Virus: "antivirus 360" problemer. PCen i kne

[theda9el2k]

Hei! Håper det er noen kloke hoder som kan hjelpe meg.

Dette er en PC med Windows XP instalasjon.

 

Hendelsesforløpet er som følger:

 

Fikk virus: "Antivirus 360:" Viruset gir seg ut for å være et antivirusprogram, mens det egentlig er et virus.

 

Lastet ned og installerte Spybot S&D for fjerning.. Restartet datamaskinen og fikk bluescreen rett etter oppstart. Det samme skjer hver gang PCen slås på uten at det går ann å gjøre noe med det. Bakgrunnsbildet med ikoner kommer opp, man ser et lite glimt av en bluescreen, også restarter datamaskinen igjen.. Den går i loop alstå.

 

Etter noen forsøk på oppstart av datamaskinen får jeg følgende melding opp:

 

"Starting windows 98...

File not found.

E:\recovery.dat does not exist!! error!!

C:\>"

 

Merk: Det er XP instalasjon på denne datamaskinen, og 98 har aldri vert installert!

 

Hva gjør jeg? Kommer ingen veg forbi den siste feilmeldingen. Formatering er ikke aktuelt pga. at vi har bilder på disken..

[PerB]

Recovery-funksjonen er basert på Win98 for oppstart.

 

Forsøk å flytt harddisken over i annen maskin for å redde bilder og andre data (evt. benyt ubuntu e.l.).

[theda9el2k]

Ja! Det ville kanskje vært en ide å boote fra en ubuntu CD (man trenger vel ikke installere?) finne bildene, ta vare på disse, for så å kjøre recoveryfunskjonen?

[raWrz]

under boot trykker du på F8 og se om du kommer inn i sikkerhets modus si ifra om du kommer inn

[theda9el2k]

kommer ikke inn i sikkermodus. nå har eieren vært med PCen hos forhandleren de kjøpte PCen hos, hvor de formaterte uten at jeg fikk prøvd og redde bildene... Får prøve med et eller annet gjennopprettingsprogram.. Noen forslag?

[raWrz]

kommer ikke inn i sikkermodus. nå har eieren vært med PCen hos forhandleren de kjøpte PCen hos, hvor de formaterte uten at jeg fikk prøvd og redde bildene... Får prøve med et eller annet gjennopprettingsprogram.. Noen forslag?

 

er umulig og få tilbake bildene hvis de har formatert maskina

[theda9el2k]

Nei.. Klarte å få tilbake noen filmer etter en krasj på min egen PC for noen år siden.. Måtte formatere, men etter å ha installert windows igjen kjørte jeg et program jeg tror het PQ partition magic eller noe i den duren. ringer det noen bjeller hos noen?

[snippsat]

er umulig og få tilbake bildene hvis de har formatert maskina

Ikke helt riktig dette.

 

Scenario 1.

Det formateres,er data tapt da?

Nei da er ingen eller lite data tapt.

 

Scenario 2.

Det formateres,og man legger inn windows på nytt.

Da kan store deler av data være tapt.

Data går kun tapt når den blir overskrevet.

 

Hvordan kan jeg finne alt data som er på disken?(snakker da om ikke synlig data)

Det er en del gratis,men de holder ikke mål til og finne all data.

 

Disse finnner det som er muilg og gjennopprette.

GetDataBack

http://www.data-recovery-software.net/

http://www.easeus.com/datarecoverywizardpro/

Endret 21. mars 2009 av SNIPPSAT

[Bruker-158599]

papirkurv.

Endret 30. juli 2010 av riskake90

[theda9el2k]

er umulig og få tilbake bildene hvis de har formatert maskina

Ikke helt riktig dette.

 

Scenario 1.

Det formateres,er data tapt da?

Nei da er ingen eller lite data tapt.

 

Scenario 2.

Det formateres,og man legger inn windows på nytt.

Da kan store deler av data være tapt.

Data går kun tapt når den blir overskrevet.

 

Hvordan kan jeg finne alt data som er på disken?(snakker da om ikke synlig data)

Det er en del gratis,men de holder ikke mål til og finne all data.

 

Disse finnner det som er muilg og gjennopprette.

GetDataBack

http://www.data-recovery-software.net/

http://www.easeus.com/datarecoverywizardpro/

 

Slik var det ja..! Hva er det beste å gjøre her? Er det mulig å legge inn windows på en ekstern HD, boote fra denne, og søke etter filene etter vha et slikt recoveryprogram?

 

Edit:

Viser seg at forhandleren allerede har lagt inn widows.. =/ har bedt henne om å ikke legge inn noe nytt på PCen fra nå, så får en bare håpe på det beste. Er man heldig, så er man heldig:) Var ihvertfall det for noen år siden da min egen PC krasjet. Fikk tilbake en god del ETTER windowsinstallasjon

Endret 23. mars 2009 av theda9el2k

[Shadowxx]

det funka ikke

 

her er min sak

 

 

Malwarebytes' Anti-Malware

 

her er

Klikk for å se/fjerne innholdet nedenfor

Malwarebytes' Anti-Malware 1.34

Databaseversjon: 1749

Windows 5.1.2600 Service Pack 3

 

26.03.2009 17:23:09

mbam-log-2009-03-26 (17-23-09).txt

 

Skanntype: Rask Skann

Objekter skannet: 67720

Tid tilbakelagt: 5 minute(s), 8 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

 

her er comfix logg

Klikk for å se/fjerne innholdet nedenfor

ComboFix 09-03-25.04 - Shadow 2009-03-26 17:30:59.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1044.18.1023.546 [GMT 1:00]

Kjører fra: c:\mxdownload\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

* Opprettet nytt gjenopprettingspunkt

 

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

.

 

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\system32\drivers\npf.sys

c:\windows\system32\packet.dll

c:\windows\system32\wpcap.dll

 

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_NPF

 

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2009-02-26 til 2009-03-26 )))))))))))))))))))))))))))))))))

.

 

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> dr------- c:\documents and settings\Administrator\Start-meny

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d--h----- c:\documents and settings\Administrator\Skrivere

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d-------- c:\documents and settings\Administrator\Skrivebord

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d--h----- c:\documents and settings\Administrator\Siste

2009-03-25 23:16 . 2009-03-25 23:17 <DIR> dr-h----- c:\documents and settings\Administrator\Programdata

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d-------- c:\documents and settings\Administrator\Mine dokumenter

2009-03-25 23:16 . 2009-02-14 06:42 <DIR> d--h----- c:\documents and settings\Administrator\Maler

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d--h----- c:\documents and settings\Administrator\Lokale innstillinger

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d-------- c:\documents and settings\Administrator\Favoritter

2009-03-25 23:16 . 2009-02-14 06:30 <DIR> d--h----- c:\documents and settings\Administrator\AndrMask

2009-03-25 23:16 . 2009-03-25 23:16 <DIR> d-------- c:\documents and settings\Administrator

2009-03-25 23:12 . 2009-03-25 23:12 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2009-03-25 23:12 . 2009-03-25 23:12 <DIR> d-------- c:\documents and settings\Shadow\Programdata\Malwarebytes

2009-03-25 23:12 . 2009-03-25 23:12 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2009-03-25 23:12 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-25 23:12 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-03-25 16:32 . 2000-05-22 01:58 647,872 --------- c:\windows\system32\Mscomct2.ocx

2009-03-25 16:32 . 2006-10-05 23:17 53,248 --------- c:\windows\Ctregrun.exe

2009-03-25 16:31 . 2009-03-25 16:31 417,792 --a------ c:\windows\system32\awrdscdc.ax

2009-03-25 16:30 . 2009-03-25 16:31 <DIR> d-------- c:\programfiler\Audible

2009-03-25 16:30 . 2003-03-18 21:20 1,060,864 --------- c:\windows\system32\mfc71.dll

2009-03-25 16:30 . 2003-03-18 20:14 499,712 --------- c:\windows\system32\msvcp71.dll

2009-03-25 16:30 . 2003-02-21 04:42 348,160 --------- c:\windows\system32\msvcr71.dll

2009-03-25 16:29 . 2009-03-25 16:42 <DIR> d-------- c:\documents and settings\All Users\Programdata\Creative

2009-03-25 16:28 . 1999-12-12 18:01 44,032 --------- c:\windows\system32\CTSVCCDA.EXE

2009-03-25 16:28 . 1999-11-17 18:00 25,088 --------- c:\windows\system32\CTSVCCTL.EXE

2009-03-25 16:27 . 2009-03-25 16:27 <DIR> d-------- c:\programfiler\Fellesfiler\Creative

2009-03-25 16:27 . 2009-03-25 16:29 <DIR> d--h----- c:\programfiler\Creative Installation Information

2009-03-22 22:14 . 2006-10-26 19:56 32,592 --a------ c:\windows\system32\msonpmon.dll

2009-03-22 22:12 . 2009-03-22 22:12 <DIR> d-------- c:\programfiler\Microsoft Works

2009-03-22 22:08 . 2009-03-22 22:08 <DIR> d-------- c:\programfiler\Microsoft.NET

2009-03-22 22:05 . 2009-03-22 22:05 <DIR> d-------- c:\programfiler\Microsoft Visual Studio 8

2009-03-22 22:04 . 2009-03-22 22:10 <DIR> d-------- c:\windows\SHELLNEW

2009-03-22 22:03 . 2009-03-22 22:22 <DIR> d-------- c:\documents and settings\All Users\Programdata\Microsoft Help

2009-03-22 22:01 . 2009-03-22 22:01 <DIR> dr-h----- C:\MSOCache

2009-03-22 21:43 . 2009-03-22 21:44 <DIR> d----c--- c:\windows\system32\DRVSTORE

2009-03-22 21:43 . 2006-06-09 11:04 278,528 --a------ c:\windows\system32\cmdiag.new

2009-03-22 21:43 . 2006-06-09 11:04 278,528 --a------ c:\windows\system32\cmdiag.cpl

2009-03-22 21:43 . 2005-04-13 11:17 163,840 --a------ c:\windows\system32\cmabout.dll

2009-03-22 21:43 . 2006-07-11 11:03 84,608 --a------ c:\windows\system32\drivers\cxbu0wdm.sys

2009-03-22 21:43 . 2006-03-20 13:53 61,440 --a------ c:\windows\system32\chksvrn.dll

2009-03-22 21:43 . 2001-04-27 09:39 41,926 --a------ c:\windows\system32\ok.bmp

2009-03-22 21:43 . 2006-07-04 08:17 10,229 --a------ c:\windows\system32\cmdiag.ini

2009-03-22 21:43 . 2006-02-03 10:42 142 --a------ c:\windows\system32\cmabout.ini

2009-03-22 21:42 . 2009-03-22 21:42 <DIR> d-------- c:\programfiler\Buypass

2009-03-17 19:27 . 2009-03-17 19:27 <DIR> d-------- C:\Isa_SCR

2009-03-17 19:22 . 2009-03-17 19:22 <DIR> d-------- c:\windows\Sun

2009-03-17 19:22 . 2009-03-17 19:22 <DIR> d-------- c:\programfiler\Java

2009-03-17 19:22 . 2009-03-17 19:22 410,984 --a------ c:\windows\system32\deploytk.dll

2009-03-17 19:22 . 2009-03-17 19:22 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-17 19:17 . 2001-08-17 21:51 23,936 --a------ c:\windows\system32\drivers\sccmusbm.sys

2009-03-17 19:17 . 2001-08-17 21:51 23,936 --a--c--- c:\windows\system32\dllcache\sccmusbm.sys

2009-03-16 21:08 . 2009-03-25 16:47 <DIR> d-------- c:\documents and settings\Shadow\Programdata\Creative

2009-03-16 20:51 . 2009-03-16 20:51 <DIR> d-------- C:\WebCam

2009-03-15 21:13 . 2008-09-26 09:52 10,384 --a------ c:\windows\system32\drivers\LBeepKE.sys

2009-03-15 21:13 . 2009-03-15 21:13 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2009-03-15 21:12 . 2009-03-15 21:12 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf

2009-03-15 21:11 . 2009-03-15 21:11 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-03-15 21:11 . 2009-03-15 21:11 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf

2009-03-15 21:09 . 2009-03-15 21:09 <DIR> d-------- c:\programfiler\Logitech

2009-03-15 21:09 . 2009-03-15 21:10 <DIR> d-------- c:\programfiler\Fellesfiler\Logishrd

2009-03-15 21:08 . 2009-03-15 21:14 <DIR> d-------- c:\documents and settings\All Users\Programdata\LogiShrd

2009-03-10 19:29 . 2009-03-26 17:26 <DIR> d-------- C:\MxDownload

2009-03-10 19:27 . 2009-03-10 19:27 0 --a------ c:\windows\system32\cid_store.dat

2009-03-09 15:29 . 2009-03-09 15:29 <DIR> d-------- c:\programfiler\BillP Studios

2009-03-09 15:29 . 2009-03-09 15:29 <DIR> d-------- c:\documents and settings\Shadow\Programdata\WinPatrol

2009-03-09 15:25 . 2002-12-29 01:14 81,920 --a------ c:\windows\system32\Startup.cpl

2009-03-08 14:20 . 2009-03-08 14:25 <DIR> d-------- c:\documents and settings\Shadow\Programdata\Stardock

2009-03-08 14:19 . 2009-03-08 14:22 <DIR> d-------- c:\documents and settings\All Users\Programdata\Stardock

2009-03-08 14:19 . 2009-03-08 14:19 <DIR> d--h-c--- c:\documents and settings\All Users\Programdata\{2C0895CF-C7CF-4FF0-B3B8-C0518C9E3418}

2009-03-08 14:11 . 2009-03-25 22:28 <DIR> dr-h----- c:\documents and settings\Shadow\Siste

2009-03-05 19:43 . 2009-03-05 19:43 <DIR> d-------- c:\documents and settings\All Users\Programdata\ATI

2009-03-05 17:19 . 2009-03-05 17:19 98,304 --a------ c:\windows\system32\CmdLineExt.dll

2009-03-05 17:12 . 2009-03-05 17:12 32 --a------ c:\windows\CD_Start.INI

2009-03-05 17:01 . 2009-03-05 17:01 <DIR> d-------- c:\programfiler\Rockstar Games

2009-03-03 16:57 . 2009-03-03 16:58 <DIR> d-------- c:\documents and settings\Shadow\Programdata\DivX

2009-03-03 16:56 . 2008-11-06 17:37 120,056 --------- c:\windows\system32\pxcpyi64.exe

2009-03-03 16:56 . 2008-11-06 17:37 118,520 --------- c:\windows\system32\pxinsi64.exe

2009-03-03 16:55 . 2009-03-03 16:56 <DIR> d-------- c:\programfiler\DivX

2009-03-02 21:21 . 2009-03-23 23:40 116 --a------ c:\windows\NeroDigital.ini

2009-03-02 21:20 . 2009-03-02 21:20 <DIR> d-------- c:\documents and settings\Shadow\Programdata\Ahead

2009-03-02 21:20 . 2005-04-20 12:32 2,916,352 --------- c:\windows\UNNMP.exe

2009-03-02 21:20 . 2006-03-22 12:55 47,867 --------- c:\windows\UNNMP.cfg

2009-03-02 21:18 . 2009-03-02 21:18 <DIR> d-------- c:\programfiler\Fellesfiler\Nero

2009-03-02 21:18 . 2001-07-09 10:50 155,648 --a------ c:\windows\system32\NeroCheck.exe

2009-03-02 21:17 . 2005-07-29 16:12 2,977,792 --------- c:\windows\UNNeroVision.exe

2009-03-02 21:17 . 2006-03-22 12:55 179,261 --------- c:\windows\UNNeroVision.cfg

2009-03-02 21:17 . 2001-08-17 22:43 24,576 --------- c:\windows\system32\msxml3a.dll

2009-03-02 21:16 . 2009-03-02 21:16 <DIR> d-------- c:\programfiler\Fellesfiler\Ahead

2009-03-02 21:16 . 2009-03-02 21:19 <DIR> d-------- c:\programfiler\Ahead

2009-03-02 21:16 . 2009-03-02 21:16 <DIR> d-------- c:\documents and settings\All Users\Programdata\Ahead

2009-03-02 21:16 . 2004-07-26 16:16 1,568,768 --------- c:\windows\system32\ImagX7.dll

2009-03-02 21:16 . 2004-07-26 16:16 476,320 --------- c:\windows\system32\ImagXpr7.dll

2009-03-02 21:16 . 2004-07-26 16:16 471,040 --------- c:\windows\system32\ImagXRA7.dll

2009-03-02 21:16 . 2004-07-09 08:43 364,544 --------- c:\windows\system32\TwnLib4.dll

2009-03-02 21:16 . 2004-07-26 16:16 262,144 --------- c:\windows\system32\ImagXR7.dll

2009-03-02 21:16 . 2000-06-26 10:45 106,496 --a------ c:\windows\system32\TwnLib20.dll

2009-03-02 21:16 . 2001-06-26 07:15 38,912 --------- c:\windows\system32\picn20.dll

2009-03-02 16:09 . 2009-03-03 14:56 4,096 --a------ c:\windows\system32\crash

2009-03-02 15:20 . 2009-03-02 15:20 <DIR> d-------- c:\documents and settings\All Users\Programdata\FLEXnet

2009-03-02 14:39 . 2009-03-18 23:28 <DIR> d-------- c:\documents and settings\Shadow\Programdata\dvdcss

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-26 16:29 --------- d-----w c:\documents and settings\Shadow\Programdata\MxBoost

