Ace_X Skrevet 12. februar 2008 Del Skrevet 12. februar 2008 (endret) Noen som vet hva dette betyr? Og evt hva som bør gjøres? Se bilde.. Endret 14. februar 2008 av Ace_X Lenke til kommentar
norbat Skrevet 12. februar 2008 Del Skrevet 12. februar 2008 Du kan kjøre gjennom langversjonen i følgende tråd: https://www.diskusjon.no/index.php?showtopic=691246. Loggene det spørres om, poster du her i din egen tråd Lenke til kommentar
Ace_X Skrevet 12. februar 2008 Forfatter Del Skrevet 12. februar 2008 OK. Her kommer HJT log hijackthis.txt Lenke til kommentar
norbat Skrevet 12. februar 2008 Del Skrevet 12. februar 2008 Det ligger malware der, ja, så fortsett med de andre programmene det henvises til i langversjonen Lenke til kommentar
Ace_X Skrevet 13. februar 2008 Forfatter Del Skrevet 13. februar 2008 Ser at SAS finner noe, men programmet "låser" seg etter scanning! Har prøvd noen ganger nå! Kanskje en reinnstallering må til? Lenke til kommentar
norbat Skrevet 13. februar 2008 Del Skrevet 13. februar 2008 Start opp i sikker modus (tapp F8 under oppstart og velg sikker modus). Kjør SAS-scanningen derfra og se om ikke det kan gjøre at SAS fullfører. Om det fortsatt ikke fungerer, så kjører du bare videre med veiledningen. Reinstallering synes jeg du skal vente med Lenke til kommentar
Ace_X Skrevet 13. februar 2008 Forfatter Del Skrevet 13. februar 2008 (endret) Da har jeg endelig fått kjørt SAS, Combofix og HJT igjen. Her følger logger... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:56:55, on 13.02.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\conime.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\OEM04Mon.exe C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe C:\Program Files\DELL\MediaDirect\PCMService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\ehome\ehtray.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Nordic Pirat Forum\NPFTrayIcon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Fingerprint Reader Suite\psqltray.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\DELL\QuickSet\quickset.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Windows\Explorer.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Sony Ericsson\Mobile2\File Manager\FMObexServer.exe C:\Windows\system32\notepad.exe C:\Program Files\Opera\Opera.exe C:\Windows\System32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.skimaker.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe O4 - HKLM\..\Run: [sigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Policies\Explorer\Run: [system Patcher] BTCPatcher.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE') O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: NPFTrayIcon.lnk = C:\Program Files\Nordic Pirat Forum\NPFTrayIcon.exe O4 - Global Startup: QuickSet.lnk = ? O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O15 - Trusted Zone: *.line6.net O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- End of file - 8854 bytes SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 02/13/2008 at 10:30 PM Application Version : 3.9.1008 Core Rules Database Version : 3401 Trace Rules Database Version: 1393 Scan type : Complete Scan Total Scan Time : 01:04:26 Memory items scanned : 780 Memory threats detected : 0 Registry items scanned : 9845 Registry threats detected : 20 File items scanned : 88322 File threats detected : 21 Trojan.Unclassified/IEBROWSERCMP HKLM\Software\Classes\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93} HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93} HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93} HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\InprocServer32 HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\InprocServer32#ThreadingModel HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\ProgID HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\Programmable HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\TypeLib HKCR\CLSID\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}\VersionIndependentProgID C:\WINDOWS\SYSTEM32\IEBROWSERC.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93} Unclassified.Unknown Origin HKLM\Software\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2} HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2} HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2} HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\InprocServer32 HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\InprocServer32#ThreadingModel HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\ProgID HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\Programmable HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\TypeLib HKCR\CLSID\{9C8A568E-4201-478A-8536-526CF371D2E2}\VersionIndependentProgID C:\WINDOWS\SYSTEM32\NST598A.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2} Adware.Tracking Cookie C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][2].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][2].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@pro-market[2].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@apmebf[1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@advertising[2].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@adecn[1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][2].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@tradedoubler[1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\nils_vågslid@doubleclick[1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\Low\nils_vå[email protected][1].txt C:\Users\Nils Vågslid\AppData\Roaming\Microsoft\Windows\Cookies\Low\nils_vå[email protected][2].txt Adware.AdRotator/AdsSite C:\WINDOWS\SYSTEM32\ADSSITE-REMOVE.EXE Adware.AdRotator/RightOnz C:\WINDOWS\SYSTEM32\RIGHTONADZ-UNINST.EXE ComboFix.txt Endret 13. februar 2008 av Ace_X Lenke til kommentar
norbat Skrevet 13. februar 2008 Del Skrevet 13. februar 2008 Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt. Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. File:: C:\Windows\System32\rar.exe C:\Windows\System32\AdssiteSocial-uninstall.exe Registry:: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "System Patcher"=- Post ny combofix-logg og fortell hvordan PC-en kjører. Lenke til kommentar
Ace_X Skrevet 14. februar 2008 Forfatter Del Skrevet 14. februar 2008 Ny Combofix log følger. PC-en virker ren nå. Får i hvert fall ikke opp det bilde jeg hadde første post lenger ComboFix 08-02-13.1 - Nils Vågslid 2008-02-14 7:47:38.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1044.18.864 [GMT 1:00] Running from: C:\Users\Nils Vågslid\Desktop\ComboFix.exe Command switches used :: C:\Users\Nils Vågslid\Desktop\CFScript.txt * Created a new restore point FILE C:\Windows\System32\AdssiteSocial-uninstall.exe C:\Windows\System32\rar.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\System32\AdssiteSocial-uninstall.exe C:\Windows\System32\rar.exe . ((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))) . 2008-02-14 03:06 . 2008-02-14 03:06 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe 2008-02-14 03:06 . 2008-02-14 03:06 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe 2008-02-14 03:06 . 2008-02-14 03:06 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys 2008-02-14 03:06 . 2008-02-14 03:06 110,136 --a------ C:\Windows\System32\drivers\ataport.sys 2008-02-14 03:06 . 2008-02-14 03:06 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys 2008-02-14 03:06 . 2008-02-14 03:06 21,560 --a------ C:\Windows\System32\drivers\atapi.sys 2008-02-14 03:06 . 2008-02-14 03:06 15,928 --a------ C:\Windows\System32\drivers\pciide.sys 2008-02-14 03:05 . 2008-02-14 03:05 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll 2008-02-14 03:05 . 2008-02-14 03:05 1,686,528 --a------ C:\Windows\System32\gameux.dll 2008-02-14 03:05 . 2008-02-14 03:05 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys 2008-02-14 03:05 . 2008-02-14 03:05 558,080 --a------ C:\Windows\System32\oleaut32.dll 2008-02-14 03:05 . 2008-02-14 03:05 216,632 --a------ C:\Windows\System32\drivers\netio.sys 2008-02-14 03:05 . 2008-02-14 03:05 167,424 --a------ C:\Windows\System32\tcpipcfg.dll 2008-02-14 03:05 . 2008-02-14 03:05 24,064 --a------ C:\Windows\System32\netcfg.exe 2008-02-14 03:05 . 2008-02-14 03:05 22,016 --a------ C:\Windows\System32\netiougc.exe 2008-02-14 03:03 . 2008-02-14 03:03 1,383,424 --a------ C:\Windows\System32\mshtml.tlb 2008-02-10 09:47 . 2008-02-10 09:47 <DIR> d-------- C:\Program Files\uTorrent 2008-02-07 19:51 . 2008-02-07 19:51 <DIR> d-------- C:\Users\Nils Vågslid\Adobe audition 2008-02-07 19:51 . 2008-02-07 19:51 <DIR> d-------- C:\Users\Nils Vågslid\Adobe audition 2008-02-07 19:41 . 2008-02-07 19:41 <DIR> d-------- C:\Users\Nils Vågslid\Application Data 2008-02-07 19:41 . 2008-02-07 19:41 <DIR> d-------- C:\Users\Nils Vågslid\Application Data 2008-01-25 19:25 . 2008-01-25 19:25 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage 2008-01-25 19:25 . 2008-01-25 19:25 <DIR> d-------- C:\ProgramData\Office Genuine Advantage 2008-01-16 19:38 . 2008-01-20 14:42 <DIR> d-------- C:\Users\All Users\Autodesk 2008-01-16 19:38 . 2008-01-20 14:42 <DIR> d-------- C:\ProgramData\Autodesk 2008-01-16 19:38 . 