Hvordan fikk de tilgang til bankkontoen min?

[Lommetørkle]

Fikk akkurat en telefon fra banken min om at kortet mitt var sperret grunnet mistenksom aktivitet, noen har brukt 92 kroner på et amerikansk kosmetikknettsted.

 

Ikke akkurat store tapet (heldigvis,) men jeg er veldig nysgjerrig på hvordan de har fått tilgang til kontoen min. Jeg bruker mobilbank (Android,) nettbank (Windows,) laster aldri ned ting fra suspekte kilder, handler bare i pålitelige nettbutikker, åpner aldri e-poster om store peniser/billig vaginaer og har alt i alt gode nettvaner (trodde jeg iallfall.)

 

Hva er den mest sannsynlige forklaringen på hvordan de har fått tak i kontoinformasjonen min? Nytt kort er på vei fra banken, men er det noe jeg bør gjøre på min kant mtp. datasikkerhet o.l.?

[Eriksendrul]

Aldri lagre info om kort/konto på dataen

 

Aldri bruk kortet ditt på nettsider du ikke har sjekket ut ordentlig og ser hvilken levrandør de bruker av tjenesten som tar betalt.

 

aldri lagre kortet ditt på netsider/programmer som steam/origin osv

 

når det kommer til bruk av bankort/bankapp på mobil er jeg blank

 

men noe særlig mere trenger du ikke gjøre

[FenrisC0de]

Jeg tipper det er kortinformasjonen de har fått tilgang til og ikke kontoinformasjonen din.

 

Du kan ha vært offer for skimming i utlandet, eller du kan ha vært uforsiktig ved kredittkortbetaling over nett.

 

Uansett er det knallbra at bankene og kredittkortselskapene her til lands følger godt med og ikke holder kundene ansvarlig for slike hendelser.

[TheGaame]

Jeg tipper det er kortinformasjonen de har fått tilgang til og ikke kontoinformasjonen din.

 

Du kan ha vært offer for skimming i utlandet, eller du kan ha vært uforsiktig ved kredittkortbetaling over nett.

 

Uansett er det knallbra at bankene og kredittkortselskapene her til lands følger godt med og ikke holder kundene ansvarlig for slike hendelser.

 

hadde ikke instalert nettbank på mobil OG lagret bassord der. fole lett å miste telefon mister. Det var noe styr med hacka origin kontoer for noen måner siden. har også lest en plass at hackere kan gp inn i mobilen din dersom bluetooth er på

[FenrisC0de]

hadde ikke instalert nettbank på mobil OG lagret bassord der. fole lett å miste telefon mister. Det var noe styr med hacka origin kontoer for noen måner siden. har også lest en plass at hackere kan gp inn i mobilen din dersom bluetooth er på

 

Seriøse bank og betalingstjenester har apper som lagrer ting som kredittkort-informasjon kryptert og sender heller ikke ut noe sånt i klartekst. Skal mer en bluetooth til for å hente ut dette.

 

Når det er sagt er det helt sikkert eksempler på dårlige applikasjoner der ute.

[puse]

Mulig du har noe slikt på maskinen din, eller du har brukt kortet på en side som har blitt hacka. For å unngå at slik skjer igjen så er det et par ting du kan gjøre, bruke paypal eller lignende der det er mulig, skru på Click to Play, og bruk Anti-Virus.

[Dr.Geek]

 

Hva er den mest sannsynlige forklaringen på hvordan de har fått tak i kontoinformasjonen min? Nytt kort er på vei fra banken, men er det noe jeg bør gjøre på min kant mtp. datasikkerhet o.l.?

 

Hai,

 

ja, du burde sjekke din PC grundig for Malware, såkalt Online-Banking Malware, som Zeus: http://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29

 

Jeg kan gjerne hjelpe deg med dette. Gå gjennom denne linken;

https://www.diskusjon.no/index.php?showtopic=691246

 

og post loggene fra Malwarebytes-Anti-Malware og combofix her i ditt thread.

 

Jeg jobber frivillig hos et stort tysk antivirusforum: "botfrei.de" og har mye erfaring innenfor feltet.

[Lommetørkle]

Tusen takk for hjelpsomme svar og gode tips

 

 

Hai,

 

ja, du burde sjekke din PC grundig for Malware, såkalt Online-Banking Malware, som Zeus: http://en.wikipedia....Trojan_horse%29

 

Jeg kan gjerne hjelpe deg med dette. Gå gjennom denne linken;

http://www.diskusjon...howtopic=691246

 

og post loggene fra Malwarebytes-Anti-Malware og combofix her i ditt thread.

 

Jeg jobber frivillig hos et stort tysk antivirusforum: "botfrei.de" og har mye erfaring innenfor feltet.

 

Sier ikke meg stort så om du kunne ta en titt hadde det vært fremragende.

Log fra combofix:

 

 

ComboFix 13-04-27.04 - Saft 04/27/2013 9:10.1.8 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.47.1044.18.6069.3470 [GMT 2:00]

Kjører fra: c:\users\Saft\Downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\FullRemove.exe

c:\windows\msvcr71.dll

c:\windows\SysWow64\muzapp.exe

.

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2013-03-27 til 2013-04-27 )))))))))))))))))))))))))))))))))

.

.

2013-04-27 07:22 . 2013-04-27 07:22 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-04-27 05:55 . 2013-04-27 05:55 -------- d-----w- c:\users\Saft\AppData\Roaming\Malwarebytes

2013-04-27 05:55 . 2013-04-27 05:55 -------- d-----w- c:\programdata\Malwarebytes

2013-04-27 05:55 . 2013-04-27 05:55 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-04-27 05:55 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-04-27 05:54 . 2013-04-27 05:54 -------- d-----w- c:\users\Saft\AppData\Local\Programs

2013-04-26 09:37 . 2013-03-06 22:33 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-04-26 09:37 . 2013-03-06 22:33 178624 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2013-04-24 03:35 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-23 18:14 . 2013-04-23 18:14 -------- d-----w- c:\users\Saft\AppData\Local\Broadcom

2013-04-23 00:00 . 2013-04-23 00:00 -------- d-----w- c:\users\Saft\AppData\Local\Adobe

2013-04-22 21:31 . 2013-04-22 21:31 -------- d-----w- c:\users\Saft\AppData\Local\Spotify

2013-04-22 21:12 . 2013-04-22 21:13 -------- d-----w- c:\users\Saft\AppData\Local\Google

2013-04-22 18:57 . 2013-04-25 06:06 -------- d-----w- c:\users\Saft\AppData\Local\Eclipse

2013-04-22 18:56 . 2013-04-22 18:56 -------- d-----w- c:\users\Saft\AppData\Local\ATI

2013-04-22 18:55 . 2013-04-22 18:57 -------- d-----w- C:\Programmering

2013-04-20 18:33 . 2013-04-20 18:33 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin

2013-04-17 17:22 . 2013-04-17 17:22 -------- d-----w- C:\spill

2013-04-11 02:02 . 2013-02-21 10:14 15404544 ----a-w- c:\windows\system32\ieframe.dll

2013-04-11 02:02 . 2013-02-21 10:14 19230208 ----a-w- c:\windows\system32\mshtml.dll

2013-04-03 21:24 . 2013-04-03 21:24 -------- d-----w- c:\windows\VMUVC

2013-04-03 21:23 . 2013-04-03 21:23 -------- d-----w- c:\users\Saft\AppData\Roaming\InstallShield

2013-04-01 00:42 . 2013-02-22 07:17 203544 ----a-w- c:\windows\system32\drivers\ssudmdm.sys

2013-04-01 00:42 . 2013-02-22 07:17 102936 ----a-w- c:\windows\system32\drivers\ssudbus.sys

2013-04-01 00:41 . 2013-02-22 07:16 21320 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys

2013-04-01 00:41 . 2013-02-22 07:16 188232 ----a-w- c:\windows\system32\drivers\ssadmdm.sys

2013-04-01 00:41 . 2013-02-22 07:16 17736 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys

2013-04-01 00:41 . 2013-02-22 07:16 17224 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys

2013-04-01 00:41 . 2013-02-22 07:16 169288 ----a-w- c:\windows\system32\drivers\ssadbus.sys

2013-04-01 00:34 . 2013-04-01 00:34 -------- d-----w- c:\program files (x86)\MyFree Codec

2013-04-01 00:33 . 2013-02-22 07:16 17736 ----a-w- c:\windows\system32\drivers\ssadwh.sys

2013-04-01 00:33 . 2013-02-22 07:16 17224 ----a-w- c:\windows\system32\drivers\ssadcm.sys

2013-04-01 00:32 . 2013-03-20 08:07 233472 ----a-w- c:\windows\SysWow64\FsUsbExService.Exe

2013-04-01 00:32 . 2013-03-20 08:07 37344 ----a-w- c:\windows\SysWow64\FsUsbExDisk.Sys

2013-04-01 00:32 . 2011-06-07 09:14 110592 ----a-w- c:\windows\SysWow64\FsUsbExDevice.Dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-27 07:09 . 2012-07-12 16:33 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2013-04-27 07:09 . 2011-01-23 16:02 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-04-26 09:39 . 2012-02-26 12:48 45056 ----a-w- c:\windows\system32\acovcnt.exe

2013-04-22 21:15 . 2012-10-08 00:39 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-04-22 21:15 . 2012-10-08 00:39 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-04-11 02:03 . 2011-06-11 10:29 72702784 ----a-w- c:\windows\system32\MRT.exe

2013-03-20 08:02 . 2011-06-07 09:13 330240 ----a-w- c:\windows\MASetupCaller.dll

2013-03-20 08:02 . 2011-06-07 09:13 45320 ----a-w- c:\windows\SysWow64\MAMACExtract.dll

2013-03-06 22:33 . 2012-08-17 03:50 70992 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2013-03-06 22:33 . 2012-02-14 23:06 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-03-06 22:33 . 2011-01-23 01:22 377920 ----a-w- c:\windows\system32\drivers\aswSP.sys

2013-03-06 22:33 . 2011-01-23 01:22 68920 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2013-03-06 22:33 . 2011-01-23 01:22 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2013-03-06 22:33 . 2011-01-23 01:22 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-03-06 22:32 . 2011-01-23 01:22 41664 ----a-w- c:\windows\avastSS.scr

2013-03-06 22:32 . 2011-01-23 01:22 287840 ----a-w- c:\windows\system32\aswBoot.exe

2013-02-12 05:45 . 2013-03-13 17:39 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45 . 2013-03-13 17:39 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45 . 2013-03-13 17:39 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45 . 2013-03-13 17:39 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48 . 2013-03-13 17:39 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 04:48 . 2013-03-13 17:39 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-02-12 04:12 . 2013-03-19 00:20 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

.

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2013-03-06 4767304]

"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]

"VMonitorVMUVC"="c:\program files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe" [2010-09-10 143360]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-3 1080608]

FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2011-1-23 12862]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MySQL55;MySQL55;c:\program files\MySQL\MySQL Server 5.5\bin\mysqld --defaults-file=c:\programdata\MySQL\MySQL Server 5.5\my.ini MySQL55 [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-08-21 44032]

R3 aswVmm;aswVmm; [x]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-07-19 79360]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-02-22 102936]

R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS [2013-03-20 37344]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]

R3 SimpleSlideShowServer;SimpleSlideShowServer;c:\program files (x86)\Samsung\AllShare\AllShareSlideShowService.exe [2012-03-02 27584]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2013-02-22 169288]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2013-02-22 21320]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2013-02-22 188232]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-02-22 203544]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 tsusbhub;tsusbhub;tsusbhub [x]

S0 aswRvrt;aswRvrt; [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-05-22 254528]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-12-07 379520]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-03-06 80816]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 SamsungAllShareV2.0;Samsung AllShare PC;c:\program files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [2012-03-02 25504]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-04-21 76912]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-22 21:12 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

.

2013-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 21:15]

.

2011-06-11 c:\windows\Tasks\Defraggler Volume C Task.job

- c:\program files\Defraggler\df64.exe [2011-05-19 13:00]

.

2013-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 21:12]

.

2013-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 21:12]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-03-06 22:32 133840 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Saft\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Tilleggsskanning -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 217.13.7.140 217.13.4.24

.

- - - - TOMME PEKERE FJERNET - - - -

.

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-ASUS_Notebook_G73 - c:\windows\system32\ASUS_Notebook_G73.scr

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL55]

"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.5\bin\mysqld\" --defaults-file=\"c:\programdata\MySQL\MySQL Server 5.5\my.ini\" MySQL55"

.

--------------------- LÅSTE REGISTERNØKLER ---------------------

.

[HKEY_USERS\S-1-5-21-1929242991-1516669075-352373606-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-1929242991-1516669075-352373606-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Tidspunkt ferdig: 2013-04-27 09:42:52

ComboFix-quarantined-files.txt 2013-04-27 07:42

.

Pre-Run: 51,835,678,720 bytes free

Post-Run: 51,301,871,616 bytes free

.

- - End Of File - - DB0E490FD11FBE880A1714886945C503

 

 

 

Log fra Malwarebytes

 

 

 

alwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2013.04.27.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

Saft :: SAFT-PC [administrator]

4/27/2013 7:56:15 AM

mbam-log-2013-04-27 (07-56-15).txt

Scan type: Full scan (C:\|D:\|Q:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 541347

Time elapsed: 1 hour(s), 10 minute(s), 57 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

 

 

[Dr.Geek]

Hai,

 

det er ingen malware spor i loggene. Men du burde update noen av programmene dine: https://www.heimdalagent.com/en/features

 

Bruk kreditkortet bare på PCer du vet er trygge og på sikre nettsteder. Men jeg tenker at problemet ligger hos android telefonen din. Viktig å sikre denne også:

 

http://www.androidauthority.com/how-to-secure-your-android-phone-and-protect-your-data-139442/

[Lommetørkle]

Hai,

 

det er ingen malware spor i loggene. Men du burde update noen av programmene dine: https://www.heimdala...com/en/features

 

Bruk kreditkortet bare på PCer du vet er trygge og på sikre nettsteder. Men jeg tenker at problemet ligger hos android telefonen din. Viktig å sikre denne også:

 

http://www.androidau...ur-data-139442/

 

Good news, takker