Feilmelding ved oppstart av Windows XP

Flygaren · 25. desember 2007

Heisann!

På den bærbare PC-en til faren min kommer det opp en feilmelding hver gang han starter den, og den er som følger:

RUNDLL

---------------------------

Feil ved innlasting av C:\WINDOWS\system32\gqxhqxmt.dll

Den angitte modulen ble ikke funnet.

Noen som vet hva jeg kan gjøre for å få denne fjernet??? Veldig irriterende er den i alle fall....

Alle forslag mottas med takk.

Kristian

M3moreX · 25. desember 2007

Formatere?

KillYou · 25. desember 2007

Formatere?

Hva er det med folk at når noe er feil skal det formateres?

Jeg finner ikke denne dll filen noen steder hvilken windows versjon har du?

M3moreX · 25. desember 2007

Var ikke snakk om at det SKULLE formateres.. var bare et lite forslag for jeg finner ikke den dll filen..

norbat · 25. desember 2007

Dette er rester etter spyware.

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile".

Loggfilen kopierer du og poster, så tar vi det derfra.

Flygaren · 26. desember 2007

Dette er rester etter spyware.

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile".

Loggfilen kopierer du og poster, så tar vi det derfra.

Takker, skal gjøre dette i morgen.

Flygaren · 27. desember 2007

Her er loggfilen som kom opp...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:33:53, on 27.12.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Norman\Npm\bin\ELOGSVC.EXE

C:\Norman\Npm\Bin\Zanda.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\Norman\Npm\bin\ZLH.EXE

C:\WINDOWS\sm56hlpr.exe

C:\Programfiler\Byggsafe\Byggsafe Total\Bin\ByggsafeServer.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programfiler\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Microsoft SQL Server\MSSQL$BYGGSAFE\Binn\sqlservr.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Norman\Npm\bin\NJEEVES.EXE

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Norman\Nvc\BIN\NIP.EXE

C:\Norman\Nvc\BIN\NVCSCHED.EXE

C:\Norman\Nvc\bin\NVCOA.EXE

C:\Norman\Nvc\bin\nvcoas.exe

C:\Documents and Settings\Oddvar Bergesen\Skrivebord\Ny mappe\HiJackThis\HijackThis.exe

C:\Norman\Nvc\bin\cclaw.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {92335157-984B-4692-8405-530335CA9F27} - C:\WINDOWS\system32\nflyiyto.dll (file missing)

O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\fvqfuvxh.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programfiler\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programfiler\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar3.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB001" /M "Stylus C48"

O4 - HKLM\..\Run: [byggsafeServer] C:\Programfiler\Byggsafe\Byggsafe Total\Bin\ByggsafeServer.exe

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Programfiler\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\gqxhqxmt.dll",forkonce

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ErrorSafeFree] "C:\Programfiler\ErrorSafe Free\uers.exe" /min

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Service Manager.lnk = C:\Programfiler\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programfiler\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programfiler\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1185722149312

O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab

O20 - Winlogon Notify: eulalib - C:\WINDOWS\Registration\CRMLog\eulalib.dll (file missing)

O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE

O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe

O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE

--

End of file - 8078 bytes

Noen som kan hjelpe meg med å tolke denne???

Kristian

KillYou · 27. desember 2007

Er ikke så god på hijack logger, men her er det readeren sa, kan se igjenom der til noen andre kommer.

jck.html

norbat · 27. desember 2007

Start hjt, velg "Do a system scan only", sett merke framfor følgende linjer og klikk Fix checked:

O2 - BHO: (no name) - {92335157-984B-4692-8405-530335CA9F27} - C:\WINDOWS\system32\nflyiyto.dll (file missing)

O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\fvqfuvxh.dll (file missing)

O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\gqxhqxmt.dll",forkonce

O4 - HKCU\..\Run: [ErrorSafeFree] "C:\Programfiler\ErrorSafe Free\uers.exe" /min

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programfiler\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programfiler\PartyGaming\PartyPoker\RunApp.exe (file missing)

O20 - Winlogon Notify: eulalib - C:\WINDOWS\Registration\CRMLog\eulalib.dll (file missing)

Kjør deretter gjennom langversjonen i følgende post: https://www.diskusjon.no/index.php?showtopic=691246

Loggene poster du her i din egen tråd

Endret 27. desember 2007 av norbat

Flygaren · 27. desember 2007

Jess, da er alt på listen gjort, og her er loggene:

