Raytee Skrevet 10. april 2009 Del Skrevet 10. april 2009 (endret) Combofix: ComboFix 09-04-04.01 - Rayte 2009-04-10 11:46:01.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3582.2882 [GMT 2:00] Kjører fra: c:\documents and settings\Rayte\Desktop\ComboFix.exe AV: AVG Anti-Virus *On-access scanning enabled* (Updated) * Opprettet nytt gjenopprettingspunkt . ((((((((((((((((((((((((((( Filer Opprettet Fra 2009-03-10 til 2009-04-10 ))))))))))))))))))))))))))))))))) . 2009-04-10 11:20 . 2009-04-10 11:20 <DIR> d-------- C:\fsaua.data 2009-04-10 10:28 . 2009-04-10 10:28 <DIR> d-------- c:\documents and settings\Rayte\Application Data\Uniblue 2009-04-10 10:27 . 2009-04-10 10:33 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\~0 2009-04-09 11:07 . 2009-04-09 11:07 <DIR> d-------- c:\documents and settings\LocalService\Application Data\Xfire 2009-04-08 21:58 . 2009-04-08 21:58 <DIR> d-------- c:\documents and settings\Rayte\Application Data\dyyno-vlc 2009-04-08 21:53 . 2009-04-08 21:53 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Xfire 2009-04-08 21:43 . 2009-04-09 12:12 <DIR> d-------- c:\program files\Xfire 2009-04-08 21:43 . 2009-04-09 21:21 <DIR> d-------- c:\documents and settings\Rayte\Application Data\Xfire 2009-04-08 21:41 . 2009-04-10 10:36 <DIR> d-------- c:\program files\Dyyno 2009-04-02 06:11 . 2009-04-02 06:11 <DIR> d-------- c:\program files\uTorrent 2009-04-02 06:11 . 2009-04-02 22:52 <DIR> d-------- c:\documents and settings\Rayte\Application Data\uTorrent 2009-03-27 03:28 . 2009-04-08 12:54 <DIR> d-------- c:\program files\World of Warcraft Public Test 2009-03-26 04:57 . 2009-03-26 04:57 <DIR> d-------- c:\windows\system32\LogFiles 2009-03-21 00:26 . 2009-03-21 00:26 41,808 --a------ c:\windows\system32\xfcodec.dll 2009-03-18 14:13 . 2009-03-18 14:13 754 --a------ c:\windows\WORDPAD.INI 2009-03-14 10:33 . 2009-03-14 10:33 <DIR> d-------- c:\program files\Java 2009-03-14 10:33 . 2009-03-14 10:33 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-03-12 09:39 . 2004-08-04 00:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-10 09:40 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-04-10 09:25 --------- d-----w c:\documents and settings\Rayte\Application Data\Skype 2009-04-10 08:37 --------- d-----w c:\documents and settings\Rayte\Application Data\Cedelia 2009-04-10 08:18 --------- d-----w c:\program files\Steam 2009-04-10 08:18 --------- d-----w c:\documents and settings\Rayte\Application Data\skypePM 2009-04-06 09:03 --------- d-----w c:\program files\Winamp Remote 2009-04-04 12:59 --------- d-----w c:\program files\World of Warcraft 2009-03-29 03:45 --------- d-----w c:\program files\PKR 2009-03-27 01:50 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-03-26 16:38 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-03-26 15:39 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-03-26 15:39 108,552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-03-26 15:39 10,520 ----a-w c:\windows\system32\avgrsstx.dll 2009-03-20 19:17 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania 2009-03-18 18:54 --------- d-----w c:\documents and settings\Rayte\Application Data\Ventrilo 2009-03-14 08:33 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-03-04 18:40 --------- d-----w c:\program files\TmNationsForever 2009-02-28 18:28 --------- d-----w c:\program files\PowerISO 2009-02-27 20:52 --------- d-----w c:\documents and settings\All Users\Application Data\OrbNetworks 2009-02-26 13:14 --------- d-----w c:\program files\Windows Live 2009-02-26 13:14 --------- d-----w c:\program files\Microsoft 2009-02-25 03:54 --------- d-----w c:\program files\Full Tilt Poker 2009-02-21 16:49 --------- d-----w c:\program files\Winamp 2009-02-21 16:49 --------- d-----w c:\documents and settings\Rayte\Application Data\Winamp 2009-02-21 13:13 --------- d-----w c:\program files\Guitar Pro 5 2009-02-21 12:14 --------- d-----w c:\program files\DVDVideoSoft 2009-02-21 12:14 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2009-02-21 12:14 --------- d-----w c:\program files\AskSearch 2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-02-10 18:58 --------- d-----w c:\program files\Ventrilo 2009-02-10 18:58 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll 2009-01-13 02:25 16,608 ----a-w c:\windows\gdrv.sys 2009-01-11 15:56 315,392 ----a-w c:\windows\HideWin.exe . ((((((((((((((((((((((((((((( SnapShot@2009-02-07_ 2.50.23,35 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB960715\spmsg.dll + 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB960715\spuninst.exe + 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB960715\update\spcustom.dll + 2008-11-15 17:18:04 755,576 ----a-w c:\windows\$hf_mig$\KB960715\update\update.exe + 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB960715\update\updspapi.dll + 2008-07-03 13:03:29 8,460,800 ----a-w c:\windows\$hf_mig$\KB967715\SP2QFE\shell32.dll + 2008-02-15 09:06:21 351,744 ----a-w c:\windows\$hf_mig$\KB967715\SP2QFE\xpsp3res.dll + 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\$hf_mig$\KB967715\SP3GDR\shell32.dll + 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll + 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll + 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe + 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll + 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe + 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll + 2005-06-28 17:23:24 213,216 -c----w c:\windows\$NtUninstallKB923689$\spuninst\spuninst.exe + 2005-06-28 17:23:53 371,424 -c----w c:\windows\$NtUninstallKB923689$\spuninst\updspapi.dll + 2005-01-28 12:44:28 2,370,296 -c----w c:\windows\$NtUninstallKB923689$\wmvcore.dll + 2008-07-09 07:38:25 231,288 -c----w c:\windows\$NtUninstallKB960715$\spuninst\spuninst.exe + 2008-07-09 07:38:37 382,840 -c----w c:\windows\$NtUninstallKB960715$\spuninst\updspapi.dll + 2007-10-26 03:36:51 8,454,656 -c----w c:\windows\$NtUninstallKB967715$\shell32.dll + 2008-07-09 07:38:25 231,288 -c----w c:\windows\$NtUninstallKB967715$\spuninst\spuninst.exe + 2008-07-09 07:38:37 382,840 -c----w c:\windows\$NtUninstallKB967715$\spuninst\updspapi.dll + 2008-02-27 13:59:28 290,816 ----a-w c:\windows\Downloaded Program Files\auc_lib.dll + 2009-03-19 08:43:18 274,432 ----a-w c:\windows\Downloaded Program Files\DyynoX.dll + 2008-02-27 13:59:28 495,616 ----a-w c:\windows\Downloaded Program Files\daas_s.dll + 2008-02-27 14:00:12 262,144 ----a-w c:\windows\Downloaded Program Files\fscax.dll + 2008-02-27 13:59:16 588,392 ----a-w c:\windows\Downloaded Program Files\gatelauncher.exe - 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-20 18:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE + 2009-02-07 15:26:59 27,648 ----a-r c:\windows\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe - 2009-01-14 17:25:23 102,400 ----a-r c:\windows\Installer\{318AB667-3230-41B5-A617-CB3BF748D371}\iTunesIco.exe + 2009-03-12 07:44:28 102,400 ----a-r c:\windows\Installer\{318AB667-3230-41B5-A617-CB3BF748D371}\iTunesIco.exe - 2009-01-11 16:12:19 80,395 ----a-r c:\windows\Installer\{33FE4D58-2D62-4969-8B0F-7F7ACBB7BD23}\MsblIco.Exe + 2009-02-26 13:14:58 80,395 ----a-r c:\windows\Installer\{33FE4D58-2D62-4969-8B0F-7F7ACBB7BD23}\MsblIco.Exe - 2000-08-31 07:00:00 29,696 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 06:00:00 29,696 ----a-w c:\windows\NIRCMD.exe + 2004-08-04 12:00:00 159,232 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\cewmdm.dll + 2004-08-04 12:00:00 52,224 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll + 2004-08-04 12:00:00 201,728 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSP.dll + 2004-08-04 12:00:00 356,352 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSSCP.dll + 2004-08-04 12:00:00 245,760 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MSWMDM.dll + 2004-08-04 12:00:00 27,136 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMLOG.dll + 2004-08-04 12:00:00 23,552 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\WMDMPS.dll + 2005-01-28 12:44:28 164,864 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\cewmdm.dll + 2005-01-28 12:44:28 25,088 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll + 2005-01-28 12:44:28 173,568 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSP.dll + 2005-01-28 12:44:28 364,784 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSSCP.dll + 2005-01-28 12:44:28 315,904 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MSWMDM.dll + 2005-01-28 12:44:28 28,160 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMLOG.dll + 2005-01-28 12:44:28 33,792 ----a-w c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDMPS.dll + 2005-01-28 12:44:28 47,104 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe + 2005-01-28 12:44:28 15,872 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfapi.dll + 2005-01-28 12:44:28 38,912 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe + 2005-01-28 12:44:28 38,912 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpd_ci.dll + 2005-01-28 12:44:28 61,952 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdconns.dll + 2005-01-28 12:44:28 114,176 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtp.dll + 2005-01-28 12:44:28 331,776 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpdr.dll + 2005-01-28 12:44:28 66,560 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdmtpus.dll + 2005-01-28 12:44:28 331,264 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdsp.dll + 2005-01-28 12:44:28 10,752 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdtrace.dll + 2005-01-28 12:44:28 18,944 ----a-w c:\windows\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpdusb.sys + 2004-08-04 12:00:00 408,064 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmadmod.dll + 2004-08-04 12:00:00 759,296 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmsdmod.dll + 2004-08-04 12:00:00 484,864 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmspdmod.dll + 2004-08-04 12:00:00 809,984 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}$BACKUP$\System\wmvdmod.dll + 2005-01-28 12:44:28 396,528 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmadmod.dll + 2005-01-28 12:44:28 774,904 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmsdmod.dll + 2005-01-28 12:44:28 413,944 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmspdmod.dll + 2005-01-28 12:44:28 1,218,808 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvadvd.dll + 2005-01-28 12:44:28 895,736 ----a-w c:\windows\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\wmvdmod.dll + 2004-08-04 12:00:00 286,208 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\blackbox.dll + 2004-08-04 12:00:00 299,520 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmclien.dll + 2004-08-04 12:00:00 87,040 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmstor.dll + 2004-08-04 12:00:00 695,296 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\drmv2clt.dll + 2004-08-04 12:00:00 259,072 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}$BACKUP$\System\msnetobj.dll + 2005-01-28 12:44:28 294,912 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\blackbox.dll + 2005-01-28 12:44:28 258,296 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmclien.dll + 2005-01-28 12:44:28 96,768 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmstor.dll + 2005-01-28 12:44:28 502,272 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drmv2clt.dll + 2005-01-28 12:44:28 142,336 ----a-w c:\windows\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\msnetobj.dll + 2004-08-04 12:00:00 6,656 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\laprxy.dll + 2008-06-10 00:31:06 103,936 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe + 2004-08-04 12:00:00 237,568 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\qasf.dll + 2004-08-04 12:00:00 670,720 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmadmoe.dll + 2007-10-27 16:39:20 230,912 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmasf.dll + 2004-08-04 12:00:00 151,552 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmidx.dll + 2008-06-10 17:18:18 1,053,696 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmnetmgr.dll + 2004-08-04 12:00:00 1,119,744 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmsdmoe2.dll + 2004-08-04 12:00:00 896,512 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmspdmoe.dll + 2008-11-07 17:32:20 2,109,440 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvcore.dll + 2004-08-04 12:00:00 1,001,472 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\wmvdmoe2.dll + 2005-01-28 12:44:28 6,656 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\laprxy.dll + 2005-01-28 12:44:28 96,768 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe + 2005-01-28 12:44:28 221,184 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\qasf.dll + 2005-01-28 12:44:28 716,288 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmadmoe.dll + 2005-01-28 12:44:28 224,768 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmasf.dll + 2005-01-28 12:44:28 335,872 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMdev.dll + 2005-01-28 12:44:28 290,816 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMDRMNet.dll + 2005-01-28 12:44:28 150,016 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmidx.dll + 2005-01-28 12:44:28 1,027,072 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmnetmgr.dll + 2005-01-28 12:44:28 1,119,744 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmsdmoe2.dll + 2005-01-28 12:44:28 940,544 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmspdmoe.dll + 2005-01-28 12:44:28 1,512,448 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMVADVE.DLL + 2005-01-28 12:44:28 2,370,296 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvcore.dll + 2005-01-28 12:44:28 1,003,008 ----a-w c:\windows\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmvdmoe2.dll - 2000-08-31 07:00:00 161,792 ----a-w c:\windows\SWREG.exe + 2000-08-31 06:00:00 161,792 ----a-w c:\windows\SWREG.exe - 2004-08-04 12:00:00 286,208 ----a-w c:\windows\system32\blackbox.dll + 2005-01-28 12:44:28 294,912 ----a-w c:\windows\system32\blackbox.dll - 2004-08-04 12:00:00 159,232 ----a-w c:\windows\system32\cewmdm.dll + 2005-01-28 12:44:28 164,864 ----a-w c:\windows\system32\cewmdm.dll + 2005-02-05 18:45:26 2,222,800 ----a-w c:\windows\system32\d3dx9_24.dll + 2005-03-18 16:19:58 2,337,488 ----a-w c:\windows\system32\d3dx9_25.dll + 2005-05-26 14:34:52 2,297,552 ----a-w c:\windows\system32\d3dx9_26.dll + 2005-07-22 18:59:04 2,319,568 ----a-w c:\windows\system32\d3dx9_27.dll + 2005-12-05 17:09:18 2,323,664 ----a-w c:\windows\system32\d3dx9_28.dll + 2006-02-03 07:43:16 2,332,368 ----a-w c:\windows\system32\d3dx9_29.dll + 2006-03-31 11:40:58 2,388,176 ----a-w c:\windows\system32\d3dx9_30.dll - 2004-08-04 12:00:00 286,208 -c--a-w c:\windows\system32\dllcache\blackbox.dll + 2005-01-28 12:44:28 294,912 -c--a-w c:\windows\system32\dllcache\blackbox.dll - 2004-08-04 12:00:00 159,232 -c--a-w c:\windows\system32\dllcache\cewmdm.dll + 2005-01-28 12:44:28 164,864 -c--a-w c:\windows\system32\dllcache\cewmdm.dll - 2004-08-04 12:00:00 299,520 -c--a-w c:\windows\system32\dllcache\drmclien.dll + 2005-01-28 12:44:28 258,296 -c--a-w c:\windows\system32\dllcache\drmclien.dll - 2004-08-04 12:00:00 87,040 -c--a-w c:\windows\system32\dllcache\drmstor.dll + 2005-01-28 12:44:28 96,768 -c--a-w c:\windows\system32\dllcache\drmstor.dll - 2004-08-04 12:00:00 695,296 -c--a-w c:\windows\system32\dllcache\drmv2clt.dll + 2005-01-28 12:44:28 502,272 -c--a-w c:\windows\system32\dllcache\drmv2clt.dll - 2004-08-04 12:00:00 6,656 -c--a-w c:\windows\system32\dllcache\laprxy.dll + 2005-01-28 12:44:28 6,656 -c--a-w c:\windows\system32\dllcache\laprxy.dll - 2008-06-10 00:31:06 103,936 -c--a-w c:\windows\system32\dllcache\logagent.exe + 2008-06-10 04:52:04 96,768 -c--a-w c:\windows\system32\dllcache\logagent.exe - 2004-08-04 12:00:00 259,072 -c--a-w c:\windows\system32\dllcache\msnetobj.dll + 2005-01-28 12:44:28 142,336 -c--a-w c:\windows\system32\dllcache\msnetobj.dll - 2004-08-04 12:00:00 52,224 -c--a-w c:\windows\system32\dllcache\mspmsnsv.dll + 2005-01-28 12:44:28 25,088 -c--a-w c:\windows\system32\dllcache\mspmsnsv.dll - 2004-08-04 12:00:00 201,728 -c--a-w c:\windows\system32\dllcache\mspmsp.dll + 2005-01-28 12:44:28 173,568 -c--a-w c:\windows\system32\dllcache\mspmsp.dll - 2004-08-04 12:00:00 356,352 -c--a-w c:\windows\system32\dllcache\msscp.dll + 2005-01-28 12:44:28 364,784 -c--a-w c:\windows\system32\dllcache\msscp.dll - 2004-08-04 12:00:00 245,760 -c--a-w c:\windows\system32\dllcache\mswmdm.dll + 2005-01-28 12:44:28 315,904 -c--a-w c:\windows\system32\dllcache\mswmdm.dll - 2004-08-04 12:00:00 237,568 -c--a-w c:\windows\system32\dllcache\qasf.dll + 2005-01-28 12:44:28 221,184 -c--a-w c:\windows\system32\dllcache\qasf.dll - 2007-10-26 03:36:51 8,454,656 -c--a-w c:\windows\system32\dllcache\shell32.dll + 2008-07-03 13:16:57 8,454,656 -c--a-w c:\windows\system32\dllcache\shell32.dll - 2004-08-04 12:00:00 408,064 -c--a-w c:\windows\system32\dllcache\wmadmod.dll + 2005-01-28 12:44:28 396,528 -c--a-w c:\windows\system32\dllcache\wmadmod.dll - 2004-08-04 12:00:00 670,720 -c--a-w c:\windows\system32\dllcache\wmadmoe.dll + 2005-01-28 12:44:28 716,288 -c--a-w c:\windows\system32\dllcache\wmadmoe.dll - 2007-10-27 16:39:20 230,912 -c--a-w c:\windows\system32\dllcache\wmasf.dll + 2007-10-27 16:40:06 227,328 -c--a-w c:\windows\system32\dllcache\wmasf.dll - 2004-08-04 12:00:00 27,136 -c--a-w c:\windows\system32\dllcache\wmdmlog.dll + 2005-01-28 12:44:28 28,160 -c--a-w c:\windows\system32\dllcache\wmdmlog.dll - 2004-08-04 12:00:00 23,552 -c--a-w c:\windows\system32\dllcache\wmdmps.dll + 2005-01-28 12:44:28 33,792 -c--a-w c:\windows\system32\dllcache\wmdmps.dll - 2004-08-04 12:00:00 151,552 -c--a-w c:\windows\system32\dllcache\wmidx.dll + 2005-01-28 12:44:28 150,016 -c--a-w c:\windows\system32\dllcache\wmidx.dll - 2008-06-10 17:18:18 1,053,696 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll + 2008-06-10 05:28:36 1,028,096 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll - 2004-08-04 12:00:00 759,296 -c--a-w c:\windows\system32\dllcache\wmsdmod.dll + 2005-01-28 12:44:28 774,904 -c--a-w c:\windows\system32\dllcache\wmsdmod.dll - 2004-08-04 12:00:00 1,119,744 -c--a-w c:\windows\system32\dllcache\wmsdmoe2.dll + 2005-01-28 12:44:28 1,119,744 -c--a-w c:\windows\system32\dllcache\wmsdmoe2.dll - 2004-08-04 12:00:00 484,864 -c--a-w c:\windows\system32\dllcache\wmspdmod.dll + 2005-01-28 12:44:28 413,944 -c--a-w c:\windows\system32\dllcache\wmspdmod.dll - 2004-08-04 12:00:00 896,512 -c--a-w c:\windows\system32\dllcache\wmspdmoe.dll + 2005-01-28 12:44:28 940,544 -c--a-w c:\windows\system32\dllcache\wmspdmoe.dll - 2007-10-27 16:37:38 2,109,440 -c--a-w c:\windows\system32\dllcache\wmvcore.dll + 2008-06-10 06:07:24 2,376,760 -c--a-w c:\windows\system32\dllcache\WMVCore.dll - 2004-08-04 12:00:00 809,984 -c--a-w c:\windows\system32\dllcache\wmvdmod.dll + 2005-01-28 12:44:28 895,736 -c--a-w c:\windows\system32\dllcache\wmvdmod.dll - 2004-08-04 12:00:00 1,001,472 -c--a-w c:\windows\system32\dllcache\wmvdmoe2.dll + 2005-01-28 12:44:28 1,003,008 -c--a-w c:\windows\system32\dllcache\wmvdmoe2.dll + 2007-03-07 23:51:00 9,336 ------w c:\windows\system32\drivers\cdr4_xp.sys + 2007-03-07 23:51:00 9,464 ------w c:\windows\system32\drivers\cdralw2k.sys + 2007-03-07 23:51:00 43,528 ------w c:\windows\system32\drivers\PxHelp20.sys + 2008-07-07 07:40:49 56,108 ----a-w c:\windows\system32\drivers\scdemu.sys + 2004-08-03 22:08:48 26,496 ----a-w c:\windows\system32\drivers\USBSTOR.SYS + 2005-01-28 12:44:28 18,944 ----a-w c:\windows\system32\drivers\wpdusb.sys - 2004-08-04 12:00:00 299,520 ----a-w c:\windows\system32\drmclien.dll + 2005-01-28 12:44:28 258,296 ----a-w c:\windows\system32\drmclien.dll - 2004-08-04 12:00:00 87,040 ----a-w c:\windows\system32\drmstor.dll + 2005-01-28 12:44:28 96,768 ----a-w c:\windows\system32\drmstor.dll - 2004-08-04 12:00:00 695,296 ----a-w c:\windows\system32\drmv2clt.dll + 2005-01-28 12:44:28 502,272 ----a-w c:\windows\system32\drmv2clt.dll - 2009-01-13 13:28:54 93,480 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-02-22 07:08:14 94,272 ----a-w c:\windows\system32\FNTCACHE.DAT - 2009-01-25 08:13:12 144,792 ----a-w c:\windows\system32\java.exe + 2009-03-14 08:33:05 144,792 ----a-w c:\windows\system32\java.exe - 2009-01-25 08:13:12 144,792 ----a-w c:\windows\system32\javaw.exe + 2009-03-14 08:33:05 144,792 ----a-w c:\windows\system32\javaw.exe - 2009-01-25 08:13:12 148,888 ----a-w c:\windows\system32\javaws.exe + 2009-03-14 08:33:05 148,888 ----a-w c:\windows\system32\javaws.exe - 2004-08-04 12:00:00 6,656 ----a-w c:\windows\system32\laprxy.dll + 2005-01-28 12:44:28 6,656 ----a-w c:\windows\system32\laprxy.dll - 2008-06-10 00:31:06 103,936 ----a-w c:\windows\system32\logagent.exe + 2008-06-10 04:52:04 96,768 ----a-w c:\windows\system32\logagent.exe - 2004-08-04 12:00:00 259,072 ----a-w c:\windows\system32\msnetobj.dll + 2005-01-28 12:44:28 142,336 ----a-w c:\windows\system32\msnetobj.dll - 2004-08-04 12:00:00 52,224 ----a-w c:\windows\system32\mspmsnsv.dll + 2005-01-28 12:44:28 25,088 ----a-w c:\windows\system32\MsPMSNSv.dll - 2004-08-04 12:00:00 201,728 ----a-w c:\windows\system32\mspmsp.dll + 2005-01-28 12:44:28 173,568 ----a-w c:\windows\system32\MsPMSP.dll - 2004-08-04 12:00:00 356,352 ----a-w c:\windows\system32\msscp.dll + 2005-01-28 12:44:28 364,784 ----a-w c:\windows\system32\MSSCP.dll + 2002-01-05 13:37:26 344,064 ----a-w c:\windows\system32\msvcr70.dll - 2004-08-04 12:00:00 245,760 ----a-w c:\windows\system32\mswmdm.dll + 2005-01-28 12:44:28 315,904 ----a-w c:\windows\system32\MSWMDM.dll - 2009-01-14 14:13:12 40,128 ----a-w c:\windows\system32\perfc009.dat + 2009-03-29 16:37:04 40,128 ----a-w c:\windows\system32\perfc009.dat - 2009-01-14 14:13:12 311,740 ----a-w c:\windows\system32\perfh009.dat + 2009-03-29 16:37:04 311,740 ----a-w c:\windows\system32\perfh009.dat + 2007-03-07 23:51:00 547,576 ------w c:\windows\system32\px.dll + 2007-03-07 23:51:00 129,784 ------w c:\windows\system32\pxafs.dll + 2007-03-07 23:51:00 64,760 ------w c:\windows\system32\pxcpya64.exe + 2007-03-07 23:51:00 510,712 ------w c:\windows\system32\pxdrv.dll + 2007-03-07 23:51:00 72,440 ------w c:\windows\system32\pxhpinst.exe + 2007-03-07 23:51:00 64,760 ------w c:\windows\system32\pxinsa64.exe + 2007-03-07 23:51:00 187,128 ------w c:\windows\system32\pxmas.dll + 2007-03-07 23:51:00 1,628,920 ------w c:\windows\system32\pxsfs.dll + 2007-03-07 23:51:00 379,640 ------w c:\windows\system32\pxwave.dll - 2004-08-04 12:00:00 237,568 ----a-w c:\windows\system32\qasf.dll + 2005-01-28 12:44:28 221,184 ----a-w c:\windows\system32\qasf.dll - 2007-10-26 03:36:51 8,454,656 ----a-w c:\windows\system32\shell32.dll + 2008-07-03 13:16:57 8,454,656 ----a-w c:\windows\system32\shell32.dll - 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll + 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll + 2005-01-28 12:44:28 47,104 ----a-w c:\windows\system32\uwdf.exe + 2007-03-07 23:51:00 39,672 ------w c:\windows\system32\vxblock.dll + 2005-01-28 12:44:28 15,872 ----a-w c:\windows\system32\wdfapi.dll + 2005-01-28 12:44:28 38,912 ----a-w c:\windows\system32\wdfmgr.exe - 2004-08-04 12:00:00 408,064 ----a-w c:\windows\system32\wmadmod.dll + 2005-01-28 12:44:28 396,528 ----a-w c:\windows\system32\wmadmod.dll - 2004-08-04 12:00:00 670,720 ----a-w c:\windows\system32\wmadmoe.dll + 2005-01-28 12:44:28 716,288 ----a-w c:\windows\system32\wmadmoe.dll - 2007-10-27 16:39:20 230,912 ----a-w c:\windows\system32\wmasf.dll + 2007-10-27 16:40:06 227,328 ----a-w c:\windows\system32\wmasf.dll - 2004-08-04 12:00:00 27,136 ----a-w c:\windows\system32\wmdmlog.dll + 2005-01-28 12:44:28 28,160 ----a-w c:\windows\system32\WMDMLOG.dll - 2004-08-04 12:00:00 23,552 ----a-w c:\windows\system32\wmdmps.dll + 2005-01-28 12:44:28 33,792 ----a-w c:\windows\system32\WMDMPS.dll + 2005-01-28 12:44:28 335,872 ----a-w c:\windows\system32\WMDRMdev.dll + 2005-01-28 12:44:28 290,816 ----a-w c:\windows\system32\WMDRMNet.dll - 2004-08-04 12:00:00 151,552 ----a-w c:\windows\system32\wmidx.dll + 2005-01-28 12:44:28 150,016 ----a-w c:\windows\system32\wmidx.dll - 2008-06-10 17:18:18 1,053,696 ----a-w c:\windows\system32\WMNetmgr.dll + 2008-06-10 05:28:36 1,028,096 ----a-w c:\windows\system32\WMNetmgr.dll + 2004-08-04 12:00:00 221,184 ----a-w c:\windows\system32\wmpns.dll - 2004-08-04 12:00:00 759,296 ----a-w c:\windows\system32\wmsdmod.dll + 2005-01-28 12:44:28 774,904 ----a-w c:\windows\system32\wmsdmod.dll - 2004-08-04 12:00:00 1,119,744 ----a-w c:\windows\system32\wmsdmoe2.dll + 2005-01-28 12:44:28 1,119,744 ----a-w c:\windows\system32\wmsdmoe2.dll - 2004-08-04 12:00:00 484,864 ----a-w c:\windows\system32\wmspdmod.dll + 2005-01-28 12:44:28 413,944 ----a-w c:\windows\system32\wmspdmod.dll - 2004-08-04 12:00:00 896,512 ----a-w c:\windows\system32\wmspdmoe.dll + 2005-01-28 12:44:28 940,544 ----a-w c:\windows\system32\wmspdmoe.dll + 2005-01-28 12:44:28 1,218,808 ----a-w c:\windows\system32\wmvadvd.dll + 2005-01-28 12:44:28 1,512,448 ----a-w c:\windows\system32\WMVADVE.DLL - 2008-11-07 17:32:20 2,109,440 ------w c:\windows\system32\WMVCore.dll + 2008-06-10 06:07:24 2,376,760 ----a-w c:\windows\system32\WMVCore.dll - 2004-08-04 12:00:00 809,984 ----a-w c:\windows\system32\wmvdmod.dll + 2005-01-28 12:44:28 895,736 ----a-w c:\windows\system32\wmvdmod.dll - 2004-08-04 12:00:00 1,001,472 ----a-w c:\windows\system32\wmvdmoe2.dll + 2005-01-28 12:44:28 1,003,008 ----a-w c:\windows\system32\wmvdmoe2.dll + 2005-01-28 12:44:28 38,912 ----a-w c:\windows\system32\wpd_ci.dll + 2005-01-28 12:44:28 61,952 ----a-w c:\windows\system32\wpdconns.dll + 2005-01-28 12:44:28 114,176 ----a-w c:\windows\system32\wpdmtp.dll + 2005-01-28 12:44:28 331,776 ----a-w c:\windows\system32\wpdmtpdr.dll + 2005-01-28 12:44:28 66,560 ----a-w c:\windows\system32\wpdmtpus.dll + 2005-01-28 12:44:28 331,264 ----a-w c:\windows\system32\wpdsp.dll + 2005-01-28 12:44:28 10,752 ----a-w c:\windows\system32\wpdtrace.dll + 2005-09-28 13:46:30 1,184,984 ----a-w c:\windows\system32\wvc1dmod.dll + 2006-02-03 07:41:26 14,032 ----a-w c:\windows\system32\x3daudio1_0.dll + 2006-02-03 07:42:06 230,096 ----a-w c:\windows\system32\xactengine2_0.dll + 2006-03-31 11:39:48 229,584 ----a-w c:\windows\system32\xactengine2_1.dll + 2006-05-31 06:24:16 230,168 ----a-w c:\windows\system32\xactengine2_2.dll + 2006-03-31 11:39:24 62,672 ----a-w c:\windows\system32\xinput1_1.dll + 2005-12-05 17:07:30 61,136 ----a-w c:\windows\system32\xinput9_1_0.dll + 2009-04-10 08:18:05 16,384 ------w c:\windows\Temp\Perflib_Perfdata_534.dat . -- Snapshot resatt til dagens dato -- . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885400] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "Steam"="c:\program files\steam\steam.exe" [2009-02-07 1410296] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-28 13516800] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-28 86016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "Mite"="c:\program files\GRT\WClient\SvcInit.exe" [2002-03-21 24576] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-26 1932568] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-14 148888] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-02-28 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe] c:\documents and settings\Rayte\Start Menu\Programs\Startup\ Xfire.lnk - c:\program files\Xfire\Xfire.exe [2009-03-21 3025232] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-03-26 17:39 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "c:\\Program Files\\GRT\\WCtrl\\WCtrl.exe"= "c:\\Program Files\\GRT\\WClient\\WClient.exe"= "c:\\Program Files\\AVG\\AVG8\\avgam.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\Steam\\steamapps\\spacedog650\\counter-strike\\hl.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Program Files\\World of Warcraft\\Repair.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\TmNationsForever\\TmForever.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 3\\Binaries\\UT3.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Rayte\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Xfire\\Xfire.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-01-25 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-25 325640] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-25 108552] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-25 908056] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-25 298264] R2 WCSvc;WCSvc;c:\program files\GRT\WClient\WCSvc.exe [2009-01-25 40960] S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [2009-01-11 47624] S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?] S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [2009-01-14 32000] --- Andre tjenester/drivere lastet i minnet --- *NewlyCreated* - APPMGMT *NewlyCreated* - MBAMSWISSARMY *NewlyCreated* - PROCEXP113 *Deregistered* - MBAMSwissArmy *Deregistered* - PROCEXP113 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2582cfc2-dffe-11dd-a839-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) 2009-03-30 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34] . - - - - TOMME PEKERE FJERNET - - - - HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe . ------- Tilleggsskanning ------- . uStart Page = hxxp://www.sol.no/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} - hxxp://webserver.dyyno.com/tng/dyyno-client/DyynoCAB.CAB . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-10 11:46:54 Windows 5.1.2600 Service Pack 2 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** . Tidspunkt ferdig: 2009-04-10 11:47:28 ComboFix-quarantined-files.txt 2009-04-10 09:47:26 ComboFix2.txt 2009-02-07 01:50:42 Pre-Run: 333 913 710 592 bytes free Post-Run: 334,046,552,064 bytes free 459 --- E O F --- 2009-02-26 02:00:41 MAM: Malwarebytes' Anti-Malware 1.34 Databaseversjon: 1902 Windows 5.1.2600 Service Pack 2 10.04.2009 11:35:40 mbam-log-2009-04-10 (11-35-40).txt Skanntype: Rask Skann Objekter skannet: 61224 Tid tilbakelagt: 2 minute(s), 56 second(s) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 0 Registerverdier infisert: 0 Registerfiler infisert: 0 Mapper infisert: 0 Filer infisert: 0 Minneprosesser infisert: (Ingen mistenkelige filer funnet) Minnemoduler infisert: (Ingen mistenkelige filer funnet) Registernøkler infisert: (Ingen mistenkelige filer funnet) Registerverdier infisert: (Ingen mistenkelige filer funnet) Registerfiler infisert: (Ingen mistenkelige filer funnet) Mapper infisert: (Ingen mistenkelige filer funnet) Filer infisert: (Ingen mistenkelige filer funnet) Har en mistanke om at jeg har Keylogger på PCen som heter SVCINIT.EXE eller noe. Takker =D Endret 10. april 2009 av Raytee Lenke til kommentar
snippsat Skrevet 10. april 2009 Del Skrevet 10. april 2009 Kopiere fet tekst under bildet->åpne notisblokk og lim inn. Lagre på skrivebordet som CFScript.txt Gjør som på bildet combofix vil starte,Post logg c:\combofix.txt File:: c:\program files\GRT\WClient\SvcInit.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Mite"=- Lenke til kommentar
Raytee Skrevet 10. april 2009 Forfatter Del Skrevet 10. april 2009 ComboFix 09-04-04.01 - Rayte 2009-04-10 16:33:01.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3582.2930 [GMT 2:00] Kjører fra: c:\documents and settings\Rayte\Desktop\ComboFix.exe Command switches brukt :: c:\documents and settings\Rayte\Desktop\CFScript.txt.txt AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated) * Opprettet nytt gjenopprettingspunkt FILE :: c:\program files\GRT\WClient\SvcInit.exe . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\GRT\WClient\SvcInit.exe . ((((((((((((((((((((((((((( Filer Opprettet Fra 2009-03-10 til 2009-04-10 ))))))))))))))))))))))))))))))))) . 2009-04-10 13:30 . 2009-04-10 13:30 <DIR> d-------- c:\documents and settings\Rayte\Application Data\Avira 2009-04-10 13:08 . 2009-04-10 13:08 <DIR> d-------- c:\program files\Avira 2009-04-10 12:48 . 2009-04-10 13:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira 2009-04-10 11:20 . 2009-04-10 11:20 <DIR> d-------- C:\fsaua.data 2009-04-10 10:28 . 2009-04-10 10:28 <DIR> d-------- c:\documents and settings\Rayte\Application Data\Uniblue 2009-04-09 11:07 . 2009-04-09 11:07 <DIR> d-------- c:\documents and settings\LocalService\Application Data\Xfire 2009-04-08 21:58 . 2009-04-08 21:58 <DIR> d-------- c:\documents and settings\Rayte\Application Data\dyyno-vlc 2009-04-08 21:53 . 2009-04-08 21:53 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Xfire 2009-04-08 21:43 . 2009-04-09 12:12 <DIR> d-------- c:\program files\Xfire 2009-04-08 21:43 . 2009-04-10 13:59 <DIR> d-------- c:\documents and settings\Rayte\Application Data\Xfire 2009-04-08 21:41 . 2009-04-10 10:36 <DIR> d-------- c:\program files\Dyyno 2009-04-02 06:11 . 2009-04-02 06:11 <DIR> d-------- c:\program files\uTorrent 2009-04-02 06:11 . 2009-04-02 22:52 <DIR> d-------- c:\documents and settings\Rayte\Application Data\uTorrent 2009-03-27 03:28 . 2009-04-08 12:54 <DIR> d-------- c:\program files\World of Warcraft Public Test 2009-03-26 04:57 . 2009-03-26 04:57 <DIR> d-------- c:\windows\system32\LogFiles 2009-03-21 00:26 . 2009-03-21 00:26 41,808 --a------ c:\windows\system32\xfcodec.dll 2009-03-18 14:13 . 2009-03-18 14:13 754 --a------ c:\windows\WORDPAD.INI 2009-03-14 10:33 . 2009-03-14 10:33 <DIR> d-------- c:\program files\Java 2009-03-14 10:33 . 2009-03-14 10:33 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-03-12 09:39 . 2004-08-04 00:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-10 14:34 --------- d-----w c:\documents and settings\Rayte\Application Data\Skype 2009-04-10 14:07 --------- d-----w c:\documents and settings\Rayte\Application Data\skypePM 2009-04-10 11:06 --------- d-----w c:\program files\Steam 2009-04-10 08:37 --------- d-----w c:\documents and settings\Rayte\Application Data\Cedelia 2009-04-06 09:03 --------- d-----w c:\program files\Winamp Remote 2009-04-04 12:59 --------- d-----w c:\program files\World of Warcraft 2009-03-29 03:45 --------- d-----w c:\program files\PKR 2009-03-27 01:50 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-03-26 16:38 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-03-20 19:17 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania 2009-03-18 18:54 --------- d-----w c:\documents and settings\Rayte\Application Data\Ventrilo 2009-03-14 08:33 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-03-04 18:40 --------- d-----w