norbat Skrevet 21. august 2010 Del Skrevet 21. august 2010 (endret) Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt. Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Post loggen. Folder:: c:\documents and settings\Administrator\Lokale innstillinger\Programdata\flybhbbcc c:\documents and settings\Administrator\Lokale innstillinger\Programdata\qxwbhrnrl rootkit:: kfzni.sys file:: c:\windows\system32\drivers\kfzni.sys SRPeek:: c:\windows\system32\winlogon.exe c:\windows\explorer.exe c:\windows\system32\drivers\ndis.sys Hvis du får spm. om å installere gjenopprettingskonsollen, sier du ja. Endret 21. august 2010 av norbat Lenke til kommentar
T.O.E Skrevet 21. august 2010 Forfatter Del Skrevet 21. august 2010 i sikkerhetsmodus? Lenke til kommentar
norbat Skrevet 21. august 2010 Del Skrevet 21. august 2010 Kan godt kjøre fra sikker modus hvis det er probl. å få logg fra normal modus. Lenke til kommentar
T.O.E Skrevet 21. august 2010 Forfatter Del Skrevet 21. august 2010 Funka bare i sikkerhetsmodus dette og. Loggen: ComboFix 10-08-21.01 - Administrator 08/22/2010 0:23.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.47.1044.18.1976.1485 [GMT 2:00] Kjører fra: c:\documents and settings\Administrator\Skrivebord\ComboFix.exe Command switches brukt :: c:\documents and settings\Administrator\Skrivebord\CFScript.txt..txt AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {2045E3EF-E5E7-488B-AC43-2B179BB14050} AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {C24317C3-EF42-4BD3-B9F6-926FE54E7D8D} FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6} FILE :: "c:\windows\system32\drivers\kfzni.sys" . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Lokale innstillinger\Programdata\flybhbbcc c:\documents and settings\Administrator\Lokale innstillinger\Programdata\qxwbhrnrl c:\windows\system32\drivers\kfzni.sys c:\windows\system32\winlogon.exe . . . er infisert!! c:\windows\explorer.exe . . . er infisert!! c:\windows\system32\drivers\ndis.sys . . . er infisert!! . ((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_kfzni -------\Service_kfzni ((((((((((((((((((((((((((( Filer Opprettet Fra 2010-07-21 til 2010-08-21 ))))))))))))))))))))))))))))))))) . 2010-08-21 16:25 . 2010-08-21 16:25 0 ----a-w- c:\windows\nsreg.dat 2010-08-21 16:25 . 2010-08-21 16:25 -------- d-----w- c:\documents and settings\Administrator\Lokale innstillinger\Programdata\Mozilla 2010-08-21 13:26 . 2010-08-21 16:04 -------- d-----w- c:\documents and settings\All Users\Programdata\Spybot - Search & Destroy 2010-08-21 12:24 . 2010-08-21 12:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2010-08-21 08:08 . 2010-08-21 08:08 -------- d-----w- c:\documents and settings\Administrator\Programdata\Malwarebytes 2010-08-21 08:08 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-21 08:07 . 2010-08-21 08:07 -------- d-----w- c:\documents and settings\All Users\Programdata\Malwarebytes 2010-08-21 08:07 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-21 08:07 . 2010-08-21 08:08 -------- d-----w- c:\programfiler\Malwarebytes' Anti-Malware 2010-08-20 21:53 . 2010-08-20 21:53 -------- d--h--w- c:\documents and settings\1505hvmo\InstallAnywhere 2010-08-20 21:50 . 2010-08-20 21:51 -------- d-----w- c:\documents and settings\1505hvmo\Programdata\BitTorrent 2010-08-20 19:52 . 2010-08-20 19:52 -------- d-----w- c:\windows\system32\wbem\Repository 2010-08-20 12:19 . 2010-08-20 12:19 -------- d-----w- c:\documents and settings\Administrator\Lokale innstillinger\Programdata\PCHealth 2010-08-19 13:18 . 2010-08-19 13:18 -------- d-----w- c:\documents and settings\1505hvmo\Programdata\Sports Interactive 2010-08-07 19:18 . 2010-08-07 19:18 -------- d--h--w- c:\windows\PIF 2010-08-05 20:39 . 2010-08-05 20:39 503808 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5df9c3ab-n\msvcp71.dll 2010-08-05 20:39 . 2010-08-05 20:39 499712 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5df9c3ab-n\jmc.dll 2010-08-05 20:39 . 2010-08-05 20:39 348160 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5df9c3ab-n\msvcr71.dll 2010-08-05 20:39 . 2010-08-05 20:39 61440 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4ea596b7-n\decora-sse.dll 2010-08-05 20:39 . 2010-08-05 20:39 12800 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4ea596b7-n\decora-d3d.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-21 22:35 . 2010-07-18 19:51 -------- d-----w- c:\documents and settings\Administrator\Programdata\LimeWire 2010-08-21 22:32 . 2009-11-04 15:16 -------- d-----w- c:\programfiler\LanSchool 2010-08-21 22:06 . 2010-06-15 23:56 -------- d-----w- c:\documents and settings\Administrator\Programdata\Spotify 2010-08-21 21:04 . 2010-06-16 20:28 -------- d-----w- c:\programfiler\DesktopEarth 2010-08-21 20:12 . 2010-06-16 21:03 -------- d-----w- c:\documents and settings\Administrator\Programdata\vlc 2010-08-21 19:36 . 2010-06-16 17:38 -------- d-----w- c:\documents and settings\Administrator\Programdata\BitTorrent 2010-08-21 12:43 . 2010-07-01 18:51 -------- d-----w- c:\documents and settings\Administrator\Programdata\Skype 2010-08-21 12:17 . 2010-07-01 18:52 -------- d-----w- c:\documents and settings\Administrator\Programdata\skypePM 2010-08-20 22:09 . 2009-06-12 12:49 -------- d--h--w- c:\programfiler\InstallShield Installation Information 2010-08-20 21:57 . 2010-06-03 09:39 -------- d-----w- c:\documents and settings\1505hvmo\Programdata\Skype 2010-08-20 20:04 . 2010-06-03 10:14 -------- d-----w- c:\documents and settings\1505hvmo\Programdata\skypePM 2010-08-20 19:27 . 2008-08-03 12:01 210816 ----a-w- c:\windows\system32\drivers\ndis.sys 2010-08-14 08:01 . 2009-06-12 12:13 -------- d-----w- c:\programfiler\Microsoft Silverlight 2010-07-28 10:43 . 2010-06-16 20:28 29926 ----a-r- c:\documents and settings\Administrator\Programdata\Microsoft\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_CE4FFA1DD37E7C505AED29.exe 2010-07-28 10:43 . 2010-06-16 20:28 29926 ----a-r- c:\documents and settings\Administrator\Programdata\Microsoft\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_C1A9BF9D98647632ED5172.exe 2010-07-28 10:43 . 2010-06-16 20:28 29926 ----a-r- c:\documents and settings\Administrator\Programdata\Microsoft\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_6FEFF9B68218417F98F549.exe 2010-07-27 11:04 . 2008-08-03 12:02 84518 ----a-w- c:\windows\system32\perfc014.dat 2010-07-27 11:04 . 2008-08-03 12:02 457746 ----a-w- c:\windows\system32\perfh014.dat 2010-07-21 14:07 . 2010-07-21 14:07 -------- d-----w- c:\programfiler\Fellesfiler\Apple 2010-07-21 14:07 . 2010-07-21 14:07 -------- d-----w- c:\programfiler\QuickTime 2010-07-21 14:06 . 2010-07-21 14:06 -------- d-----w- c:\documents and settings\All Users\Programdata\Apple Computer 2010-07-16 16:23 . 2010-07-16 16:23 -------- d-----w- c:\documents and settings\Administrator\Programdata\Apple Computer 2010-07-06 09:04 . 2010-07-06 09:04 61232 ----a-w- c:\windows\system32\lskhook64.dll 2010-07-06 09:04 . 2010-07-06 09:04 75056 ----a-w- c:\windows\system32\lskhook.dll 2010-07-05 18:51 . 2010-07-05 18:51 -------- d-----w- c:\programfiler\Apple Software Update 2010-07-05 18:51 . 2010-07-05 18:51 -------- d-----w- c:\documents and settings\All Users\Programdata\Apple 2010-07-01 18:52 . 2010-07-01 18:52 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-07-01 18:51 . 2010-07-01 18:51 -------- d-----r- c:\programfiler\Skype 2010-07-01 18:51 . 2010-07-01 18:51 -------- d-----w- c:\programfiler\Fellesfiler\Skype 2010-07-01 18:50 . 2010-06-03 09:39 -------- d-----w- c:\documents and settings\All Users\Programdata\Skype 2010-06-30 10:51 . 2010-06-30 10:51 371272 ----a-r- c:\documents and settings\1505hvmo\Programdata\Microsoft\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe 2010-06-27 15:56 . 2010-06-15 21:20 -------- d-----w- c:\programfiler\Opera 2010-06-16 19:01 . 2010-06-16 19:01 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-06-15 23:56 . 2010-06-15 23:56 655360 ----a-w- c:\documents and settings\Administrator\Programdata\Spotify\Gracenote\gnsdk_sdkmanager.dll 2010-06-15 23:56 . 2010-06-15 23:56 282624 ----a-w- c:\documents and settings\Administrator\Programdata\Spotify\Gracenote\gnsdk_musicid_file.dll 2010-06-15 23:56 . 2010-06-15 23:56 208896 ----a-w- c:\documents and settings\Administrator\Programdata\Spotify\Gracenote\gnsdk_dsp.dll 2010-06-15 20:55 . 2010-06-15 20:55 503808 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f75a956-n\msvcp71.dll 2010-06-15 20:55 . 2010-06-15 20:55 499712 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f75a956-n\jmc.dll 2010-06-15 20:55 . 2010-06-15 20:55 348160 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f75a956-n\msvcr71.dll 2010-06-15 20:54 . 2010-06-15 20:54 61440 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7329539c-n\decora-sse.dll 2010-06-15 20:54 . 2010-06-15 20:54 12800 ----a-w- c:\documents and settings\Administrator\Programdata\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7329539c-n\decora-d3d.dll 2010-06-15 20:48 . 2010-06-15 20:48 85176 ----a-w- c:\documents and settings\Administrator\Lokale innstillinger\Programdata\GDIPFONTCACHEV1.DAT 2010-06-10 16:46 . 2010-06-10 16:46 153600 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\cache\6.0\39\1d7a9127-66ffc9b9-n\lwjgl.dll 2010-06-07 20:47 . 2010-06-07 20:46 87 ----a-w- c:\documents and settings\1505hvmo\jagex_runescape_preferences2.dat 2010-06-07 20:46 . 2010-06-07 20:45 42 ----a-w- c:\documents and settings\1505hvmo\jagex_runescape_preferences.dat 2010-06-07 20:46 . 2010-06-07 20:46 0 ----a-w- c:\documents and settings\1505hvmo\jagex__preferences3.dat 2010-05-31 07:34 . 2010-05-31 07:34 503808 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-20880a3a-n\msvcp71.dll 2010-05-31 07:34 . 2010-05-31 07:34 499712 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-20880a3a-n\jmc.dll 2010-05-31 07:34 . 2010-05-31 07:34 348160 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-20880a3a-n\msvcr71.dll 2010-05-31 07:34 . 2010-05-31 07:34 61440 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-73a6983d-n\decora-sse.dll 2010-05-31 07:34 . 2010-05-31 07:34 12800 ----a-w- c:\documents and settings\1505hvmo\Programdata\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-73a6983d-n\decora-d3d.dll 2009-06-01 17:19 . 2009-06-01 17:19 6253 ----a-w- c:\programfiler\eula.rtf . (((((((((((((((((((((((((((((((((((((((((( SR_Search )))))))))))))))))))))))))))))))))))))))))))))))))))))))) c:\windows\system32\dllcache\explorer.exe [x] [-] A67E9F4D1702203DEAA4B1A0ED2A792C 1033728 \RP4\A0003083.exe c:\windows\system32\dllcache\winlogon.exe [x] [-] AEF02169B75C963E95040A26944E22BD 506880 \RP4\A0000450.exe . ------- Sigcheck ------- [-] 2010-08-20 19:27 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [------] . . c:\windows\system32\drivers\ndis.sys [-] 2010-08-20 19:27 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [------] . . c:\windows\system32\dllcache\ndis.sys [-] 2008-04-15 . 68EF5586A73B55BBA6CFC92FE1E33B36 . 506880 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe [-] 2008-04-15 . A67E9F4D1702203DEAA4B1A0ED2A792C . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe . ((((((((((((((((((((((((((((( SnapShot@2010-08-21_21.04.29 ))))))))))))))))))))))))))))))))))))))))) . + 2010-08-21 22:20 . 2010-08-21 22:20 16384 c:\windows\Temp\Perflib_Perfdata_338.dat + 2010-08-21 22:32 . 2010-08-21 22:32 16384 c:\windows\Temp\Perflib_Perfdata_248.dat - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Swedish.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Swedish.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Spanish.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Spanish.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\PortugueseBrazilian.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\PortugueseBrazilian.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut8_57F014000F314BE984FA68DAF3EDB629.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut8_57F014000F314BE984FA68DAF3EDB629.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut4_57F014000F314BE984FA68DAF3EDB629.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut4_57F014000F314BE984FA68DAF3EDB629.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut2_57F014000F314BE984FA68DAF3EDB629.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut2_57F014000F314BE984FA68DAF3EDB629.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut2_01B928542FD2483DBC92A5C3611FBF0F.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut2_01B928542FD2483DBC92A5C3611FBF0F.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut1_57F014000F314BE984FA68DAF3EDB629.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut1_57F014000F314BE984FA68DAF3EDB629.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut1.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut1.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Japanese.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Japanese.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Italian.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Italian.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\FrenchCanadian.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\FrenchCanadian.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\English.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\English.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudioDesktop.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudioDesktop.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudio_German_47E8DEFABB1544659378F993E9E0CF41.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudio_German_47E8DEFABB1544659378F993E9E0CF41.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudio.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\DataStudio.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Danish.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Danish.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Chinese.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Chinese.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\ARPPRODUCTICON.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\ARPPRODUCTICON.exe - 2009-11-05 11:23 . 2009-11-05 11:23 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Arabic.exe + 2009-11-05 11:23 . 2010-08-21 22:34 40960 c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\Arabic.exe . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\programfiler\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="c:\programfiler\Trend Micro\OfficeScan Client\pccntmon.exe" [2009-04-16 746792] "WatchDog"="c:\programfiler\InterVideo\DVD Check\DVDCheck.exe" [2008-05-23 197904] c:\documents and settings\Administrator\Start-meny\Programmer\Oppstart\ DesktopEarth AutoStart.lnk - c:\documents and settings\Administrator\Programdata\Microsoft\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_C1A9BF9D98647632ED5172.exe [2010-6-16 29926] LimeWire On Startup.lnk - c:\programfiler\LimeWire\LimeWire.exe [2010-7-8 503808] c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\ DVD Check.lnk - c:\programfiler\InterVideo\DVD Check\DVDCheck.exe [2009-6-12 197904] PASPortal.lnk - c:\windows\Installer\{7AC82557-3E93-4896-83E0-6BCC1A869F98}\NewShortcut1.exe [2009-11-5 40960] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "CompatibleRUPSecurity"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au] "NoAutoUpdate"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{763370C4-268E-4308-A60C-D8DA0342BE32}"= "c:\programfiler\Novell\ZENworks\bin\NalShell.dll" [2009-12-11 929792] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 14:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 14:08 281088 ----a-w- c:\programfiler\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LCredMgr] 2009-06-24 17:58 61440 ----a-w- c:\programfiler\Novell\CASA\bin\lcredmgr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nzrNotifier] 2009-11-20 06:36 57344 ----a-w- c:\windows\system32\nzrNotifier.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1584278910-2727298251-198245966-46329\Scripts\Logon\0\0] "Script"=logon.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1584278910-2727298251-198245966-5694\Scripts\Logon\0\0] "Script"=logon.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1584278910-2727298251-198245966-87039\Scripts\Logon\0\0] "Script"=logon.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-961192664-1044802044-2078469417-43630\Scripts\Logon\0\0] "Script"=logon.bat [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\LanSchoolStudent] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programfiler\\LanSchool\\student.exe"= "c:\\Programfiler\\BitTorrent\\bittorrent.exe"= "c:\\Programfiler\\Spotify\\spotify.exe"= "c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7628:TCP"= 7628:TCP:ZENworks TCP - Port 7628 "7628:UDP"= 7628:UDP:ZENworks UDP - Port 7628 "63287:TCP"= 63287:TCP:Trend Micro OfficeScan Listener R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [8/18/2009 10:31 AM 24064] R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [8/3/2008 2:12 PM 10880] R2 accoca;ActivClient Middleware Service;c:\programfiler\ActivIdentity\ActivClient\accoca.exe [5/15/2007 4:08 PM 182576] R2 LanSchoolStudent;LanSchool Student Service;c:\programfiler\LanSchool\student.exe [7/6/2010 11:05 AM 1054000] R2 Novell Identity Store;Novell Identity Store;c:\programfiler\Novell\CASA\bin\micasad.exe [6/24/2009 7:58 PM 245760] R2 Novell ZENworks Agent Service;Novell ZENworks Agent Service;c:\programfiler\Novell\ZENworks\bin\ZenworksWindowsService.exe [11/26/2009 12:45 PM 28672] R2 nzwinvnc;Novell ZENworks Remote Management powered by VNC;c:\programfiler\Novell\ZENworks\bin\nzrWinVNC.exe -service --> c:\programfiler\Novell\ZENworks\bin\nzrWinVNC.exe -service [?] R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [8/17/2009 12:26 PM 50192] R2 TmFilter;Trend Micro Filter;c:\programfiler\Trend Micro\OfficeScan Client\TmXPFlt.sys [5/22/2009 1:02 AM 225296] R2 TmPreFilter;Trend Micro PreFilter;c:\programfiler\Trend Micro\OfficeScan Client\tmpreflt.sys [5/22/2009 1:00 AM 36368] R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [8/13/2009 5:31 PM 9176] R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [4/7/2009 1:50 PM 31896] R3 tmcfw;tmcfw;c:\windows\system32\drivers\TM_CFW.sys [2/23/2009 12:32 PM 338960] R3 TmPfw;OfficeScan NT Firewall;c:\programfiler\Trend Micro\OfficeScan Client\TmPfw.exe [2/23/2009 12:32 PM 488768] S2 gupdate1c9ec307e332d60;Googles oppdateringstjeneste (gupdate1c9ec307e332d60);c:\programfiler\Google\Update\GoogleUpdate.exe [6/13/2009 4:08 PM 133104] S3 Com4QLBEx;Com4QLBEx;c:\programfiler\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [8/18/2009 12:57 PM 193840] S3 RoxMediaDB10;RoxMediaDB10;c:\programfiler\Fellesfiler\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [4/8/2008 2:12 PM 1112560] S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [6/21/2007 4:40 AM 56448] S3 TmProxy;OfficeScan NT Proxy Service;c:\programfiler\Trend Micro\OfficeScan Client\TmProxy.exe [2/23/2009 12:31 PM 652552] S3 ZENPreAgent;Novell ZENworks Pre Agent;c:\windows\novell\zenworks\bin\ZENPreAgent.exe [8/13/2009 5:28 PM 188416] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/16/2010 9:01 PM 691696] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-06-20 10:47 451872 ----a-w- c:\programfiler\Fellesfiler\LightScribe\LSRunOnce.exe . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) 2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\programfiler\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2010-08-21 c:\windows\Tasks\Google Software Updater.job - c:\programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-13 14:08] 2010-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programfiler\Google\Update\GoogleUpdate.exe [2009-06-13 14:08] 2010-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programfiler\Google\Update\GoogleUpdate.exe [2009-06-13 14:08] 2010-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-866411099-3860770546-1621290543-500Core.job - c:\documents and settings\Administrator\Lokale innstillinger\Programdata\Google\Update\GoogleUpdate.exe [2010-06-19 17:02] 2010-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-866411099-3860770546-1621290543-500UA.job - c:\documents and settings\Administrator\Lokale innstillinger\Programdata\Google\Update\GoogleUpdate.exe [2010-06-19 17:02] 2010-08-21 c:\windows\Tasks\User_Feed_Synchronization-{A0CCED10-2886-49BC-A483-EB00AF7419B3}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Tilleggsskanning ------- . uStart Page = hxxp://svgs.vfk.no mStart Page = hxxp://svgs.vfk.no uInternet Settings,ProxyOverride = <local> uInternet Settings,ProxyServer = http=127.0.0.1:6522 IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} DPF: DirectEdit - hxxps://vfk.itslearning.com/file/DirectEdit.CAB FF - ProfilePath - c:\documents and settings\Administrator\Programdata\Mozilla\Firefox\Profiles\ppmrok2n.default\ FF - plugin: c:\documents and settings\Administrator\Lokale innstillinger\Programdata\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\programfiler\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\programfiler\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\programfiler\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\programfiler\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programfiler\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programfiler\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programfiler\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programfiler\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no"); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-22 00:32 Windows 5.1.2600 Service Pack 3 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... skanning vellykket skjulte filer: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe >>UNKNOWN [0x89CE90E0]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf754bf28 \Driver\ACPI -> ACPI.sys @ 0xf735ecb8 \Driver\atapi -> atapi.sys @ 0xf7211852 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8 NDIS: Intel® WiFi Link 5100 AGN -> SendCompleteHandler -> NDIS.sys @ 0x89cd0bb0 PacketIndicateHandler -> NDIS.sys @ 0x89cdda21 SendHandler -> NDIS.sys @ 0x89cbb87b user & kernel MBR OK ************************************************************************** . --------------------- LÅSTE REGISTERNØKLER --------------------- [HKEY_USERS\S-1-5-21-866411099-3860770546-1621290543-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ce,34,9f,d2,40,f3,35,46,bd,c6,e1,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ce,34,9f,d2,40,f3,35,46,bd,c6,e1,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLL'er Lastet Av Kjørende Prosesser --------------------- - - - - - - - > 'winlogon.exe'(1148) c:\windows\system32\ZENPol.dll c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\programfiler\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\programfiler\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\msi.dll c:\windows\system32\nzrNotifier.dll c:\programfiler\Novell\ZENworks\bin\nzrLogger.dll c:\programfiler\Novell\ZENworks\bin\modules\RemotingService.dll c:\programfiler\Novell\ZENworks\bin\zmd.dll c:\programfiler\Novell\ZENworks\bin\Novell.Zenworks.Logger.dll c:\programfiler\Novell\ZENworks\bin\Novell.Zenworks.extlogger.dll c:\programfiler\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\programfiler\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\programfiler\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\programfiler\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll - - - - - - - > 'explorer.exe'(4512) c:\windows\system32\msi.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Andre Kjørende Prosesser ------------------------ . c:\windows\System32\SCardSvr.exe c:\programfiler\Novell\ZENworks\bin\TSUsage32.exe c:\windows\system32\agrsmsvc.exe c:\programfiler\Fellesfiler\InterVideo\RegMgr\iviRegMgr.exe c:\programfiler\Java\jre6\bin\jqs.exe c:\programfiler\Fellesfiler\LightScribe\LSSrvc.exe c:\programfiler\ActivIdentity\ActivClient\acevents.exe c:\programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\mdm.exe c:\programfiler\Trend Micro\OfficeScan Client\ntrtscan.exe c:\programfiler\Novell\ZENworks\bin\nzrWinVNC.exe c:\programfiler\Trend Micro\OfficeScan Client\tmlisten.exe c:\windows\system32\wbem\wmiapsrv.exe c:\programfiler\Trend Micro\OfficeScan Client\CNTAoSMgr.exe c:\programfiler\Trend Micro\BM\TMBMSRV.exe c:\windows\system32\msiexec.exe c:\programfiler\DataStudio\PASPortal.exe c:\programfiler\DesktopEarth\DesktopEarth.exe . ************************************************************************** . Tidspunkt ferdig: 2010-08-22 00:36:48 - maskinen ble startet på nytt ComboFix-quarantined-files.txt 2010-08-21 22:36 ComboFix2.txt 2010-08-21 21:07 Pre-Run: 18,111,029,248 byte ledig Post-Run: 18,094,903,296 byte ledig - - End Of File - - AEF3A2925020DDF7214965498CCAE86F Lenke til kommentar
T.O.E Skrevet 22. august 2010 Forfatter Del Skrevet 22. august 2010 (endret) Ser det bra ut? Malwarebytes-scannen finner fremdeles de to Rootkit.Agent filene i C:\WINDOWS\system32\Drivers\ntndis.sys og C:\WINDOWS\system32\ipsecndis.sys Endret 22. august 2010 av T.O.E Lenke til kommentar
norbat Skrevet 28. august 2010 Del Skrevet 28. august 2010 Beklager sein respons. Post nye logger. Lenke til kommentar
T.O.E Skrevet 30. august 2010 Forfatter Del Skrevet 30. august 2010 Loggen fra Malwarebytes: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Databaseversjon: 4507 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/30/2010 5:17:04 PM mbam-log-2010-08-30 (17-17-04).txt Skanntype: Hurtigsøk Objekter skannet: 188230 Tid tilbakelagt: 6 minutt(er), 45 sekund(er) Minneprosesser infisert: 0 Minnemoduler infisert: 0 Registernøkler infisert: 0 Registerverdier infisert: 0 Registerfiler infisert: 0 Mapper infisert: 0 Filer infisert 2 Minneprosesser infisert: (Ingen skadelige objekter funnet) Minnemoduler infisert: (Ingen skadelige objekter funnet) Registernøkler infisert: (Ingen skadelige objekter funnet) Registerverdier infisert: (Ingen skadelige objekter funnet) Registerfiler infisert: (Ingen skadelige objekter funnet) Mapper infisert: (Ingen skadelige objekter funnet) Filer infisert C:\WINDOWS\system32\Drivers\ntndis.sys (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\system32\ipsecndis.sys (Rootkit.Agent) -> Delete on reboot. Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå