Hjelp til å se igjenom logg

[McDuck81]

hei, har kjørt Malwarebytes Anti-Malware og Combofix på en bærbarpc, kan noen her være så snill å hjelpe meg med å se igjenom loggene, maskina er veldig treg, reagerer ikke på noe, virker som det er et virus inne på den

 

Malwarebytes' Anti-Malware 1.44

Databaseversjon: 3510

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

06.03.2010 14:09:03

mbam-log-2010-03-06 (14-09-03).txt

 

Skanntype: Rask Skann

Objekter skannet: 115590

Tid tilbakelagt: 6 minute(s), 17 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

ComboFix 10-03-05.03 - Kine 06.03.2010 14:16:06.1.1 - FAT32x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.47.1044.18.1023.564 [GMT 1:00]

Kjører fra: G:\ComboFix.exe

AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

FW: Norman Security Suite *enabled* {83B29CE9-9DE2-2CB5-9AB3-780D70FF12B0}

 

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

.

 

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\All Users\Programdata\hpe13.dll

c:\windows\system32\Settings

c:\windows\system32\Settings\Settings.ini

 

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2010-02-06 til 2010-03-06 )))))))))))))))))))))))))))))))))

.

 

2010-03-06 13:02 . 2010-03-06 13:02 -------- d-----w- c:\documents and settings\Kine\Programdata\Malwarebytes

2010-03-06 13:02 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-06 13:02 . 2010-03-06 13:02 -------- d-----w- c:\documents and settings\All Users\Programdata\Malwarebytes

2010-03-06 13:02 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-06 13:02 . 2010-03-06 13:02 -------- d-----w- c:\programfiler\Malwarebytes' Anti-Malware

2010-03-06 12:19 . 2010-03-06 12:19 -------- d--h--r- c:\documents and settings\Kine\Siste

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-09 06:13 . 2004-10-18 15:23 88840 ----a-w- c:\windows\system32\perfc014.dat

2009-12-09 06:13 . 2004-10-18 15:23 465682 ----a-w- c:\windows\system32\perfh014.dat

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"updateMgr"="c:\programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"Sony Ericsson PC Suite"="c:\programfiler\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]

"OM2_Monitor"="c:\programfiler\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-04-17 95536]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HControl"="c:\windows\ATK0100\HControl.exe" [2006-08-10 110592]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-23 7286784]

"nwiz"="nwiz.exe" [2005-09-23 1519616]

"RTHDCPL"="RTHDCPL.EXE" [2005-09-06 14850560]

"SynTPLpr"="c:\programfiler\Synaptics\SynTP\SynTPLpr.exe" [2004-12-21 98394]

"SynTPEnh"="c:\programfiler\Synaptics\SynTP\SynTPEnh.exe" [2004-12-21 688218]

"ASUS Live Update"="c:\programfiler\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]

"NB Probe"="c:\programfiler\ASUS\NB Probe\NBProbe.exe" [2005-07-27 765952]

"Power_Gear"="c:\programfiler\ASUS\Power4 Gear\BatteryLife.exe" [2005-06-16 86016]

"Wireless Console"="c:\programfiler\ASUS\Wireless Console\wcourier.exe" [2005-07-22 57344]

"IntelZeroConfig"="c:\programfiler\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-01 802816]

"IntelWireless"="c:\programfiler\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-01 696320]

"REGSHAVE"="c:\programfiler\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"LogMeIn GUI"="c:\programfiler\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]

"Norman ZANDA"="c:\programfiler\Norman\Npm\Bin\ZLH.EXE" [2009-11-24 189824]

"iTunesHelper"="c:\programfiler\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"OM2_Monitor"="c:\programfiler\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-04-17 54576]

"SweetIM"="c:\programfiler\SweetIM\Messenger\SweetIM.exe" [2009-08-26 111928]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

ASUS ChkMail.lnk - c:\programfiler\ASUS\Asus ChkMail\ChkMail.exe [2008-7-7 32768]

ExifLauncher2.lnk - c:\programfiler\FinePixViewer\QuickDCF2.exe [2008-7-7 303104]

Adobe Reader Speed Launch.lnk - c:\programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programfiler\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2009-10-03 11:46 87352 ----a-w- c:\windows\system32\LMIinit.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\LimeWire\\LimeWire.exe"=

"c:\\Programfiler\\Messenger\\msmsgs.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"c:\\Programfiler\\iTunes\\iTunes.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Windows Live\\Sync\\WindowsLiveSync.exe"=

 

R0 NDIS_RD;Norman Firewall NDIS driver;c:\windows\system32\drivers\ndis_rd.sys [06.12.2008 19:22 82072]

R0 R592;R592;c:\windows\system32\drivers\R592.sys [07.07.2008 16:51 57088]

R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [07.07.2008 16:51 27264]

R1 NGS;Norman General Security Driver;c:\programfiler\Norman\Ngs\Bin\ngs.sys [27.02.2009 21:24 25032]

R1 NPROSEC;Norman Security driver;c:\programfiler\Norman\Ngs\Bin\nprosec.sys [06.12.2008 19:22 61512]

R1 TDI_RD;Norman Firewall TDI driver;c:\windows\system32\drivers\tdi_rd.sys [06.12.2008 19:22 76944]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18.03.2009 20:17 54752]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\programfiler\LogMeIn\x86\rainfo.sys [24.07.2008 18:46 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [06.12.2008 18:41 47640]

R2 Ndiskio;Ndiskio;c:\programfiler\Norman\Nse\Bin\Ndiskio.sys [16.10.2009 07:27 24168]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [15.11.2009 15:31 27632]

R3 SynMini;USB2.0 1.3M Web Cam;c:\windows\system32\drivers\SynMini.sys [07.07.2008 17:26 720438]

R3 SynScan;USB2.0 1.3M Web Cam Still Image;c:\windows\system32\drivers\SynScan.sys [07.07.2008 17:26 8246]

S3 fsssvc;Windows Live Tryggere for familien-tjenesten;c:\programfiler\Windows Live\Family Safety\fsssvc.exe [05.08.2009 22:48 704864]

S3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [06.12.2008 19:22 21832]

S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [28.07.2009 23:47 89256]

S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [28.07.2009 23:47 15016]

S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [28.07.2009 23:47 120744]

S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [28.07.2009 23:47 114216]

S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [28.07.2009 23:47 25512]

S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [28.07.2009 23:47 110632]

S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [28.07.2009 23:47 115752]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

 

2009-12-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programfiler\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.startsiden.no/

uInternet Settings,ProxyOverride = *.local

.

- - - - TOMME PEKERE FJERNET - - - -

 

URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

HKCU-Run-MsnMsgr - ~c:\programfiler\Windows Live\Messenger\msnmsgr.exe

AddRemove-CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10431966 - c:\programfiler\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10431966\HXFSETUP.EXE -U -IHDAUDIO\FUNC_02&VEN_14F1&DEV_2BFA&SUBSYS_10431966

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-06 14:21

Windows 5.1.2600 Service Pack 3 FAT NTAPI

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MsnMsgr = ~"c:\programfiler\Windows Live\Messenger\msnmsgr.exe" /background?

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'winlogon.exe'(912)

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

.

Tidspunkt ferdig: 2010-03-06 14:22:53

ComboFix-quarantined-files.txt 2010-03-06 13:22

 

Pre-Run: 61 888 921 600 byte ledig

Post-Run: 62 101 422 080 byte ledig

 

- - End Of File - - 80057D53D2D8CCF97AC397A7CBDB6E7F

[norbat]

Loggen ser grei ut.

 

Er det noen prosesser som bruker mye cpu?

Høyreklikk på oppgavelinja og velg Oppgavebehandling.

Under arkfanen Prosesser vil du få oversikt om det er noen prosesser som bruker mye cpu. Hvilke?

[McDuck81]

zanda.exe, nprosec.exe, zlh.exe, er de som går igjen, har prøvd å avslutte de, men det hjelper ikke

[norbat]

Alle de prosessene tilhører Norman. Mitt forslag er at du avinstallerer Norman. Hvis pc'n kjører bedre, så finnes det andre alternativer til antivirusprogam.

[McDuck81]

ok, da skal jeg prøve det, om det ikke virker så må jeg nok formatere her takk for hjelpen

[snippsat]

Avinstallere norman som foreslått,for og se om den skaper problemer.

Avira er bra og bruker minst resusser av de gratise antivirusene.

 

Rydd opp litt CCleaner - Defraggler

[McDuck81]

kan noen her forklare meg litt hva jeg må slette i registret for å bli kvitt norman, har kjørt delnvc.exe men det hjelper ikke stort, mappen norman ligger inne på pc'n enda også

[norbat]

Kanskje det bare er mappa som ligger igjen?

Post gjerne en ny combofix-logg.

[McDuck81]

prøver meg med Security Application Remvoal Tool nå, så far jeg se om den hjelper, legger ut en ny combofix-logg etter hvert