

Post-Run: 295,323,590,656 byte ledig

316 --- E O F --- 2009-01-08 18:21:45

-----------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.32

Databaseversjon: 1625

Windows 6.0.6001 Service Pack 1

06.01.2009 23:07:07

mbam-log-2009-01-06 (23-07-07).txt

Skanntype: Rask Skann

Objekter skannet: 57360

Tid tilbakelagt: 8 minute(s), 16 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 30

Registerverdier infisert: 3

Registerfiler infisert: 0

Mapper infisert: 1

Filer infisert: 4

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.

Registerverdier infisert:

raWrz · 9. januar 2009

kan du gi meg ressen av Mbam loggen ?

pettsorg · 11. januar 2009

kan du gi meg ressen av Mbam loggen ?

Prøver igjen: