CID og Adserver

Ruben2k · 13. februar 2008

jeg har CID å Adserver popup, Bruker windows vista, Hva skal jeg gjøre??

snippsat · 13. februar 2008

Last ned HijackThis legg i egen mappe på skrivebordet.

Start programmet og velg "Do a system scan and save a logfile".

Loggfilen kopierer du og limer inn i posten din.

Endret 13. februar 2008 av SNIPPSAT

Ruben2k · 13. februar 2008

Last ned HijackThis legg i egen mappe på skrivebordet.
Start programmet og velg "Do a system scan and save a logfile".

Loggfilen kopierer du og limer inn i posten din.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:09:45, on 13.02.2008

Platform: Windows Vista SP1, v.668 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.17052)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe

C:\Program Files\Hp\QuickPlay\QPService.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Razer\Diamondback\razerhid.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Switcher\Switcher.exe

C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\NETGEAR\WG111v2\WG111v2.exe

C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Razer\Diamondback\razerofa.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe

C:\Windows\system32\taskmgr.exe

C:\Users\Ruben\Desktop\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...O&pf=laptop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...O&pf=laptop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...O&pf=laptop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe

O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [switcher] "C:\Program Files\Switcher\Switcher.exe" /quiet

O4 - HKCU\..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [axistwo] "C:\ProgramData\infoelseelse.225fo"

O4 - HKCU\..\Run: [vc log bows face] "C:\ProgramData\mail first chin.5t4g3iq"

O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKLM\..\Policies\Explorer\Run: [ZboardTray] "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch

O4 - Startup: OneNote 2007 Screen Clipper og Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe

O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: &Winamp Toolbar Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Blogg dette - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blogg dette i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.EXE

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe

O23 - Service: RelevantKnowledge - RelevantKnowledge - C:\Windows\system32\rlservice.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: SCM_Service - Unknown owner - C:\Windows\System32\WinService.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 14483 bytes

snippsat · 13. februar 2008

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Problemer med og få kjørt combofix disable antivirus.

Last ned kjør SAS free

Post logg.

Etter dette restart on ny HijackThis

Endret 13. februar 2008 av SNIPPSAT

Ruben2k · 13. februar 2008

Last Combofix ned ,legg på skrivebordet.
Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Problemer med og få kjørt combofix disable antivirus.

Last ned kjør SAS free

Post logg.

Etter dette restart on ny HijackThis

Cobofix

ComboFix 08-02-13.2 - Ruben 2008-02-13 22:49:45.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.156 [GMT 1:00]

Running from: C:\Users\Ruben\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Windows\system32\WinService.exe

.

((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))

.

2008-02-13 19:01 . 2008-02-13 19:01 <DIR> d-------- C:\Program Files\nLite

2008-02-13 15:47 . 2008-02-13 15:47 <DIR> d-------- C:\Windows\LastGood

2008-02-12 21:13 . 2008-02-13 18:50 <DIR> d-------- C:\Program Files\Steam

2008-02-12 21:13 . 2008-02-12 22:37 <DIR> d-------- C:\Program Files\Common Files\Steam

2008-02-12 14:34 . 2008-02-12 14:34 <DIR> d-------- C:\Program Files\Trust

2008-02-12 14:33 . 2008-02-12 14:33 <DIR> d-------- C:\download

2008-02-11 17:11 . 2008-02-11 17:11 <DIR> d-------- C:\Users\All Users\Windows Genuine Advantage

2008-02-07 12:57 . 2008-02-07 12:57 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf

2008-02-06 17:37 . 2008-02-06 17:37 <DIR> d-------- C:\Users\All Users\Yahoo! Companion

2008-02-06 17:37 . 2008-02-06 17:37 <DIR> d-------- C:\ProgramData\Yahoo! Companion

2008-02-05 17:44 . 2008-02-05 17:44 <DIR> d-------- C:\Program Files\Yahoo!

2008-02-05 17:43 . 2008-02-05 17:45 <DIR> d-------- C:\Program Files\CCleaner

2008-02-02 15:04 . 2008-02-02 15:04 <DIR> d-------- C:\Users\Administrator\AppData

2008-01-27 19:49 . 2008-01-27 19:49 <DIR> d-------- C:\Program Files\The Sir. Community

2008-01-27 19:21 . 2008-01-27 19:22 <DIR> d-------- C:\Program Files\BfSV

2008-01-26 21:23 . 2008-01-26 21:23 <DIR> d-------- C:\Program Files\Lavalys

2008-01-25 18:55 . 2008-01-25 18:55 229,376 --a------ C:\Windows\System32\UCI32A27.dll

2008-01-19 18:26 . 2008-01-19 18:26 <DIR> d-------- C:\Program Files\NETGEAR

2008-01-19 18:26 . 2007-05-04 11:29 290,816 --a------ C:\Windows\System32\SCMLib.dll