2009-03-25 22:16 --------- d--h--w c:\programfiler\InstallShield Installation Information

2009-03-25 15:32 --------- d-----w c:\programfiler\Creative

2009-03-24 18:59 --------- d-----w c:\documents and settings\Shadow\Programdata\uTorrent

2009-03-22 21:11 --------- d-----w c:\programfiler\MSBuild

2009-03-22 21:10 --------- d-----w c:\programfiler\DC++

2009-03-16 19:36 --------- d-----w c:\programfiler\ATI

2009-03-08 13:19 --------- d-----w c:\programfiler\Stardock

2009-03-08 01:44 --------- d-----w c:\documents and settings\Shadow\Programdata\Winamp

2009-03-05 18:38 --------- d-----w c:\programfiler\ATI Technologies

2009-03-03 18:52 --------- d-----w c:\documents and settings\Shadow\Programdata\AVGTOOLBAR

2009-03-01 19:11 --------- d-----w c:\documents and settings\All Users\Programdata\avg8

2009-02-23 20:23 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-02-23 20:23 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-02-23 20:22 --------- d-----w c:\programfiler\AVG

2009-02-23 20:18 --------- d---a-w c:\documents and settings\All Users\Programdata\TEMP

2009-02-23 20:17 2,560 ----a-w c:\windows\_MSRSTRT.EXE

2009-02-23 19:25 --------- d-----w c:\documents and settings\Shadow\Programdata\ImgBurn

2009-02-23 19:21 --------- d-----w c:\programfiler\ImgBurn

2009-02-23 17:46 --------- d-----w c:\programfiler\MP3 Wave Converter

2009-02-23 17:35 --------- d-----w c:\programfiler\NOS

2009-02-23 17:35 --------- d-----w c:\documents and settings\All Users\Programdata\NOS

2009-02-23 16:57 --------- d-----w c:\programfiler\EA GAMES

2009-02-22 18:34 --------- d-----w c:\programfiler\Fellesfiler\Adobe

2009-02-22 18:29 --------- d-----w c:\programfiler\Maxthon2

2009-02-22 18:01 --------- d-----w c:\programfiler\Windows Desktop Search

2009-02-15 13:29 --------- d-----w c:\programfiler\Astro Gemini Software

2009-02-15 13:25 29,696 ----a-w c:\windows\mickey32.dll

2009-02-15 13:25 232,784 ----a-w c:\windows\Matrix Code.scr

2009-02-15 13:25 2,285,222 ----a-w c:\windows\Matrix Code.exe

2009-02-15 09:22 --------- d-----w c:\programfiler\Fellesfiler\Stardock

2009-02-14 23:41 --------- d-----w c:\programfiler\Counter-Strike

2009-02-14 23:13 --------- d-----w c:\programfiler\Steam

2009-02-14 20:43 --------- d-----w c:\programfiler\Fellesfiler\DirectX

2009-02-14 20:21 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2009-02-14 20:21 22,328 ----a-w c:\documents and settings\Shadow\Programdata\PnkBstrK.sys

2009-02-14 19:25 --------- d-----w c:\programfiler\Activision

2009-02-14 19:18 --------- d-----w c:\documents and settings\Shadow\Programdata\DAEMON Tools Lite

2009-02-14 18:06 --------- d-----w c:\documents and settings\Shadow\Programdata\DAEMON Tools Pro

2009-02-14 18:06 --------- d-----w c:\documents and settings\Shadow\Programdata\DAEMON Tools

2009-02-14 18:05 --------- d-----w c:\programfiler\DAEMON Tools Lite

2009-02-14 18:05 --------- d-----w c:\documents and settings\All Users\Programdata\DAEMON Tools Lite

2009-02-14 18:01 717,296 ----a-w c:\windows\system32\drivers\sptd.sys

2009-02-14 14:05 --------- d-----w c:\documents and settings\Shadow\Programdata\vlc

2009-02-14 14:04 --------- d-----w c:\programfiler\VideoLAN

2009-02-14 10:48 --------- d-----w c:\programfiler\CCleaner

2009-02-14 09:54 --------- d-----w c:\programfiler\uTorrent

2009-02-14 09:36 --------- d-----w c:\documents and settings\Shadow\Programdata\Ventrilo

2009-02-14 09:27 --------- d-----w c:\documents and settings\All Users\Programdata\Messenger Plus!

2009-02-14 09:23 --------- d-----w c:\programfiler\Messenger Plus! Live

2009-02-14 09:19 --------- d-----w c:\programfiler\Windows Live SkyDrive

2009-02-14 09:19 --------- d-----w c:\programfiler\Windows Live

2009-02-14 09:19 --------- d-----w c:\programfiler\Microsoft

2009-02-14 09:16 --------- d-----w c:\programfiler\Fellesfiler\Windows Live

2009-02-14 09:01 --------- d-----w c:\programfiler\Bonjour

2009-02-14 08:51 --------- d-----w c:\programfiler\Fellesfiler\Macrovision Shared

2009-02-14 07:38 --------- d-----w c:\programfiler\VALVe

2009-02-14 07:37 --------- d-----w c:\programfiler\Winamp

2009-02-14 07:29 --------- d-----w c:\documents and settings\Shadow\Programdata\ATI

2009-02-14 07:25 --------- d-----w c:\documents and settings\Shadow\Programdata\Windows Search

2009-02-14 07:22 --------- d-----w c:\programfiler\Reference Assemblies

2009-02-14 07:17 --------- d-----w c:\programfiler\Windows Media Connect 2

2009-02-14 07:04 --------- d-----w c:\programfiler\Microsoft Silverlight

2009-02-14 06:59 --------- d-----w c:\programfiler\Fellesfiler\InstallShield

2009-02-14 05:45 --------- d-----w c:\programfiler\microsoft frontpage

2009-02-14 05:44 --------- d-----w c:\programfiler\Elektroniske tjenester

2009-02-14 05:43 --------- d-----w c:\programfiler\Fellesfiler\Tjenester

2009-02-04 07:27 3,488,768 ----a-w c:\windows\system32\drivers\ati2mtag.sys

2009-02-04 03:52 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"MSMSGS"="c:\programfiler\Messenger\msmsgs.exe" [2008-04-14 1695232]

"msnmsgr"="c:\programfiler\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885400]

"CTSyncU.exe"="c:\programfiler\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-23 1601304]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"StartCCC"="c:\programfiler\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2009-03-17 148888]

"GrooveMonitor"="c:\programfiler\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"CTCheck"="c:\programfiler\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]

"P17Helper"="P17.dll" [2005-05-03 c:\windows\system32\P17.dll]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 c:\windows\KHALMNPR.Exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\Shadow\Start-meny\Programmer\Oppstart\

Stardock ObjectDock.lnk - c:\programfiler\Stardock\ObjectDock\ObjectDock.exe [2009-02-14 3450608]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

SetPointII.lnk - c:\programfiler\Logitech\SetPoint II\SetpointII.exe [2008-11-13 323584]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-02-23 21:23 10520 c:\windows\system32\avgrsstx.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\uTorrent\\uTorrent.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Programfiler\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=

"c:\\Programfiler\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=

"c:\\Programfiler\\DC++\\DCPlusPlus.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgemc.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Programfiler\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\ONENOTE.EXE"=

 

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-23 325128]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-23 107272]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-23 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-23 298264]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-03-15 10384]

R3 cxbu0wdm;CardMan 3x21;c:\windows\system32\drivers\cxbu0wdm.sys [2009-03-22 84608]

R3 P0870Dev;Creative WebCam Live! Motion;c:\windows\system32\drivers\P0870Dev.sys [2009-03-16 172288]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2007-05-23 547744]

S3 OMNUSB;Omnikey AG CardMan 2020 USB-smartkortleser;c:\windows\system32\drivers\sccmusbm.sys [2009-03-17 23936]

.

- - - - TOMME PEKERE FJERNET - - - -

 

HKLM-Run-Key Drv - plkhost.exe

 

 

.

------- Tilleggsskanning -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

Trusted Zone: buypass.no

Trusted Zone: headit.no

Trusted Zone: norsk-tipping.no

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-26 17:39:50

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'winlogon.exe'(532)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\windows\system32\scardsvr.exe

c:\programfiler\Bonjour\mDNSResponder.exe

c:\windows\system32\CTSVCCDA.EXE

c:\programfiler\Java\jre6\bin\jqs.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\programfiler\AVG\AVG8\avgrsx.exe

c:\programfiler\AVG\AVG8\avgcsrvx.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\rundll32.exe

c:\programfiler\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\programfiler\Fellesfiler\Logishrd\KHAL2\KHALMNPR.exe

c:\programfiler\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2009-03-26 17:46:05 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2009-03-26 16:45:59

 

Pre-Run: 94 656 376 832 byte ledig

Post-Run: 94,859,321,344 byte ledig

 

302 --- E O F --- 2009-02-14 07:31:45