2008-01-16 19:42 <DIR> d-------- C:\Program Files\AutoCAD 2008 2008-01-15 22:14 . 2008-01-15 22:47 <DIR> d-------- C:\Users\Nils Vågslid\Autocad 2008-01-15 22:14 . 2008-01-15 22:47 <DIR> d-------- C:\Users\Nils Vågslid\Autocad . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-14 06:49 3,145,728 --sha-w C:\Users\Nils Vågslid\ntuser.dat 2008-02-14 06:49 3,145,728 --sha-w C:\Users\Nils Vågslid\ntuser.dat 2008-02-14 02:06 --------- d-----w C:\ProgramData\Microsoft Help 2008-02-14 02:05 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-02-14 02:05 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-02-14 02:05 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-02-14 02:05 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-02-14 02:03 824,832 ----a-w C:\Windows\System32\wininet.dll 2008-02-14 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-14 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-14 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-13 21:55 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-02-13 16:21 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-13 16:05 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\LimeWire 2008-02-10 14:25 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\uTorrent 2008-02-07 22:36 --------- d-----w C:\Program Files\ESET 2008-02-06 09:18 --------- d-----w C:\ProgramData\CyberLink 2008-01-20 13:42 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\Autodesk 2008-01-16 18:42 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2008-01-13 22:06 --------- d-----w C:\Program Files\MagicISO 2008-01-13 13:51 --------- d-----w C:\Program Files\Autodesk 2008-01-13 08:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-12 13:41 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\Adobe 2008-01-12 12:08 --------- d---a-w C:\ProgramData\TEMP 2008-01-12 11:49 --------- d-----w C:\ProgramData\FLEXnet 2008-01-12 11:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-12 11:37 --------- d-----w C:\Program Files\Bonjour 2008-01-12 11:26 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-01-12 11:25 --------- d-----w C:\Program Files\Adobe CS3 2008-01-11 22:04 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\Ahead 2008-01-11 02:12 --------- d-----w C:\Program Files\Windows Mail 2008-01-11 02:03 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys 2008-01-11 02:03 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys 2008-01-11 02:02 11,776 ----a-w C:\Windows\System32\sbunattend.exe 2008-01-11 02:02 --------- d-----w C:\Program Files\Windows Sidebar 2007-12-26 20:36 --------- d-----w C:\Program Files\Common Files\Ahead 2007-12-26 20:29 --------- d-----w C:\ProgramData\Nero 2007-12-26 20:29 --------- d-----w C:\Program Files\Nero 2007-12-22 20:50 --------- d-----w C:\Program Files\Opera 2007-12-22 20:15 --------- d-----w C:\ProgramData\Roxio 2007-12-22 19:03 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\Roxio 2007-12-21 14:39 10,752 ----a-w C:\Windows\System32\WhoisCL.exe 2007-12-15 02:04 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2007-12-15 02:04 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2007-12-15 02:04 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2007-12-15 02:02 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys 2007-12-15 02:02 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys 2007-12-15 02:02 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys 2007-12-15 02:02 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys 2007-12-14 21:29 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\SUPERAntiSpyware.com 2007-12-14 21:29 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com 2007-12-14 19:57 --------- d-----w C:\Program Files\RegistryFix 2007-12-14 18:56 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\Line 6 2007-12-14 18:55 --------- d-----w C:\Program Files\VideoLAN 2007-12-14 18:20 --------- d-----w C:\Users\Nils Vågslid\AppData\Roaming\SpywareBot 2007-12-14 18:14 --------- d-----w C:\Program Files\Trend Micro 2007-11-17 07:02 1,244,672 ----a-w C:\Windows\System32\mcmde.dll 2007-11-15 02:03 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2007-11-15 02:03 67,584 ----a-w C:\Windows\System32\wlanhlp.dll 2007-11-15 02:03 542,720 ----a-w C:\Windows\System32\sysmain.dll 2007-11-15 02:03 502,784 ----a-w C:\Windows\System32\wlansvc.dll 2007-11-15 02:03 47,104 ----a-w C:\Windows\System32\wlanapi.dll 2007-11-15 02:03 297,984 ----a-w C:\Windows\System32\wlansec.dll 2007-11-15 02:03 290,816 ----a-w C:\Windows\System32\wlanmsm.dll 2007-11-15 02:03 24,064 ----a-w C:\Windows\System32\wtsapi32.dll 2007-11-15 02:03 2,923,520 ----a-w C:\Windows\explorer.exe 2007-11-15 02:03 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2007-09-18 18:50 174 --sha-w C:\Program Files\desktop.ini 2007-09-03 20:21 76 --sh--r C:\Windows\CT4CET.bin 2007-09-16 08:00 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-09-16 08:00 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-09-16 08:00 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay] @={F2F31467-B1AC-4df0-AE79-FD5FA085E22B} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen] @={A3E208F7-0E3A-4182-A7A6-B169D5D691AA} [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}] 2007-04-16 23:13 721408 --a------ C:\Program Files\Fingerprint Reader Suite\farchns.dll [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}] 2007-04-16 23:13 721408 --a------ C:\Program Files\Fingerprint Reader Suite\farchns.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-04 05:01 1006264] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-10 08:00 857648] "OEM04Mon.exe"="C:\Windows\OEM04Mon.exe" [2007-06-11 10:01 36864] "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-06-29 07:15 405504] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-05-24 13:41 138008] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-05-24 13:40 154392] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-05-24 13:40 133912] "SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-09-03 21:19 77824] "PSQLLauncher"="C:\Program Files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 22:50 49168] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 11:37 81920] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 11:22 221184] "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-04-16 16:10 184320] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-09-03 21:36 1862144] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-21 07:16 949376] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 11:35 221184] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 08:16 528384] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 17:55:50 703280] NPFTrayIcon.lnk - C:\Program Files\Nordic Pirat Forum\NPFTrayIcon.exe [2004-07-26 20:16:52 615424] QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-09-03 21:22:42 45056] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] C:\Windows\system32\psqlpwd.dll 2007-04-16 23:04 86528 C:\Windows\System32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL R2 BcmSqlStartupSvc;Oppstartstjeneste for Business Contact Manager SQL Server;"C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [2008-01-16 11:21] R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 04:29] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-05-24 13:35] R3 btwaudio;Bluetooth-lydenhet;C:\Windows\system32\drivers\btwaudio.sys [2006-11-07 02:37] R3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2006-11-07 00:13] R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-07 00:13] R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-05-24 13:40] R3 NETw4v32;Intel® Wireless WiFi Link kortdriver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-25 15:14] R3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM04Vfx.sys [2007-03-06 03:45] R3 OEM04Vid;Creative Camera OEM004 Driver;C:\Windows\system32\DRIVERS\OEM04Vid.sys [2007-05-07 10:00] R3 TcUsb;TC USB Kernel Driver;C:\Windows\system32\Drivers\tcusb.sys [2007-04-16 22:44] S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" [2007-02-10 04:29] S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 08:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3d35ab0-931f-11dc-a176-0015c57d5e79}] \shell\AutoRun\command - F:\setupSNK.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-14 07:49:48 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-14 7:50:25 ComboFix-quarantined-files.txt 2008-02-14 06:50:23 ComboFix2.txt 2008-02-13 21:53:13 . 2008-02-14 02:09:34 --- E O F --- Lenke til kommentar
norbat Skrevet 14. februar 2008 Del Skrevet 14. februar 2008 Ja, dette ser fint ut Du kan avinstallere combofix ved å skrive combofix /u fra kjør-vinduet (start->kjør). Hvis du ikke ønsker å beholde SAS, så avinstallerer du det fra legg til / fjern programmer. Lenke til kommentar
Ace_X Skrevet 14. februar 2008 Forfatter Del Skrevet 14. februar 2008 Hjertlig takk for fantastisk hjelp! Har jeg forstått det rett setter jeg nå "LØST" i emnefeltet... Lenke til kommentar
norbat Skrevet 14. februar 2008 Del Skrevet 14. februar 2008 Ja, du har forstått det rett. Surf trygt. Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå