Poster utskilt fra veiledertråden-2

[Gjest Bruker-127711]

Atsjonas: følg guiden og legg ut loggene i en ny tråd

 

Thank you.

[markevans]

Har laga en egen tråd på dette, men poster det her også:

 

Har fått ormen P2P-Worm.Nugg!sd6 på PCen.

 

Har prøvd å fjerne det med Malwarebytes anti malware program, som bare har redusert antallet infeksjoner. Jeg får fortsatt opp viruset på PC Tools Spyware Doctor. Åssen får jeg fjerna det helt?

 

Her er loggen:

 

Malwarebytes' Anti-Malware 1.33

Databaseversjon: 1698

Windows 5.1.2600 Service Pack 2

 

27.01.2009 20:53:42

mbam-log-2009-01-27 (20-53-42).txt

 

Skanntype: Rask Skann

Objekter skannet: 61468

Tid tilbakelagt: 6 minute(s), 26 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

[r2d290]

markevans: du får ikke hjelp i denne tråden. Hold deg til din egen tråd

[Arne M]

Se her.

Takk, nå ble alt så meget bedre.

Arne M

Det ble ikke så mye bedre. Det er egentlig lurer på er den reklamen som bruker flash player. Er en på førstesiden hos Aftenposten i dag, reklame for Netcom. Hvordan fjerner man disse ???

 

Arne M

[hernil]

Du legger dem i blokkeringslista.

Endret 28. januar 2009 av hernil

[kake_fisk]

Er dette vanlig når man skal laste ned combifix?

[r2d290]

Jeg har ikke fått akurat den før, men det er kjent at forskjellige programmer kan reagere på det programmet. Kan ikke vite om combofix har gode eller dårlige hensikter. Men bare overse det, combofix blir brukt over hele verden, noe som gjør meg ganske sikker på at det er et trygt program.

[Mikkel™]

Halp! Får virus advarsler ifra helvette her :|. Har og en mappe kalt "Accessories" Som re-lager seg selv hver gang jeg sletter den (ikke Tilbehør nei. Har norsk WIN OS).

 

MBAM:

 

Malwarebytes' Anti-Malware 1.33

Databaseversjon: 1710

Windows 5.1.2600 Service Pack 3

 

31.01.2009 00:11:34

mbam-log-2009-01-31 (00-11-34).txt

 

Skanntype: Rask Skann

Objekter skannet: 46182

Tid tilbakelagt: 1 minute(s), 48 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

Combofix:

 

ComboFix 09-01-21.04 - Mikkel 2009-01-31 0:12:59.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.2047.1400 [GMT 1:00]

Kjører fra: c:\documents and settings\Mikkel\Skrivebord\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

.

- REDUCED FUNCTIONALITY MODE -

.

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-28 til 2009-01-30 )))))))))))))))))))))))))))))))))

.

 

2009-01-31 00:09 . 2009-01-31 00:09 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2009-01-31 00:09 . 2009-01-31 00:09 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\Malwarebytes

2009-01-31 00:09 . 2009-01-31 00:09 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2009-01-31 00:09 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-31 00:09 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-31 00:02 . 2009-01-31 00:02 <DIR> d-------- c:\programfiler\Microsoft Silverlight

2009-01-30 23:33 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll

2009-01-30 23:30 . 2009-01-30 23:33 <DIR> d-------- c:\windows\system32\XPSViewer

2009-01-30 23:30 . 2009-01-30 23:30 <DIR> d-------- c:\programfiler\MSBuild

2009-01-30 23:29 . 2009-01-30 23:29 <DIR> d-------- c:\windows\SxsCaPendDel

2009-01-30 23:29 . 2009-01-30 23:29 <DIR> d-------- c:\programfiler\Reference Assemblies

2009-01-30 23:29 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll

2009-01-30 23:29 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll

2009-01-30 23:29 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-01-30 23:29 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll

2009-01-30 23:29 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll

2009-01-30 23:29 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll

2009-01-30 23:29 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-01-30 23:26 . 2009-01-30 23:26 <DIR> d-------- c:\windows\LastGood

2009-01-30 23:26 . 2006-07-14 16:51 121,856 --a------ c:\windows\system32\SET33.tmp

2009-01-29 23:28 . 2009-01-29 23:28 <DIR> d-------- c:\documents and settings\LocalService\Programdata\Xfire

2009-01-27 21:01 . 2009-01-27 21:02 <DIR> d-------- c:\windows\system32\NtmsData

2009-01-27 17:23 . 2009-01-30 23:17 <DIR> d-------- c:\programfiler\Lavasoft

2009-01-27 17:23 . 2009-01-30 23:17 <DIR> d-------- c:\documents and settings\All Users\Programdata\Lavasoft

2009-01-26 16:13 . 2009-01-26 16:13 <DIR> d-------- c:\programfiler\Fellesfiler\Adobe

2009-01-26 16:12 . 2009-01-30 15:27 <DIR> d-------- c:\programfiler\NOS

2009-01-26 16:12 . 2009-01-30 15:27 <DIR> d-------- c:\documents and settings\All Users\Programdata\NOS

2009-01-26 07:37 . 2009-01-26 07:37 <DIR> d-------- c:\documents and settings\NetworkService\Programdata\Xfire

2009-01-26 07:36 . 2009-01-26 19:34 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\Xfire

2009-01-25 19:05 . 2009-01-25 19:05 <DIR> d--hs---- c:\documents and settings\Mikkel\PrivacIE

2009-01-25 01:17 . 2009-01-30 07:28 <DIR> d-------- c:\windows\ie8updates

2009-01-25 00:55 . 2008-04-14 08:22 81,920 --a------ c:\windows\system32\ieencode.dll

2009-01-25 00:55 . 2008-04-14 08:22 81,920 --a------ c:\windows\system32\dllcache\ieencode.dll

2009-01-24 20:12 . 2009-01-24 20:12 98,304 --a------ c:\windows\system32\CmdLineExt.dll

2009-01-23 02:17 . 2009-01-23 02:17 42,320 --a------ c:\windows\system32\xfcodec.dll

2009-01-22 16:06 . 2009-01-22 16:06 268 --ah----- C:\sqmdata02.sqm

2009-01-22 16:06 . 2009-01-22 16:06 244 --ah----- C:\sqmnoopt02.sqm

2009-01-21 15:57 . 2009-01-21 15:57 <DIR> d-------- c:\documents and settings\All Users\Programdata\Blizzard

2009-01-19 17:09 . 2009-01-19 17:09 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\dvdcss

2009-01-11 14:09 . 2009-01-11 14:09 <DIR> d-------- c:\windows\system32\LogFiles

2009-01-11 14:09 . 2009-01-30 19:36 202,040 --a------ c:\windows\system32\PnkBstrB.exe

2009-01-11 14:09 . 2009-01-30 19:37 137,688 --a------ c:\windows\system32\drivers\PnkBstrK.sys

2009-01-11 14:09 . 2009-01-11 14:09 66,872 --a------ c:\windows\system32\PnkBstrA.exe

2009-01-10 20:28 . 2009-01-30 23:18 <DIR> d-------- c:\programfiler\Steam

2009-01-10 00:51 . 2009-01-10 00:51 <DIR> d-------- c:\programfiler\Fellesfiler\Blizzard Entertainment

2009-01-10 00:01 . 2009-01-10 00:01 <DIR> d-------- c:\programfiler\Ventrilo

2009-01-10 00:01 . 2009-01-10 00:01 261 --a------ c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

2009-01-09 23:57 . 2009-01-10 00:01 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\Ventrilo

2009-01-08 21:23 . 2008-04-14 08:22 221,184 --a------ c:\windows\system32\wmpns.dll

2009-01-08 19:55 . 2009-01-08 19:55 <DIR> d-------- c:\programfiler\Guitar Pro 5

2009-01-07 22:28 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll

2009-01-07 22:28 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll

2009-01-07 22:28 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

2009-01-07 21:01 . 2009-01-07 21:01 <DIR> d-------- c:\documents and settings\All Users\Programdata\Azureus

2009-01-07 21:00 . 2009-01-07 21:00 <DIR> d-------- c:\programfiler\AskBarDis

2009-01-07 21:00 . 2009-01-29 07:09 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\Azureus

2009-01-07 20:59 . 2009-01-27 07:50 <DIR> d-------- c:\programfiler\Vuze

2009-01-07 20:57 . 2009-01-07 20:57 <DIR> d-------- c:\windows\Sun

2009-01-07 19:03 . 2009-01-30 23:17 <DIR> d-------- c:\documents and settings\Mikkel\Programdata\skypePM

2009-01-07 19:03 . 2009-01-07 19:03 56 --ah----- c:\windows\system32\ezsidmv.dat

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-30 22:17 --------- d-----w c:\documents and settings\Mikkel\Programdata\Skype

2009-01-24 19:02 --------- d--h--w c:\programfiler\InstallShield Installation Information

2009-01-09 23:01 --------- d-----w c:\programfiler\Fellesfiler\Wise Installation Wizard

2009-01-07 17:54 --------- d-----w c:\programfiler\Skype

2009-01-07 17:54 --------- d-----w c:\programfiler\Fellesfiler\Skype

2009-01-07 17:54 --------- d-----w c:\documents and settings\All Users\Programdata\Skype

2009-01-07 17:35 --------- d-----w c:\documents and settings\Mikkel\Programdata\Winamp

2009-01-07 17:34 --------- dcsh--w c:\programfiler\Fellesfiler\WindowsLiveInstaller

2009-01-07 17:34 --------- d-----w c:\programfiler\Windows Live

2009-01-07 17:34 --------- d-----w c:\documents and settings\Mikkel\Programdata\vlc

2009-01-07 17:32 --------- d-----w c:\documents and settings\All Users\Programdata\WLInstaller

2009-01-07 17:12 --------- d-----w c:\programfiler\Launchy

2009-01-07 17:12 --------- d-----w c:\documents and settings\Mikkel\Programdata\Launchy

2009-01-07 17:11 --------- d-----w c:\programfiler\FreeCommander

2009-01-07 17:02 --------- d-----w c:\programfiler\Avira

2009-01-07 17:00 --------- d-----w c:\programfiler\VideoLAN

2009-01-07 16:57 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-01-07 16:57 --------- d-----w c:\programfiler\Java

2009-01-07 16:53 --------- d-----w c:\programfiler\Winamp

2009-01-07 16:52 --------- d-----w c:\programfiler\Windows Desktop Search

2009-01-07 16:52 --------- d-----w c:\documents and settings\Mikkel\Programdata\Windows Desktop Search

2009-01-07 16:48 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_xusb21_01005.Wdf

2009-01-07 16:44 --------- d-----w c:\documents and settings\All Users\Programdata\LogiShrd

2009-01-07 16:43 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-01-07 16:43 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2009-01-07 16:43 --------- d-----w c:\programfiler\Logitech

2009-01-07 16:43 --------- d-----w c:\programfiler\Fellesfiler\Logishrd

2009-01-07 16:43 --------- d-----w c:\documents and settings\Mikkel\Programdata\Leadertech

2009-01-07 16:39 --------- d-----w c:\documents and settings\All Users\Programdata\Logitech

2009-01-07 16:35 --------- d-----w c:\programfiler\AGEIA Technologies

2009-01-07 16:32 --------- d-----w c:\programfiler\SystemRequirementsLab

2009-01-07 16:30 --------- d-----w c:\programfiler\ATI Technologies

2009-01-07 16:26 --------- d-----w c:\programfiler\Realtek

2009-01-07 16:26 --------- d-----w c:\programfiler\Fellesfiler\InstallShield

2009-01-07 16:19 --------- d-----w c:\programfiler\microsoft frontpage

2009-01-07 16:18 --------- d-----w c:\programfiler\Elektroniske tjenester

2009-01-07 16:17 --------- d-----w c:\programfiler\Fellesfiler\Tjenester

2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys

2008-11-12 12:45 453,152 ----a-w c:\windows\system32\NVUNINST.EXE

2008-10-23 12:43 286,720 ----a-w c:\windows\system32\SET4AE.tmp

2008-10-23 12:43 286,720 ----a-w c:\windows\system32\gdi32.dll

2008-10-17 01:03 3,593,216 ------w c:\windows\system32\SET30A.tmp

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:12 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-15 16:38 337,408 ----a-w c:\windows\system32\SET48A.tmp

2008-10-13 08:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll

2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll

2007-10-04 09:21 2,421,118 ----a-w c:\windows\inf\SET23A.tmp

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-12-09 18:40 333192 --a------ c:\programfiler\AskBarDis\bar\bin\askBar.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\programfiler\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

 

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Steam"="c:\programfiler\steam\steam.exe" [2009-01-10 1410296]

"msnmsgr"="c:\programfiler\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]

"Launch LCDMon"="c:\programfiler\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-18 1687824]

"Launch LGDCore"="c:\programfiler\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2009-01-07 136600]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 c:\windows\KHALMNPR.Exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

Launchy.lnk - c:\programfiler\Launchy\Launchy.exe [2009-01-07 286720]

SetPointII.lnk - c:\programfiler\Logitech\SetPoint II\SetpointII.exe [2007-08-30 319488]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programfiler\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.XFR1"= xfcodec.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^DualCoreCenter.lnk]

path=c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\DualCoreCenter.lnk

backup=c:\windows\pss\DualCoreCenter.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^Windows Search.lnk]

path=c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^Mikkel^Start-meny^Programmer^Oppstart^Xfire.lnk]

path=c:\documents and settings\Mikkel\Start-meny\Programmer\Oppstart\Xfire.lnk

backup=c:\windows\pss\Xfire.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 11:34 5724184 c:\programfiler\Windows Live\Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

--a------ 2008-08-04 00:02 36352 c:\programfiler\Winamp\winampa.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programfiler\\Mozilla Firefox\\firefox.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Programfiler\\Vuze\\Azureus.exe"=

"c:\\Programfiler\\Ventrilo\\Ventrilo.exe"=

"e:\\F.E.A.R\\FEAR.exe"=

"e:\\F.E.A.R\\FEARMP.exe"=

"c:\\Programfiler\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=

"e:\\Xfire\\Xfire.exe"=

"c:\\Programfiler\\Skype\\Phone\\Skype.exe"=

 

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-01-31 38496]

R4 ASKService;ASKService;c:\programfiler\AskBarDis\bar\bin\AskService.exe [2009-01-07 464264]

R4 ASKUpgrade;ASKUpgrade;c:\programfiler\AskBarDis\bar\bin\ASKUpgrade.exe [2009-01-07 234888]

S3 DualCoreCenter;DualCoreCenter;c:\programfiler\ATI Technologies\ATI.ACE\NTGLM7X.sys [2009-01-07 27136]

S3 RushTopDevice2;RushTopDevice2;c:\programfiler\ATI Technologies\ATI.ACE\RushTop.sys [2009-01-07 39424]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

 

--- Andre tjenester/drivere lastet i minnet ---

 

*NewlyCreated* - FONTCACHE3.0.0.0

*NewlyCreated* - MBAMSWISSARMY

*Deregistered* - avgio

*Deregistered* - avipbb

*Deregistered* - ssmdrv

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

 

2009-01-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\programfiler\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []

.

- - - - TOMME PEKERE FJERNET - - - -

 

MSConfigStartUp-Ad-Watch - c:\programfiler\Lavasoft\Ad-Aware\AAWTray.exe

 

 

.

------- Tilleggsskanning -------

.

uStart Page = about:blank

uInternet Connection Wizard,ShellNext = hxxp://vg.no/

FF - ProfilePath - c:\documents and settings\Mikkel\Programdata\Mozilla\Firefox\Profiles\1dzbtpza.default\

FF - plugin: c:\documents and settings\Mikkel\Programdata\Mozilla\Firefox\Profiles\1dzbtpza.default\extensions\[email protected]\plugins\npRACtrl.dll

 

---- FIREFOX POLICIES ----

c:\programfiler\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no");

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-31 00:13:07

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

Tidspunkt ferdig: 2009-01-31 0:13:48

ComboFix-quarantined-files.txt 2009-01-30 23:13:46

 

Pre-Run: 26 046 390 272 byte ledig

Post-Run: 26,256,285,696 byte ledig

 

WindowsXP-KB310994-SP2-Pro-BootDisk-NOR.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

240 --- E O F --- 2009-01-30 06:29:04

 

 

 

Sikkert ikke noe men er litt frika her

[raWrz]

lag en ny post med problemet ditt da vi ikke lenger hjelper i denne tråden

[kake_fisk]

Jeg har ikke fått akurat den før, men det er kjent at forskjellige programmer kan reagere på det programmet. Kan ikke vite om combofix har gode eller dårlige hensikter. Men bare overse det, combofix blir brukt over hele verden, noe som gjør meg ganske sikker på at det er et trygt program.

 

Men jeg får ikke lasta det ned nå, går det an å disable sikkerheten i noen minutter?

[norbat]

Jeg har ikke fått akurat den før, men det er kjent at forskjellige programmer kan reagere på det programmet. Kan ikke vite om combofix har gode eller dårlige hensikter. Men bare overse det, combofix blir brukt over hele verden, noe som gjør meg ganske sikker på at det er et trygt program.

 

Men jeg får ikke lasta det ned nå, går det an å disable sikkerheten i noen minutter?

 

Ja

[pxK]

Hvordan funker trådet atm nå?

 

Poster man bare hijack log for å sjekke om det er noe så lage sin egen tråd om problemet?

 

Paranoid som jeg da er så vil bare sjekke om det er noe i min system.

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:30:54, on 31.01.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe

C:\Program Files (x86)\AVG\AVG8\avgtray.exe

C:\Windows\SysWOW64\Ctxfihlp.exe

C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Windows\SysWOW64\CTXFISPI.EXE

C:\Program Files\Logitech\SetPoint\LU\LogitechUpdate.exe

C:\Program Files\Logitech\SetPoint\LU\LogitechUpdate.exe

E:\Spill\Steam\Steam.exe

C:\Windows\SysWOW64\conime.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe

C:\Program Files (x86)\Spotify\spotify.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~2\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [AsioThk32Reg] REGSVR32.EXE /S CTASIO.DLL

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe" /r

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

 

--

End of file - 7533 bytes

 

 

[x871kx6167ss7]

Hei. Ser på statestikk over nettverket. Og fra broren min sin PC er det mye trafikk på porten 1522. Han har hatt problemer med virus ol. tidligere. Har ikke funnet noe spesielt ved hjelp av google. Han sier at han bare bruker msn + wow.

 

Hvordan kan jeg undersøke hva dette er for noe? Gatewayen kjører OpenBSD og maskinen hans XP.

[raWrz]

@ pxK: lag en egen tråd om problemet ditt

 

@ Blackslash: du kan vel egentlig gjøre det samme da blir all hjelp osv my mer oversiktlig

[pxK]

Har ikke akkurat noe problem, men bare om noen gidder å sjekke loggen.

 

Må man lage egen tråd for det og?

[norbat]

pxK:

Vi har bestemt at man skal opprette en egen tråd da denne tråden ikke er for support. Håper du synes det ikke er for mye forlangt

 

Opprett egen tråd, så skal du straks få tilbakemelding

[pxK]

Hehe, den er grei

[Teds]

Uten å virke desperat, men håper gjerne noen av dere eksperter kunne kikket innom denne tråden og hjulpet meg utover kvelden: https://www.diskusjon.no/index.php?showtopi...0#entry13012696

 

På forhånd takk!

[norbat]

Uten å virke desperat, men håper gjerne noen av dere eksperter kunne kikket innom denne tråden og hjulpet meg utover kvelden: https://www.diskusjon.no/index.php?showtopi...0#entry13012696

 

På forhånd takk!

 

Det skal vi selvfølgelig gjøre

[Pizzaen]

Hei Siden det er flere og flere som går over til 64bits systemer så tror jeg det hadde vært lurt og finne et alternativt program til Combofix siden Combofix ikke funker i 64bits systemer og lage en guide til som er skrevet for de som bruker 64bits systemer. Bare en tanke...

Endret 6. februar 2009 av Pizzaen