2008-01-19 18:26 . 2007-01-18 12:20 21,728 --a------ C:\Windows\System32\drivers\SCMNdisP.sys

2008-01-18 17:19 . 2008-02-13 15:29 <DIR> d-------- C:\Users\Ruben\AppData\Roaming\skypePM

2008-01-18 17:19 . 2008-01-18 17:19 32 --a------ C:\Users\All Users\ezsid.dat

2008-01-18 17:19 . 2008-01-18 17:19 32 --a------ C:\ProgramData\ezsid.dat

2008-01-18 17:16 . 2008-01-18 17:16 <DIR> d-------- C:\Program Files\Skype

2008-01-18 17:16 . 2008-01-18 17:16 <DIR> d-------- C:\Program Files\Common Files\Skype

2008-01-16 14:31 . 2007-12-12 03:15 2,032,128 --a------ C:\Windows\System32\win32k.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-13 17:50 160,240 ----a-w C:\Users\Ruben\AppData\Roaming\nvModes.dat

2008-02-13 15:03 --------- d-----w C:\Users\Ruben\AppData\Roaming\LimeWire

2008-02-13 14:47 --------- d-----w C:\ProgramData\Microsoft Help

2008-02-13 14:30 --------- d-----w C:\Users\Ruben\AppData\Roaming\Skype

2008-02-12 15:30 --------- d-----w C:\Users\Ruben\AppData\Roaming\MiniLyrics

2008-02-12 13:40 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2

2008-02-11 22:29 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-02-11 14:42 --------- d-----w C:\Users\Ruben\AppData\Roaming\uTorrent

2008-02-11 14:42 --------- d-----w C:\ProgramData\Memo Drive Vc Log

2008-02-11 14:42 --------- d-----w C:\ProgramData\FLEXnet

2008-02-11 14:42 --------- d-----w C:\Program Files\uTorrent

2008-02-06 16:40 --------- d-----w C:\Users\Ruben\AppData\Roaming\teamspeak2

2008-02-04 07:22 --------- d-----w C:\ProgramData\NVIDIA

2008-02-02 14:05 --------- d-----w C:\Program Files\Microsoft Works

2008-02-01 15:32 --------- d-----w C:\ProgramData\Symantec

2008-01-31 21:40 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys

2008-01-31 21:37 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe

2008-01-28 01:45 --------- d-----w C:\Users\Ruben\AppData\Roaming\Roxio

2008-01-28 01:44 --------- d-----w C:\ProgramData\Roxio

2008-01-26 21:00 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-01-26 18:25 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys

2008-01-18 16:16 --------- d-----w C:\ProgramData\Skype

2008-01-15 08:54 10,537 ----a-w C:\Windows\system32\drivers\COH_Mon.cat

2008-01-15 04:28 706 ----a-w C:\Windows\system32\drivers\COH_Mon.inf

2008-01-12 17:32 23,904 ----a-w C:\Windows\system32\drivers\COH_Mon.sys

2008-01-11 16:53 --------- d-----w C:\Program Files\MSN Messenger

2008-01-11 16:48 --------- d-----w C:\Program Files\Windows Live

2008-01-11 16:37 --------- d-----w C:\ProgramData\WLInstaller

2008-01-11 00:05 --------- d-----w C:\Program Files\SubMagic

2008-01-10 09:23 --------- d-----w C:\Program Files\Diverse

2008-01-09 23:12 413,696 ----a-w C:\Windows\System32\wrap_oal.dll

2008-01-09 23:12 110,592 ----a-w C:\Windows\System32\OpenAL32.dll

2008-01-09 23:12 --------- d-----w C:\Program Files\OpenAL

2008-01-09 23:12 --------- d-----w C:\Program Files\Eidos

2008-01-09 22:06 --------- d-----w C:\Users\Ruben\AppData\Roaming\Webcammax

2008-01-09 21:46 --------- d-----w C:\Users\Ruben\AppData\Roaming\Creative

2008-01-09 21:43 --------- d-----w C:\Program Files\Creative

2008-01-09 20:47 --------- d-----w C:\ProgramData\Messenger Plus!

2008-01-08 19:55 --------- d-----w C:\Program Files\ValuSoft

2007-12-31 19:43 --------- d-----w C:\Program Files\FlightGear

2007-12-31 16:33 --------- d-----w C:\Users\Ruben\AppData\Roaming\flightgear.org

2007-12-26 18:41 --------- d-----w C:\Program Files\Java

2007-12-24 20:46 --------- d-----w C:\ProgramData\Sonic

2007-12-23 23:20 --------- d-----w C:\Program Files\LFS

2007-12-21 02:05 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2007-12-19 22:50 --------- d-----w C:\Program Files\lfs2

2007-12-17 23:52 --------- d-----w C:\ProgramData\WindowsSearch

2007-12-17 17:17 174 --sha-w C:\Program Files\desktop.ini

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Sidebar

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Photo Gallery

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Mail

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Journal

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Defender

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Collaboration

2007-12-17 17:01 --------- d-----w C:\Program Files\Windows Calendar

2007-12-17 16:23 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2007-12-17 16:23 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2007-12-17 13:42 --------- d-----w C:\ProgramData\Phone inter

2007-12-17 13:30 --------- d-----w C:\Program Files\Messenger Plus! Live

2007-12-17 13:30 --------- d-----w C:\Program Files\Circle Developement

2007-12-13 19:11 6,656 ----a-w C:\Windows\System32\kbd106n.dll

2007-12-13 11:37 --------- d-----w C:\Users\Ruben\AppData\Roaming\dvdcss

2007-11-30 12:19 986,680 ----a-w C:\Windows\System32\winload.exe

2007-11-30 12:19 926,776 ----a-w C:\Windows\System32\winresume.exe

2007-11-30 12:17 614,968 ----a-w C:\Windows\System32\ci.dll

2007-11-30 12:17 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll

2007-11-30 12:17 3,599,928 ----a-w C:\Windows\System32\ntkrnlpa.exe

2007-11-30 12:17 3,547,192 ----a-w C:\Windows\System32\ntoskrnl.exe

2007-11-30 12:17 247,352 ----a-w C:\Windows\System32\clfs.sys

2007-11-30 12:17 177,208 ----a-w C:\Windows\System32\halmacpi.dll

2007-11-30 12:16 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe

2007-11-30 12:16 141,880 ----a-w C:\Windows\System32\halacpi.dll

2007-11-30 12:15 51,768 ----a-w C:\Windows\System32\PSHED.DLL

2007-11-30 12:15 1,203,792 ----a-w C:\Windows\System32\ntdll.dll

2007-11-30 12:14 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL

2007-11-30 12:14 21,560 ----a-w C:\Windows\System32\kdusb.dll

2007-11-30 12:14 19,512 ----a-w C:\Windows\System32\kdcom.dll

2007-11-30 12:13 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL

2007-11-30 12:13 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL

2007-11-30 12:12 4,595,712 ----a-w C:\Windows\System32\AuthFWSnapin.dll

2007-11-30 12:12 241,720 ----a-w C:\Windows\System32\rsaenh.dll

2007-11-30 12:12 155,704 ----a-w C:\Windows\System32\dssenh.dll

2007-11-30 12:12 131,640 ----a-w C:\Windows\System32\basecsp.dll

2007-11-30 12:11 996,352 ----a-w C:\Windows\System32\WMNetMgr.dll

2007-11-30 12:11 99,840 ----a-w C:\Windows\System32\ulib.dll

2007-11-30 12:11 98,304 ----a-w C:\Windows\System32\TapiMigPlugin.dll

2007-11-30 12:11 95,744 ----a-w C:\Windows\System32\xwtpw32.dll

2007-11-30 12:11 95,232 ----a-w C:\Windows\System32\xactsrv.dll

2007-11-30 12:11 94,208 ----a-w C:\Windows\System32\Tabbtn.dll

2007-11-30 12:11 92,672 ----a-w C:\Windows\System32\ufat.dll

2007-11-30 12:11 92,160 ----a-w C:\Windows\System32\wlancfg.dll

2007-11-30 12:11 913,408 ----a-w C:\Windows\System32\WlanMM.dll

2007-11-30 12:11 9,728 ----a-w C:\Windows\System32\wscproxystub.dll

2007-11-30 12:11 9,216 ----a-w C:\Windows\System32\WSHTCPIP.DLL

2007-11-30 12:11 9,216 ----a-w C:\Windows\System32\wship6.dll

2007-11-30 12:11 89,600 ----a-w C:\Windows\System32\txflog.dll

2007-11-30 12:11 88,576 ----a-w C:\Windows\System32\infocardapi.dll

2007-11-30 12:11 88,064 ----a-w C:\Windows\System32\wiascanprofiles.dll

2007-11-30 12:11 878,592 ----a-w C:\Windows\System32\wer.dll

2007-11-30 12:11 87,552 ----a-w C:\Windows\System32\WUDFCoinstaller.dll

2007-11-04 14:01 88 --sh--r C:\Windows\System32\524BBB5CE5.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]

2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-11-30 13:07 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2007-11-30 13:10 2153472 C:\Windows\System32\oobefldr.dll]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2007-11-30 13:07 125952]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:08 21686568]

"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 11:32 81920]

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16 171464]

"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:23 221568]

"Switcher"="C:\Program Files\Switcher\Switcher.exe" [2007-10-28 11:35 425984]

"Taskbar Shuffle"="C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe" [2007-06-16 14:47 827392]

