Pup-ups på internett

Kles · 2. mai 2007

Heisann.

Jeg har et kjempestort problem på pcen min. Det går ut på at hver gang jeg er inne på internett, prøver et eller annet program å koble seg på nettet. Dette ender som oftest i pop-ups hvor jeg får beskjed om at pcen er infisert av diverse virus o.l. og om dumme poker-tilbud på nettet.

Jeg bruker Norman Firewall, og jeg får beskjed før pop.upsene kommer om at et program prøver å komme seg inn på internett. Det vises også en IP adresse på hvor dette programmet vil.

Jeg har kjørt 3 viruskontroller: Norman, BitDefender og AVG. I tillegg her jeg kjørt disse tre anti-spyware programmene: Spyware Doctor, AVG Anti-Spyware og SAS. Jeg har også prøvd å fikse det til med SmitfreudFIX og CCleaner.

Hver gang jeg går på internett og skjekker innstillingene, er den personlige beskyttelsen skrudd ned til bunns, selv om jeg setter den til Middels-høy.

Jeg har spurt venner som har peiling, og skjekket her på diskusjon.no, men klarer ikke å få det til! Jeg trenger hvirkelig hjelp!

Vær så snill å hjelp meg viss du har vert borti noe lignende før, eller vet hva jeg bør gjøre!

Her er en HijackThis-rapport viss det kan være til hjelp:

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 23:27:24, on 02.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Intel\Wireless\Bin\EvtEng.exe

C:\Programfiler\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\System32\cusrvc.exe

C:\WINDOWS\system32\emitray.exe

C:\Norman\Npf\BIN\NPFSVICE.EXE

C:\Norman\Bin\Zanda.exe

C:\WINDOWS\System32\QCONSVC.EXE

C:\Programfiler\Intel\Wireless\Bin\RegSrvc.exe

C:\Programfiler\Spyware Doctor\sdhelp.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\TPHDEXLG.EXE

C:\WINDOWS\system32\TpKmpSVC.exe

C:\WINDOWS\System32\wm.exe

C:\Norman\Nvc\bin\nvcoas.exe

C:\Norman\Nvc\BIN\NVCSCHED.EXE

C:\Norman\bin\NJEEVES.EXE

C:\Norman\Nvc\BIN\nipsvc.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

C:\Programfiler\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Programfiler\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Programfiler\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\System32\igfxpers.exe

C:\WINDOWS\system32\TpShocks.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\ThinkPad\ConnectUtilities\QCTRAY.EXE

C:\Programfiler\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\system32\NWTRAY.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Norman\bin\ZLH.EXE

C:\Norman\Nvc\BIN\NIP.EXE

C:\Norman\Nvc\bin\cclaw.exe

C:\Norman\Npf\BIN\npfmsg2.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Programfiler\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\svchost.exe

C:\Documents and Settings\administrator\Skrivebord\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.linksidene.no/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.linksidene.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {56238299-39F1-4E9A-95CE-80F2E02D7A74} - C:\WINDOWS\system32\iifgdax.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar2.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\ogvlsume.dll

O2 - BHO: (no name) - {EDC0A6B2-ACAB-4961-83CC-9231D1633942} - C:\WINDOWS\system32\pmnlm.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar2.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Programfiler\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Programfiler\Analog Devices\SoundMAX\smax4.exe" /tray

O4 - HKLM\..\Run: [synTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Programfiler\ThinkPad\Utilities\TpKmapAp.exe -helper

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe

O4 - HKLM\..\Run: [TpShocks] TpShocks.exe

O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor

O4 - HKLM\..\Run: rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog

O4 - HKLM\..\Run: [QCTRAY] C:\Programfiler\ThinkPad\ConnectUtilities\QCTRAY.EXE

O4 - HKLM\..\Run: [QCWLICON] C:\Programfiler\ThinkPad\ConnectUtilities\QCWLICON.EXE

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [sxgTkBar] SxgTkBar.exe

O4 - HKLM\..\Run: [infoData] rundll32.exe "C:\WINDOWS\system32\ksblqerm.dll",realset

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] E:\SUPERAntiSpyware.exe

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\System32\btxppanel.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O20 - Winlogon Notify: iifgdax - C:\WINDOWS\SYSTEM32\iifgdax.dll

O20 - Winlogon Notify: pmnlm - C:\WINDOWS\system32\pmnlm.dll

O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll

O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll

O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programfiler\ThinkPad\Bluetooth Software\bin\btwdins.exe

O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\System32\cusrvc.exe

O23 - Service: Emagic EMI System Tray Service (emitray) - Emagic Soft- und Hardware GmbH - C:\WINDOWS\system32\emitray.exe

O23 - Service: EvtEng - Intel Corporation - C:\Programfiler\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe

O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE

O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE

O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe

O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE

O23 - Service: QCONSVC - Lenovo - C:\WINDOWS\System32\QCONSVC.EXE

O23 - Service: RegSrvc - Intel Corporation - C:\Programfiler\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programfiler\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programfiler\Spyware Doctor\sdhelp.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE

O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe

Endret 3. mai 2007 av b-real

nets · 3. mai 2007

Ser nok desverre ut som du er helt infisert av et eller annet Virus.

Jeg vile anbefale å boote opp med Antivirus CDen din å se om den klarer å finne viruset med de definisjonene som ligger på CDen. Evt. prøve flere forskjellige slike CDer. (Altså starte opp fra antivirus CDen din før windows starter).

Hvis ikke det fungerer så ser jeg desverre ikke annen utvei enn en god gammeldags format

Endret 3. mai 2007 av Nets

3. mai 2007

Hva med i det hele tatt å skjekke ut Hijackthis loggen? Man formaterer ikke pc'en før man har skjekket og muligens slettet farlige filer i Hijackthis først.

Noe jeg overlater til noen andre

Endret 3. mai 2007 av medlem-105082

norbat · 3. mai 2007

Hei, Kles

Last ned Vundofix,

start programmet og klikk "Scan for Vundo"-knappen.

Når programmet er kjørt ferdig, klikker du på knappen "Remove vundo".

Programmet lage en logg som du poster senere.

Hent Combofix og legg det på skrivebordet. Lukk alle andre programmer. Kjør programmet. Ikke klikk på noe annet.

Når programmet er ferdig åpnes en loggfil: combofix.txt

Den loggfilen poster du også senere.

Post deretter de overnevte loggene + en ny HJT-logg

Kles · 3. mai 2007

Flott! Det skal jeg gjøre så snart som mulig!

Kles · 3. mai 2007

Her kommer ComboFix loggen og den nye HijackThis loggen. Jeg fikk ingen logg etter å ha brukt VundoFix...

Combofix:

Administrator" - 07-05-03 20:00:05 Service Pack 2

ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\administrator\Skrivebord\"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\installer\e4152.msi

C:\DOCUME~1\ADMINI~1\SKRIVE~1.\internet explorer.lnk

((((((((((((((((((((((((((((((( Files Created from 2007-04-03 to 2007-05-03 ))))))))))))))))))))))))))))))))))

2007-05-03 17:07 <DIR> d-------- C:\VundoFix Backups

2007-05-02 22:43 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Siste

2007-05-02 18:41 576,853 ---hs---- C:\WINDOWS\system32\mlnmp.ini2

2007-05-02 17:57 0 --a------ C:\WINDOWS\XGPLAYER.EXE

2007-05-02 17:57 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE

2007-05-02 17:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\SUPERAntiSpyware.com

2007-05-02 17:39 <DIR> d-------- C:\DOCUME~1\ADMINI~1\PROGRA~1\SUPERAntiSpyware.com

2007-05-02 17:28 <DIR> d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard

2007-05-02 13:02 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-05-02 12:58 26,944 --a------ C:\WINDOWS\system32\drivers\avg7rsnt.sys

2007-05-01 21:56 <DIR> d-------- C:\WINDOWS\BDOSCAN8

2007-04-27 14:06 577,637 ---hs---- C:\WINDOWS\system32\mlnmp.bak2

2007-04-25 19:05 633,237 ---hs---- C:\WINDOWS\system32\mlnmp.bak1

2007-04-25 18:55 <DIR> d-------- C:\Programfiler\Foxit Software

2007-04-25 18:02 <DIR> d-------- C:\Programfiler\CCleaner

2007-04-24 14:34 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\PROGRA~1\TEMP

2007-04-24 14:23 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys

2007-04-24 14:23 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys

2007-04-24 14:15 <DIR> d-------- C:\Programfiler\Docudesk

2007-04-24 14:15 <DIR> d-------- C:\Programfiler\BearShare Applications

2007-04-24 14:15 <DIR> d-------- C:\Programfiler\Audacity

2007-04-24 14:15 <DIR> d-------- C:\Programfiler\Analog Devices

2007-04-24 14:02 <DIR> d-------- C:\Programfiler\Analog Devices(2)

2007-04-23 19:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1\.housecall6.6

2007-04-23 18:51 <DIR> d-------- C:\Programfiler\Spyware Doctor

2007-04-22 20:04 0 --a------ C:\WINDOWS\nsreg.dat

2007-04-22 19:58 18,764 --a------ C:\WINDOWS\system32\ddmon.dll

2007-04-10 16:34 <DIR> d-------- C:\DOCUME~1\ADMINI~1\PROGRA~1\Ableton

2007-04-10 13:35 9,984 --a------ C:\WINDOWS\system32\drivers\emifilt.sys

2007-04-10 13:35 599,424 --a------ C:\WINDOWS\system32\drivers\emiload.sys

2007-04-10 13:35 462,848 --a------ C:\WINDOWS\system32\emitray.exe

2007-04-10 13:35 139,264 --a------ C:\WINDOWS\system32\emieasi.dll

2007-04-10 13:35 118,784 --a------ C:\WINDOWS\system32\easiasio.dll

2007-04-10 13:35 114,688 --a------ C:\WINDOWS\system32\easimme.dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-03 19:58 5 --a------ C:\NPF_USER.DAT

2007-05-02 22:24 -------- d-------- C:\Programfiler\videolan

2007-05-02 22:23 -------- d-------- C:\Programfiler\native instruments

2007-05-02 22:13 -------- d-------- C:\Programfiler\finale 2006

2007-05-02 21:43 -------- d-------- C:\Programfiler\ricochet xtreme

2007-05-02 21:42 -------- d-------- C:\Programfiler\ski jump international

2007-04-24 14:56 -------- d-------- C:\DOCUME~1\ADMINI~1\PROGRA~1\utorrent

2007-03-27 22:19 -------- d-------- C:\Programfiler\steinberg

2007-03-27 22:05 -------- d-------- C:\Programfiler\syncrosoft

2007-03-25 10:05 46522 --a------ C:\WINDOWS\system32\perfc014.dat

2007-03-25 10:05 319198 --a------ C:\WINDOWS\system32\perfh014.dat

2007-03-17 15:45 292864 --a------ C:\WINDOWS\system32\winsrv.dll

2007-03-10 12:53 604 --ah----- C:\Programfiler\stll notifier

2007-03-10 12:51 -------- d-------- C:\Programfiler\sibelius software

2007-03-10 12:46 -------- d-------- C:\Programfiler\waves

2007-03-08 17:39 577536 --a------ C:\WINDOWS\system32\user32.dll

2007-03-08 17:39 40960 --a------ C:\WINDOWS\system32\mf3216.dll

2007-03-08 17:39 281600 --a------ C:\WINDOWS\system32\gdi32.dll

2007-03-08 17:38 1843584 --a------ C:\WINDOWS\system32\win32k.sys

2007-03-05 23:37 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-03-05 22:53 -------- d-------- C:\Programfiler\yahoo!

2007-02-05 22:19 185344 --a------ C:\WINDOWS\system32\upnphost.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{011AB9D2-F79E-4472-BF80-CF7F54654610} C:\WINDOWS\system32\pmnlm.dll [x]

{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

{56238299-39F1-4E9A-95CE-80F2E02D7A74} C:\WINDOWS\system32\iifgdax.dll [x]

{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\programfiler\google\googletoolbar2.dll

{B56A7D7D-6927-48C8-A975-17DF180C71AC} C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"TPHOTKEY"="C:\\PROGRA~1\\Lenovo\\PkgMgr\\HOTKEY\\TPHKMGR.exe"

"SoundMAXPnP"="C:\\Programfiler\\Analog Devices\\SoundMAX\\SMax4PNP.exe"

"SoundMAX"="\"C:\\Programfiler\\Analog Devices\\SoundMAX\\smax4.exe\" /tray"

"SynTPLpr"="C:\\Programfiler\\Synaptics\\SynTP\\SynTPLpr.exe"

"SynTPEnh"="C:\\Programfiler\\Synaptics\\SynTP\\SynTPEnh.exe"

"TPKMAPHELPER"="C:\\Programfiler\\ThinkPad\\Utilities\\TpKmapAp.exe -helper"

"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"

"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"

"Persistence"="C:\\WINDOWS\\System32\\igfxpers.exe"

"TpShocks"="TpShocks.exe"

"PWRMGRTR"="rundll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\PWRMGRTR.DLL,PwrMgrBkGndMonitor"

"BLOG"="rundll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog"

"QCTRAY"="C:\\Programfiler\\ThinkPad\\ConnectUtilities\\QCTRAY.EXE"

"QCWLICON"="C:\\Programfiler\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE"

"NWTRAY"="NWTRAY.EXE"

"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe"

"QuickTime Task"="\"C:\\Programfiler\\QuickTime\\qttask.exe\" -atboottime"

"Norman ZANDA"="C:\\Norman\\bin\\ZLH.EXE /LOAD /SPLASH"

"SxgTkBar"="SxgTkBar.exe"

"InfoData"="rundll32.exe \"C:\\WINDOWS\\system32\\ksblqerm.dll\",realset"

"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

"!AVG Anti-Spyware"="\"C:\\Programfiler\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]

"swg"="C:\\Programfiler\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"

"SUPERAntiSpyware"="E:\\SUPERAntiSpyware.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"Spyware Doctor"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoWinKeys"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{56238299-39F1-4E9A-95CE-80F2E02D7A74}"=""

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa

Authentication Packages REG_MULTI_SZ msv1_0\0nwv1_0\0\0

Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0

Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0

NetworkService REG_MULTI_SZ DnsCache\0\0

rpcss REG_MULTI_SZ RpcSs\0\0

imgsvc REG_MULTI_SZ StiSvc\0\0

termsvcs REG_MULTI_SZ TermService\0\0

HTTPFilter REG_MULTI_SZ HTTPFilter\0\0

DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

Usnsvc REG_MULTI_SZ usnsvc\0\0

WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

C:\WINDOWS\tasks\PMTask.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-03 20:04:37

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

********************************************************************

HijackThis:

Logfile of HijackThis v1.99.1

Scan saved at 20:09:39, on 03.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Intel\Wireless\Bin\EvtEng.exe

C:\Programfiler\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\System32\cusrvc.exe

C:\WINDOWS\system32\emitray.exe

C:\Norman\Npf\BIN\NPFSVICE.EXE

C:\Norman\Bin\Zanda.exe

C:\WINDOWS\System32\QCONSVC.EXE

C:\Programfiler\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Spyware Doctor\sdhelp.exe

C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\Programfiler\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Programfiler\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Programfiler\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\TPHDEXLG.EXE

C:\WINDOWS\system32\TpKmpSVC.exe

C:\WINDOWS\System32\wm.exe

C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Norman\Nvc\bin\nvcoas.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\System32\igfxpers.exe

C:\Norman\Nvc\BIN\NVCSCHED.EXE

C:\WINDOWS\system32\TpShocks.exe

C:\Norman\bin\NJEEVES.EXE

C:\Programfiler\ThinkPad\ConnectUtilities\QCTRAY.EXE

C:\Norman\Nvc\BIN\nipsvc.exe

C:\Programfiler\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\system32\NWTRAY.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Norman\bin\ZLH.EXE

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Norman\Nvc\BIN\NIP.EXE

C:\Norman\Nvc\bin\cclaw.exe

C:\Norman\Npf\BIN\npfmsg2.exe

C:\Programfiler\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

C:\Documents and Settings\administrator\Skrivebord\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.linksidene.no/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.linksidene.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {011AB9D2-F79E-4472-BF80-CF7F54654610} - C:\WINDOWS\system32\pmnlm.dll (file missing)

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {56238299-39F1-4E9A-95CE-80F2E02D7A74} - C:\WINDOWS\system32\iifgdax.dll (file missing)