c:\program files\TmNationsForever 2009-02-28 18:28 --------- d-----w c:\program files\PowerISO 2009-02-27 20:52 --------- d-----w c:\documents and settings\All Users\Application Data\OrbNetworks 2009-02-26 13:14 --------- d-----w c:\program files\Windows Live 2009-02-26 13:14 --------- d-----w c:\program files\Microsoft 2009-02-25 03:54 --------- d-----w c:\program files\Full Tilt Poker 2009-02-21 16:49 --------- d-----w c:\program files\Winamp 2009-02-21 16:49 --------- d-----w c:\documents and settings\Rayte\Application Data\Winamp 2009-02-21 13:13 --------- d-----w c:\program files\Guitar Pro 5 2009-02-21 12:14 --------- d-----w c:\program files\DVDVideoSoft 2009-02-21 12:14 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2009-02-21 12:14 --------- d-----w c:\program files\AskSearch 2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-02-10 18:58 --------- d-----w c:\program files\Ventrilo 2009-02-10 18:58 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll 2009-01-13 02:25 16,608 ----a-w c:\windows\gdrv.sys 2009-01-11 15:56 315,392 ----a-w c:\windows\HideWin.exe . ((((((((((((((((((((((((((((( SnapShot_2009-04-10_11.47.09,01 ))))))))))))))))))))))))))))))))))))))))) . + 2008-03-12 09:29:14 94,465 ----a-w c:\windows\system32\avsda.dll + 2008-05-09 10:15:51 45,376 ----a-w c:\windows\system32\drivers\avgntdd.sys + 2008-01-21 15:11:28 22,336 ----a-w c:\windows\system32\drivers\avgntmgr.sys + 2008-10-30 08:21:03 75,072 ----a-w c:\windows\system32\drivers\avipbb.sys + 2007-03-01 07:34:22 28,352 ----a-w c:\windows\system32\drivers\ssmdrv.sys + 2009-04-10 11:07:07 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_938.dat . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885400] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "Steam"="c:\program files\steam\steam.exe" [2009-02-07 1410296] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-28 13516800] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-28 86016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-14 148888] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-02-28 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe] c:\documents and settings\Rayte\Start Menu\Programs\Startup\ Xfire.lnk - c:\program files\Xfire\Xfire.exe [2009-03-21 3025232] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "c:\\Program Files\\GRT\\WCtrl\\WCtrl.exe"= "c:\\Program Files\\GRT\\WClient\\WClient.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\Steam\\steamapps\\spacedog650\\counter-strike\\hl.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Program Files\\World of Warcraft\\Repair.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\TmNationsForever\\TmForever.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 3\\Binaries\\UT3.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Rayte\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Xfire\\Xfire.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2009-04-10 164097] R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [2009-04-10 258305] R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2009-04-10 41217] R2 WCSvc;WCSvc;c:\program files\GRT\WClient\WCSvc.exe [2009-01-25 40960] S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [2009-01-11 47624] S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?] S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [2009-01-14 32000] --- Andre tjenester/drivere lastet i minnet --- *NewlyCreated* - ANTIVIRMAILSERVICE *NewlyCreated* - ANTIVIRSCHEDULER *NewlyCreated* - ANTIVIRSERVICE *NewlyCreated* - ANTIVIRWEBSERVICE *NewlyCreated* - AVESERVICE *NewlyCreated* - AVGIO *NewlyCreated* - AVGNTFLT *NewlyCreated* - AVIPBB *NewlyCreated* - SSMDRV [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2582cfc2-dffe-11dd-a839-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) 2009-03-30 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34] . . ------- Tilleggsskanning ------- . uStart Page = hxxp://www.sol.no/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s LSP: avsda.dll DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} - hxxp://webserver.dyyno.com/tng/dyyno-client/DyynoCAB.CAB . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-10 16:34:12 Windows 5.1.2600 Service Pack 2 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** . Tidspunkt ferdig: 2009-04-10 16:34:46 ComboFix-quarantined-files.txt 2009-04-10 14:34:44 ComboFix2.txt 2009-04-10 09:47:29 ComboFix3.txt 2009-02-07 01:50:42 Pre-Run: 334 154 371 072 bytes free Post-Run: 334,151,053,312 bytes free 183 --- E O F --- 2009-02-26 02:00:41 =D=D Lenke til kommentar
snippsat Skrevet 10. april 2009 Del Skrevet 10. april 2009 Ser bra ut. Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc. Sjekk om software er oppdatert Secunia Surf trygt. Lenke til kommentar
Raytee Skrevet 10. april 2009 Forfatter Del Skrevet 10. april 2009 Hærlig! Takk skal du ha! =D=D Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå