Trenger hjelp med antivirus/spyware logger!

[Laffebaffen]

Maskina har begynt å oppføre seg rart i det siste. Den jobber hele tida, selv om jeg ikke har noen programmer gående!

 

Har kjørt CCleaner, kjører Avast og SAS. I tillegg kjørte jeg Hijack This. Håper noen kan se på disse loggene for meg!

 

SAS logg 1

 

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 11/11/2007 at 08:26 PM

 

Application Version : 3.9.1008

 

Core Rules Database Version : 3259

Trace Rules Database Version: 1328

 

Scan type : Complete Scan

Total Scan Time : 00:44:05

 

Memory items scanned : 616

Memory threats detected : 0

Registry items scanned : 6016

Registry threats detected : 0

File items scanned : 57412

File threats detected : 4

 

Adware.Tracking Cookie

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@advertising[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@2o7[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@atdmt[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@imrworldwide[1].txt

 

 

 

SAS logg 2

 

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 11/09/2007 at 11:30 PM

 

Application Version : 3.9.1008

 

Core Rules Database Version : 3259

Trace Rules Database Version: 1328

 

Scan type : Custom Scan

Total Scan Time : 00:21:30

 

Memory items scanned : 610

Memory threats detected : 0

Registry items scanned : 6016

Registry threats detected : 0

File items scanned : 16854

File threats detected : 34

 

Adware.Tracking Cookie

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@doubleclick[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@advertising[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@2o7[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@tradedoubler[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@atdmt[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@imrworldwide[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@serving-sys[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@2o7[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@advertising[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@atdmt[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@click24[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@doubleclick[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@fastclick[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@hitbox[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@imrworldwide[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@overture[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@serving-sys[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@toplist[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@tradedoubler[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

 

 

SAS logg 3

 

UPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 10/19/2007 at 09:42 PM

 

Application Version : 3.9.1008

 

Core Rules Database Version : 3259

Trace Rules Database Version: 1328

 

Scan type : Complete Scan

Total Scan Time : 00:53:57

 

Memory items scanned : 768

Memory threats detected : 0

Registry items scanned : 6113

Registry threats detected : 0

File items scanned : 57844

File threats detected : 26

 

Adware.Tracking Cookie

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@doubleclick[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@advertising[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@atdmt[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@imrworldwide[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\olaf@serving-sys[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@2o7[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@adbrite[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@adtech[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@advertising[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@atdmt[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@casalemedia[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@doubleclick[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@fastclick[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@imrworldwide[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@statcounter[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@tradedoubler[2].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\olaf@tribalfusion[1].txt

C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt

 

 

HJT logg

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:47:05, on 14.11.2007

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16546)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\ASUS\Net4Switch\Net4Switch.exe

C:\Windows\Explorer.EXE

C:\Program Files\ASUS\ASUS Live Update\ALU.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\A4Tech\Mouse\Amoumain.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Apoint2K\ApMsgFwd.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Apoint2K\HidFind.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\Apoint2K\Apvfb.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\IEUser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hamkam.no/presentation/default.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

 

--

End of file - 6835 bytes

 

[norbat]

Loggene ser greie ut.

Du har både avast og norton (noen tjenester kjører i alle fall) kjørende. Du bør ikke ha mer en ett av-prog.

Hvis du går ut i oppgavebehandlinga og sjekker prosesslisten, er det noen av prosessene som bruker 'mye' cpu?

Endret 15. november 2007 av norbat

[Laffebaffen]

Kjører ikke norton lengre, siden prøveperioden gikk ut. Avinstallerte det, men da har kanskje ikke alle prosessene blitt med.

 

Uansett: akkurat nå er det iexplore og firefox som drar mest, men dette er vel nokså normalt. ( De ligger på henholdsvis 85 000 og 70 000. Så er det noe som heter dmw.exe, og denne ligger på 25 000. Resten ligger like under og nedover, men disse er antakelig ikke så betydelige. Eller ?

[norbat]

Høres greit ut det du opplyser om.

 

Uansett, du kan fullføre avinstalleringen av Norton:

 

Norton Removal Tool bruker å fjerne de siste restene. Om dette funker i Vista vet jeg ikke.

 

I hjt-loggen er det disse tjenestene som hører til Norton:

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

 

De fleste er knyttet til LiveUpdate (et prog. som vanligvis avinstalleres fra legg til / fjern programmer.)

 

Hva som gjør at PC-en jobber hele tiden er jeg litt usikker på. Kan være en form for indexering e.l. Et alt. kan være å stille PC-en tilbake til før dette begynte (systemgjenoppretting), men om det er særlig hensiktmessig, vet jeg ikke. Ingen ting tyder på at du har noen form for infeksjon.

[Laffebaffen]

Hmm.. Det var da noen snåle greier.. Men skal prøve å tilbakestille når jeg får tid. Uansett tusen takk for hjelpa og for kjappe svar !