"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]

"axistwo"="C:\ProgramData\infoelseelse.225fo" [2007-12-17 14:32 213008]

"vc log bows face"="C:\ProgramData\mail first chin.5t4g3iq" [2007-12-17 14:44 147472]

"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-10-27 18:00 299008]

"Steam"="C:\Program Files\Steam\Steam.exe" [2008-02-12 21:18 1266936]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2007-11-30 13:07 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-11-30 13:13 1008184]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 01:50 1021224]

"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]

"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-03-28 16:45 176128]

"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-06 10:28 180224]

"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 10:54 50696]

"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 12:18 472776]

"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 15:12 317128]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]

"Diamondback"="C:\Program Files\Razer\Diamondback\razerhid.exe" [2007-02-14 10:15 147456]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]

"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 01:29 102400]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]

"WinampAgent"="C:\Program Files\Winamp\wianmpa.exe" [ ]

"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-16 12:00 531272]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 06:59 115816]

"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51 583048]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-07 02:35 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-07 02:35 8534560]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-07 02:35 81920]

"WheelMouse"="C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe" [2007-03-13 15:33 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

C:\Users\Ruben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper og Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]

wkcalrem.LNK - C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe [2005-08-19 13:14:28 21504]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

NETGEAR WG111v2 Smart Wizard.lnk - C:\Program Files\NETGEAR\WG111v2\WG111v2.exe [2008-01-19 18:26:44 1261568]

WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 11:10:00 394856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"ZboardTray"= "C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Zboard]

Winlognotif.dll

R0 SCMNdisP;General NDIS Protocol Driver;C:\Windows\system32\DRIVERS\scmndisp.sys [2007-01-18 12:20]

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\IDS-DI~1\20080212.002\IDSvix86.sys [2007-11-06 16:58]

R2 RelevantKnowledge;RelevantKnowledge;C:\Windows\system32\rlservice.exe [2007-10-11 20:44]

R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 05:27]

R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-15 17:50]

R3 P0630VID;Creative WebCam Live!;C:\Windows\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07]

R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-12 21:22]

R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]

S2 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-01-05 23:04]

S2 SCM_Service;SCM_Service;C:\Windows\System32\WinService.exe []

S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 16:43]

S3 Razerlow;Razerlow USB Filter Driver;C:\Windows\system32\Drivers\Razerlow.sys [2005-04-24 21:43]

S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\Windows\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53]

S3 UMPass;Microsoft UMPass Driver;C:\Windows\system32\DRIVERS\umpass.sys [2007-11-30 11:27]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab3e9076-80ca-11dc-8ee7-001b24794e85}]

\shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da90626f-826e-11dc-bad8-001b24794e85}]

\shell\AutoRun\command - G:\setup.exe

.

Contents of the 'Scheduled Tasks' folder

"2007-12-18 19:47:59 C:\Windows\Tasks\Norton AntiVirus - Run Full System Scan - Ruben.job"

- C:\Program Files\Norton AntiVirus\Navw32.exeB/TASK:

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-13 22:59:59

Windows 6.0.6001 Service Pack 1, v.668 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-02-13 23:03:47

ComboFix-quarantined-files.txt 2008-02-13 22:03:40

.

2008-02-13 14:48:38 --- E O F ---

norbat · 13. februar 2008

Hvis du har installert Messenger Plus Live m/sponsorprogram, så får du disse popupene. Du kan derfor starte med å avinstallere Messenger Plus.

Kjør deretter på nytt Combofix. Post ny logg.

Ruben2k · 14. februar 2008

Nå står det INGEN LYDUTDATAENHET ER INSTALLERT

norbat · 14. februar 2008

Det burde være den minste bekymringen. Du har hatt en trojan med bakdørfunksjon som har mulighet til å registrere din aktivitet på PC-en. Post derfor en ny combofix-logg etter at du har fjernet Messenger Plus!

Ruben2k · 14. februar 2008

Det burde være den minste bekymringen. Du har hatt en trojan med bakdørfunksjon som har mulighet til å registrere din aktivitet på PC-en. Post derfor en ny combofix-logg etter at du har fjernet Messenger Plus!

ComboFix 08-02-13.2 - Ruben 2008-02-14 14:35:23.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.164 [GMT 1:00]

Running from: C:\Users\Ruben\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 )))))))))))))))))))))))))))))))

.

2008-02-13 23:07 . 2008-02-13 23:07 <DIR> d-------- C:\Users\Ruben\AppData\Roaming\SUPERAntiSpyware.com

2008-02-13 23:07 . 2008-02-13 23:07 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com

2008-02-13 23:07 . 2008-02-13 23:07 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com

2008-02-13 23:07 . 2008-02-13 23:16 <DIR> d-------- C:\Program Files\SUPERAntiSpyware