SUPERAntiSpyware

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 12/27/2007 at 05:59 PM

Application Version : 3.9.1008

Core Rules Database Version : 3369

Trace Rules Database Version: 1365

Scan type : Complete Scan

Total Scan Time : 00:29:28

Memory items scanned : 439

Memory threats detected : 0

Registry items scanned : 5034

Registry threats detected : 11

File items scanned : 23736

File threats detected : 20

Unclassified.Unknown Origin

HKLM\Software\Classes\CLSID\{938A8A03-A938-4019-B764-03FF8D167D79}

HKCR\CLSID\{938A8A03-A938-4019-B764-03FF8D167D79}

HKCR\CLSID\{938A8A03-A938-4019-B764-03FF8D167D79}\InprocServer32

HKCR\CLSID\{938A8A03-A938-4019-B764-03FF8D167D79}\InprocServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\FVQFUVXH.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{938A8A03-A938-4019-B764-03FF8D167D79}

HKCR\CLSID\{938A8A03-A938-4019-B764-03FF8D167D79}

Adware.Vundo Variant

HKLM\Software\Classes\CLSID\{E12BFF69-38A7-406e-A8EF-2738107A7831}

HKCR\CLSID\{E12BFF69-38A7-406E-A8EF-2738107A7831}

HKCR\CLSID\{E12BFF69-38A7-406E-A8EF-2738107A7831}\InprocServer32

HKCR\CLSID\{E12BFF69-38A7-406E-A8EF-2738107A7831}\InprocServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\LCXCQENH.DLL

HKCR\CLSID\{E12BFF69-38A7-406E-A8EF-2738107A7831}

Adware.Tracking Cookie

C:\Documents and Settings\Oddvar Bergesen\Cookies\[email protected][1].txt

Malware.DriveCleaner

C:\Programfiler\DriveCleaner 2006 Free\Activate.dat

C:\Programfiler\DriveCleaner 2006 Free\bnlink.dat

C:\Programfiler\DriveCleaner 2006 Free\lapv.dat

C:\Programfiler\DriveCleaner 2006 Free\license.rtf

C:\Programfiler\DriveCleaner 2006 Free\manual.url

C:\Programfiler\DriveCleaner 2006 Free\pv.dat

C:\Programfiler\DriveCleaner 2006 Free\readme.rtf

C:\Programfiler\DriveCleaner 2006 Free\sr.log

C:\Programfiler\DriveCleaner 2006 Free\support.url

C:\Programfiler\DriveCleaner 2006 Free\UDC2006.xml

C:\Programfiler\DriveCleaner 2006 Free\UDC6.url

C:\Programfiler\DriveCleaner 2006 Free\unins000.dat

C:\Programfiler\DriveCleaner 2006 Free\unins000.exe

C:\Programfiler\DriveCleaner 2006 Free\UninstallPage.html

C:\Programfiler\DriveCleaner 2006 Free\updater.dat

C:\Programfiler\DriveCleaner 2006 Free

Trojan.ErrorSafe

C:\WINDOWS\SYSTEM32\ERRORSAFESETUP.EXE

ComboFix

ComboFix 07-12-21.4 - Oddvar Bergesen 2007-12-27 18:18:15.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.150 [GMT 1:00]

Running from: C:\Documents and Settings\Oddvar Bergesen\Skrivebord\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\cookies.ini

.

((((((((((((((((((((((((( Files Created from 2007-11-27 to 2007-12-27 )))))))))))))))))))))))))))))))

.

2007-12-27 17:26 . 2007-12-27 17:27 <DIR> d-------- C:\Programfiler\SUPERAntiSpyware

2007-12-27 17:26 . 2007-12-27 17:26 <DIR> d-------- C:\Documents and Settings\Oddvar Bergesen\Programdata\SUPERAntiSpyware.com

2007-12-27 17:26 . 2007-12-27 17:26 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\SUPERAntiSpyware.com

2007-12-27 17:25 . 2007-12-27 17:25 <DIR> d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard

2007-12-27 17:23 . 2007-12-27 17:23 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Yahoo! Companion

2007-12-27 17:21 . 2007-12-27 17:40 <DIR> dr-h----- C:\Documents and Settings\Oddvar Bergesen\Siste

2007-12-27 17:10 . 2007-12-27 17:10 <DIR> d-------- C:\Programfiler\Yahoo!

2007-12-27 17:10 . 2007-12-27 17:10 <DIR> d-------- C:\Programfiler\CCleaner

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-27 16:21 --------- d-----w C:\Documents and Settings\All Users\Programdata\Spybot - Search & Destroy

2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-10-30 23:30 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll

2007-10-29 22:45 1,290,752 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-29 22:45 1,290,752 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll

2007-10-27 07:52 --------- d-----w C:\Programfiler\Java

2007-10-25 16:44 8,466,432 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll

2007-10-20 05:01 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-20 05:01 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll

2007-10-10 23:54 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll

2007-10-10 23:54 232,960 ----a-w C:\WINDOWS\system32\dllcache\webcheck.dll

2007-10-10 23:53 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll

2007-10-10 23:53 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll

2007-10-10 23:53 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll

2007-10-10 23:53 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2007-10-10 23:53 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll

2007-10-10 23:53 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll

2007-10-10 23:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll

2007-10-10 23:53 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll

2007-10-10 23:53 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll

2007-10-10 23:53 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll

2007-10-10 23:53 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll

2007-10-10 23:53 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll

2007-10-10 23:53 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll

2007-10-10 23:53 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll

2007-10-10 23:53 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll

2007-10-10 23:53 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll

2007-10-10 23:53 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll

2007-10-10 23:53 105,984 ----a-w C:\WINDOWS\system32\dllcache\url.dll

2007-10-10 23:53 102,400 ----a-w C:\WINDOWS\system32\dllcache\occache.dll

2007-10-10 23:53 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll

2007-10-10 11:02 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe

2007-10-10 11:02 625,152 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe

2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe

2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Programfiler\Messenger\msmsgs.exe" [2004-10-13 17:24]

"swg"="C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-28 08:40]

"SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]

"SoundMan"="SOUNDMAN.EXE" [2005-05-17 10:48 C:\WINDOWS\SOUNDMAN.EXE]

"VTTimer"="VTTimer.exe" [2005-03-08 02:33 C:\WINDOWS\system32\VTTimer.exe]

"VTTrayp"="VTtrayp.exe" [2005-03-11 16:33 C:\WINDOWS\system32\VTTrayp.exe]

"Norman ZANDA"="C:\Norman\Npm\bin\ZLH.exe" [2007-08-09 13:40]

"SMSERIAL"="sm56hlpr.exe" [2005-04-07 11:33 C:\WINDOWS\sm56hlpr.exe]

"EPSON Stylus C48 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.exe" [2005-05-17 04:00]

"ByggsafeServer"="C:\Programfiler\Byggsafe\Byggsafe Total\Bin\ByggsafeServer.exe" [2004-06-02 08:06]

"Telenor Online Start"="C:\Programfiler\Telenor\Online Start\Telenor.exe" [2006-11-30 14:51]

"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

Service Manager.lnk - C:\Programfiler\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 16:23:32]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

R0 viaagp1;VIA AGP Filter;C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2003-07-01 20:42]

R2 MSSQL$BYGGSAFE;MSSQL$BYGGSAFE;C:\Programfiler\Microsoft SQL Server\MSSQL$BYGGSAFE\Binn\sqlservr.exe -sBYGGSAFE []

R2 Ndiskio;Ndiskio;C:\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 09:55]

R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-01-14 16:22]

R3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2007-07-09 09:50]

R3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe [2007-07-12 10:38]

R3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE [2007-05-23 12:23]

S3 nvcfsr;nvcfsr;C:\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 14:25]

S3 nvcoafl51;nvcoafl51;C:\Norman\Nvc\bin\nvcoafl51.sys [2007-01-09 14:25]

S3 nvcoaft51;nvcoaft51;C:\Norman\Nvc\bin\nvcoaft51.sys [2007-01-09 14:25]

S3 nvcoarc51;nvcoarc51;C:\Norman\Nvc\bin\nvcoarc51.sys [2007-01-09 14:25]

S3 SQLAgent$BYGGSAFE;SQLAgent$BYGGSAFE;C:\Programfiler\Microsoft SQL Server\MSSQL$BYGGSAFE\Binn\sqlagent.EXE -i BYGGSAFE []

S3 Via4in1;Via4in1;C:\Documents and Settings\Administrator\Via4in1.sys []

S4 viaagp;VIA AGP-bussfilter;C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-03 23:07]

*Newly Created Service* - CATCHME

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-27 18:20:11

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-12-27 18:20:50

.

2007-12-11 19:43:00 --- E O F ---

HijackThis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:25:42, on 27.12.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Norman\Npm\bin\ELOGSVC.EXE

C:\Norman\Npm\Bin\Zanda.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\Norman\Npm\bin\ZLH.EXE

C:\WINDOWS\sm56hlpr.exe

C:\Programfiler\Byggsafe\Byggsafe Total\Bin\ByggsafeServer.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Norman\Nvc\BIN\NIP.EXE

C:\Programfiler\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Microsoft SQL Server\MSSQL$BYGGSAFE\Binn\sqlservr.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Norman\Npm\bin\NJEEVES.EXE

C:\Norman\Nvc\BIN\NVCSCHED.EXE

C:\Norman\Nvc\bin\nvcoas.exe

C:\WINDOWS\System32\alg.exe

C:\Norman\Nvc\bin\cclaw.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Oddvar Bergesen\Skrivebord\Ny mappe\HiJackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll