[Løst] Noen se over disse loggene? Ulike program virker ikke lenger.

IcedInsanity · 18. juni 2011

Lastet ned en reg cleaner fra en sikker side, men etter kjøring så er alle snarveiene på skrivebordet borte, eller de er ikke borte men når du trykke rpå de så åpnes ikke porgrammet, og bildet av de ulike programmene som skal være der er borte, FireFox virker ikke heller.

Legger ved logger.

Combofix

ComboFix 11-06-17.04 - Acer 18.06.2011 12:46:37.6.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.47.1044.18.3036.1973 [GMT 2:00]

Kjører fra: c:\users\Acer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YTMPCF7K\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\IsUn0414.exe

c:\windows\system32\drivers\vqnpf.sys

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_xvxveo

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2011-05-18 til 2011-06-18 )))))))))))))))))))))))))))))))))

.

2011-06-18 10:51 . 2011-06-18 10:51 -------- d-----w- c:\users\Public\AppData\Local\temp

2011-06-18 10:51 . 2011-06-18 10:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-18 10:44 . 2011-06-18 10:45 -------- d-----w- C:\32788R22FWJFW

2011-06-17 23:24 . 2011-06-17 23:24 -------- d-----w- c:\program files\Winamp Detect

2011-06-17 23:24 . 2011-06-17 23:24 -------- d-----w- c:\program files\Common Files\PX Storage Engine

2011-06-17 23:24 . 2011-06-17 23:25 -------- d-----w- c:\program files\Winamp

2011-06-17 23:20 . 2011-06-17 23:20 -------- d-----w- c:\program files\CCleaner

2011-06-17 23:15 . 2011-06-17 23:28 -------- d-----w- c:\program files\Sony

2011-06-17 23:10 . 2011-06-17 23:14 -------- d-----w- c:\program files\Wise Registry Cleaner

2011-06-17 23:06 . 2011-06-17 23:19 -------- d-----w- c:\users\Acer\AppData\Roaming\Sammsoft

2011-06-17 23:01 . 2011-06-17 23:01 -------- d-----w- c:\programdata\RegistryCleanerFree

2011-06-17 23:01 . 2011-06-17 23:01 -------- d-----w- c:\users\Acer\AppData\Roaming\RegistryCleanerFree

2011-06-17 06:45 . 2011-05-18 10:37 6962000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA3A2889-D7A1-4155-B185-2B5ACCC5EE1A}\mpengine.dll

2011-06-16 11:30 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 11:30 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 11:30 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 11:19 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-16 11:19 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-16 11:19 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-16 11:19 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-16 11:19 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-16 11:19 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-16 11:19 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-16 11:19 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-16 11:19 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-05-31 18:56 . 2011-05-31 19:36 -------- d-----w- c:\users\Acer\AppData\Roaming\gtk-2.0

2011-05-31 18:56 . 2011-05-31 18:56 -------- d-----w- c:\users\Acer\.thumbnails

2011-05-31 18:54 . 2011-05-31 19:46 -------- d-----w- c:\users\Acer\.gimp-2.6

2011-05-27 13:13 . 2011-05-27 13:13 -------- d-----w- c:\users\Acer\AppData\Local\PowerChallenge

2011-05-24 19:39 . 2011-05-18 10:37 6962000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-05-23 18:06 . 2010-11-30 09:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3FD33A18-42EA-4CC5-B44C-C615F9A45ACD}\gapaengine.dll

2011-05-23 17:54 . 2011-06-17 22:59 -------- d-----w- c:\program files\Microsoft Security Client

2011-05-23 17:54 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-12 20:20 . 2011-05-15 16:17 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-05-29 07:11 . 2010-11-23 18:21 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-29 07:11 . 2010-11-23 18:21 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-13 23:23 . 2009-01-24 05:44 319456 ----a-w- c:\windows\DIFxAPI.dll

2011-04-21 09:13 . 2011-04-21 09:13 161792 ----a-w- c:\windows\system32\msls31.dll

2011-04-21 09:13 . 2011-04-21 09:13 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-04-21 09:13 . 2011-04-21 09:13 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-04-21 09:13 . 2011-04-21 09:13 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-04-21 09:13 . 2011-04-21 09:13 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-04-21 09:13 . 2011-04-21 09:13 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-04-21 09:13 . 2011-04-21 09:13 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-04-21 09:13 . 2011-04-21 09:13 367104 ----a-w- c:\windows\system32\html.iec

2011-04-21 09:13 . 2011-04-21 09:13 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-04-21 09:13 . 2011-04-21 09:13 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-21 09:13 . 2011-04-21 09:13 152064 ----a-w- c:\windows\system32\wextract.exe

2011-04-21 09:13 . 2011-04-21 09:13 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-04-21 09:13 . 2011-04-21 09:13 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-04-21 09:13 . 2011-04-21 09:13 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-04-21 09:13 . 2011-04-21 09:13 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-04-21 09:13 . 2011-04-21 09:13 11776 ----a-w- c:\windows\system32\mshta.exe

2011-04-21 09:13 . 2011-04-21 09:13 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-04-21 09:13 . 2011-04-21 09:13 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-04-21 09:13 . 2011-04-21 09:13 101888 ----a-w- c:\windows\system32\admparse.dll

2011-04-08 05:14 . 2011-05-13 22:46 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll

2011-04-08 05:14 . 2011-05-13 22:46 855656 ----a-w- c:\windows\system32\nvgenco322060.dll

2011-04-08 05:14 . 2011-05-13 22:46 6299752 ----a-w- c:\windows\system32\nvwgf2um.dll

2011-04-08 05:14 . 2011-05-13 22:46 57960 ----a-w- c:\windows\system32\OpenCL.dll

2011-04-08 05:14 . 2011-05-13 22:46 5180824 ----a-w- c:\windows\system32\nvcuda.dll

2011-04-08 05:14 . 2011-05-13 22:46 2765928 ----a-w- c:\windows\system32\nvcuvid.dll

2011-04-08 05:14 . 2011-05-13 22:46 2074216 ----a-w- c:\windows\system32\nvcuvenc.dll

2011-04-08 05:14 . 2011-05-13 22:46 15227496 ----a-w- c:\windows\system32\nvoglv32.dll

2011-04-08 05:14 . 2011-05-13 22:46 10690024 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2011-04-08 05:14 . 2011-05-13 22:46 10071656 ----a-w- c:\windows\system32\nvd3dum.dll

2011-04-08 05:14 . 2011-05-13 22:46 2034280 ----a-w- c:\windows\system32\nvapi.dll

2011-04-08 05:14 . 2011-05-13 22:46 13007464 ----a-w- c:\windows\system32\nvcompiler.dll

2011-04-08 05:14 . 2011-05-13 22:46 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd

2011-04-06 13:33 . 2011-05-13 23:23 3464104 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys

2011-04-06 08:15 . 2011-05-13 23:23 952320 ----a-w- c:\windows\system32\RCoRes.dat

2011-03-31 14:49 . 2011-05-13 23:23 2160744 ----a-w- c:\windows\system32\RtkPgExt.dll

2011-03-31 14:49 . 2011-05-13 23:23 4105832 ----a-w- c:\windows\system32\RtkAPO.dll

2011-03-24 14:03 . 2011-05-13 23:23 70248 ----a-w- c:\windows\system32\RtkCoInst.dll

2011-04-30 08:23 . 2011-04-24 20:19 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]

"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]

"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-11 544768]

"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]

"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]

"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]

"Logitech G930"="c:\program files\Logitech\G930\G930.exe" [2011-03-23 1516888]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"AvgUninstallURL"="start http:" [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoStart IR.lnk]

backup=c:\windows\pss\AutoStart IR.lnk.CommonStartup

backupExtension=.CommonStartup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech G930]

2011-03-23 09:42 1516888 ----a-w- c:\program files\Logitech\G930\G930.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 cxbu0wdm;CardMan 3x21;c:\windows\system32\DRIVERS\cxbu0wdm.sys [2010-07-03 114304]

S1 archlp;archlp;c:\windows\system32\drivers\archlp.sys [2009-02-19 127744]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]

S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-11-28 24576]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

getPlusHelper REG_MULTI_SZ getPlusHelper

Akamai REG_MULTI_SZ Akamai

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.ea.com/uk/football/fifa-ultimate-team/app

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0414&s=2&o=vp32&d=0709&m=aspire_6930g

TCP: DhcpNameServer = 193.213.112.4 130.67.15.198

FF - ProfilePath - c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\xpi0y9gy.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2088657&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com

FF - prefs.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=nsG5i5zi&q=

FF - user.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=nsG5i5zi&q=

.

- - - - TOMME PEKERE FJERNET - - - -

.

URLSearchHooks-{af543a13-f8e6-4423-a4ac-1cc0475ecb44} - (no file)

BHO-{af543a13-f8e6-4423-a4ac-1cc0475ecb44} - (no file)

Toolbar-{af543a13-f8e6-4423-a4ac-1cc0475ecb44} - (no file)

WebBrowser-{AF543A13-F8E6-4423-A4AC-1CC0475ECB44} - (no file)

AddRemove-Akamai - c:\program files\common files\akamai\uninstall.exe

AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\program files\NOS\bin\getPlus_Helper.dll

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-18 17:16

Windows 6.0.6002 Service Pack 2 NTFS

.

skanner skjulte prosesser ...

.

skanner skjulte autostart-oppføringer ...

.

skanner skjulte filer ...

.

skanning vellykket

skjulte filer: 0

.

**************************************************************************

.

--------------------- LÅSTE REGISTERNØKLER ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

.

- - - - - - - > 'Explorer.exe'(3872)

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\windows\system32\WLANExt.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

c:\windows\system32\libusbd-nt.exe

c:\acer\Mobility Center\MobilityService.exe

c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\conime.exe

c:\windows\PEV.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2011-06-18 17:19:02 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2011-06-18 15:19

ComboFix2.txt 2011-03-17 13:19

ComboFix3.txt 2010-11-28 00:40

ComboFix4.txt 2010-11-23 18:47

ComboFix5.txt 2011-06-18 10:45

.

Pre-Run: 152 029 822 976 byte ledig

Post-Run: 152 449 568 768 byte ledig

.

- - End Of File - - 100DCB5C356A4F330C59153A4A330780

]

Mbam:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Databaseversjon: 6885

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

18.06.2011 12:34:11

mbam-log-2011-06-18 (12-34-02).txt

Skanntype: Hurtigsøk

Objekter skannet: 158342

Tid tilbakelagt: 5 minutt(er), 32 sekund(er)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 1

Filer infisert 4

Minneprosesser infisert: