[LØST] Hjelp til å renske gammel PC.

Ace_X · 20. februar 2008

Hei,

Har en gammel Stasjonær PC som jeg bruker på kontoret. Får opp MSVCP71.dll error ved oppstart og når jeg åpner Outlook.

Maskinen har XP.

Trenger hjelp til å gjøre denne PC-en ren.

Poster med HJT logg.

På forhånd takk.

Endret 20. februar 2008 av Ace_X

p@ge · 20. februar 2008

kanskje denne side kan hjelpe deg:

http://www.dll-files.com/dllindex/dll-files.shtml?msvcp71

lykke til

Ace_X · 20. februar 2008

kanskje denne side kan hjelpe deg:

http://www.dll-files.com/dllindex/dll-files.shtml?msvcp71

lykke til

Ja, jeg prøvde det, men får fremdeles opp denne erroren!

Mulig jeg har gjort noe feil!

snippsat · 20. februar 2008

For vista,samme for xp.

http://www.softwaretipspalace.com/MS_Windo...s-and-fixes.php

Post den hjt loggen.

Ace_X · 20. februar 2008

Sorry, den skulle ha vært med i første post!

Her er den

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:44:46, on 20.02.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\Programfiler\Eicon\Diva\DiTask.exe

C:\Programfiler\Eicon\Diva\Divamon.exe

C:\Programfiler\Eicon\Diva\watch.exe

C:\Programfiler\Eicon\Diva\cgserver.exe

C:\Programfiler\Fellowes\MediaFACE 4.0\SetHook.exe

C:\Programfiler\Eicon\Diva\diinfo.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\Programfiler\eBay\eBay Toolbar2\eBayTBDaemon.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Eset\nod32kui.exe

C:\Programfiler\Dell Printers\paperport\pptd40nt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\URGENT~1\ubackup.exe

C:\Programfiler\Microsoft ActiveSync\wcescomm.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Programfiler\Sony Corporation\Image Transfer\SonyTray.exe

C:\Programfiler\Nordic Pirat Forum\NPFTrayIcon.exe

C:\Programfiler\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe

C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE

C:\Programfiler\VeriSign\NAVI\naviagent.exe

C:\Programfiler\Eset\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\Uniblue\RegistryBooster 2\RegistryBooster.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.online.no:8080;ftp=proxy.online.no:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programfiler\VeriSign\i-Nav\i-nav_4_2_1.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - (no file)

O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programfiler\eBay\eBay Toolbar2\eBayTB.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programfiler\VeriSign\i-Nav\i-nav_4_2_1.dll

O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programfiler\eBay\eBay Toolbar2\eBayTB.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [DiTask.exe] "C:\Programfiler\Eicon\Diva\DiTask.exe"

O4 - HKLM\..\Run: [Divamon.exe] "C:\Programfiler\Eicon\Diva\Divamon.exe"

O4 - HKLM\..\Run: [Eicon TechnologyLAN_DAEMON] "C:\Programfiler\Eicon\Diva\watch.exe"

O4 - HKLM\..\Run: [CGServer] "C:\Programfiler\Eicon\Diva\cgserver.exe"

O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Programfiler\DirectCD\DirectCD.exe

O4 - HKLM\..\Run: [MediaFace Integration] C:\Programfiler\Fellowes\MediaFACE 4.0\SetHook.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [eBayToolbar] C:\Programfiler\eBay\eBay Toolbar2\eBayTBDaemon.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Programfiler\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Dell MFP Color Laser Printer 3115cn Launcher] "C:\Programfiler\Dell Printers\Dell MFP Color Laser Printer 3115cn\Address Book Editor\Launcher.exe" /s

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Programfiler\Fellesfiler\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Programfiler\Dell Printers\paperport\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Programfiler\Dell Printers\paperport\IndexSearch.exe"

O4 - HKLM\..\Run: [DLPSP] "C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ABCBACKUP] "C:\PROGRA~1\URGENT~1\ubackup.exe" 1

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programfiler\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2] C:\Programfiler\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programfiler\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programfiler\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Image Transfer.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: NPFTrayIcon.lnk = C:\Programfiler\Nordic Pirat Forum\NPFTrayIcon.exe

O4 - Global Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Programfiler\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &eBay Search - res://C:\Programfiler\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: Hjelp for i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)

O9 - Extra 'Tools' menuitem: Hjelp for i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)

O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Programfiler\VeriSign\i-Nav\i-nav_4_2_1.dll

O9 - Extra 'Tools' menuitem: Innstillinger for i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Programfiler\VeriSign\i-Nav\i-nav_4_2_1.dll

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O15 - Trusted Zone: *.line6.net

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE

O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Programfiler\VeriSign\NAVI\naviagent.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programfiler\Eset\nod32krn.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O24 - Desktop Component 0: (no name) - file:///C:/Documents%20and%20Settings/Nils%20V%E5gslid/Mine%20dokumenter/V%E5gslid.com/Diverse%20bilder/fiath.jpg

--

End of file - 10468 bytes

snippsat · 20. februar 2008

Start HijackThis finn disse linjene merk dem,så trykk fixed checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - (no file)

O4 - HKLM\..\Run: [Dell MFP Color Laser Printer 3115cn Launcher] "C:\Programfiler\Dell Printers\Dell MFP Color Laser Printer 3115cn\Address Book Editor\Launcher.exe" /s

O4 - Global Startup: Image Transfer.lnk = ?

O9 - Extra button: Hjelp for i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)

O9 - Extra 'Tools' menuitem: Hjelp for i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Last ned kjør CCleaner

Gå til 'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere xx.

Kjør register-renser og.

Restart og ny hjt-logg.

Ace_X · 20. februar 2008

Her kommer logger:

Cobofix:

ComboFix 08-02-20.2 - Nils Vågslid 2008-02-20 19:28:34.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.422 [GMT 1:00]

Running from: C:\Documents and Settings\Nils Vågslid\Skrivebord\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\LocalService\Programdata\NetMon

C:\Documents and Settings\LocalService\Programdata\NetMon\domains.txt

C:\Documents and Settings\LocalService\Programdata\NetMon\log.txt

C:\Programfiler\windows

C:\Programfiler\windows\WinUpdate.fld

C:\WINDOWS\keyboard231.dat

.

((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))

.

2008-02-20 18:19 . 2003-03-19 03:14 499,712 --a------ C:\WINDOWS\SYSTEM32\MSVCP71.DLL

2008-02-20 17:44 . 2008-02-20 17:44 <DIR> d-------- C:\Programfiler\Trend Micro

2008-02-20 17:29 . 2008-02-20 17:31 <DIR> d-------- C:\WINDOWS\ShellNew

2008-02-20 17:14 . 2008-02-20 17:14 <DIR> d-------- C:\Documents and Settings\Nils Vågslid\Programdata\Uniblue

2008-02-20 15:51 . 2008-02-20 15:53 <DIR> d-------- C:\Programfiler\SUPERAntiSpyware

2008-02-20 15:51 . 2008-02-20 15:51 <DIR> d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard

2008-02-20 15:51 . 2008-02-20 15:51 <DIR> d-------- C:\Documents and Settings\Nils Vågslid\Programdata\SUPERAntiSpyware.com

2008-02-20 15:51 . 2008-02-20 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\SUPERAntiSpyware.com

2008-02-19 18:19 . 2008-02-19 18:19 <DIR> d-------- C:\Documents and Settings\Nils Vågslid\Programdata\ScanSoft

2008-02-19 17:58 . 2007-02-22 00:38 144,280 --a------ C:\WINDOWS\SYSTEM32\dlsrm.dll

2008-02-19 17:56 . 2007-01-12 15:07 29,913 --a------ C:\WINDOWS\maxlink.ini

2008-02-19 17:55 . 2008-02-19 17:55 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\InstallShield

2008-02-19 17:54 . 2008-02-19 17:54 <DIR> d-------- C:\Programfiler\Fellesfiler\ScanSoft Shared

2008-02-19 17:54 . 2008-02-19 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\ScanSoft

2008-02-19 17:52 . 2008-02-19 17:58 <DIR> d-------- C:\Programfiler\Dell Printers

2008-02-19 17:51 . 2007-05-15 16:00 131,162 --a------ C:\WINDOWS\SYSTEM32\dlxbazil.dll

2008-02-19 17:50 . 2007-04-04 03:34 532,480 -ra------ C:\WINDOWS\SYSTEM32\dlsbairs.dll

2008-02-19 17:50 . 2007-04-16 09:46 48,128 -ra------ C:\WINDOWS\SYSTEM32\dlsbaisc.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-20 16:58 --------- d-----w C:\Programfiler\Uniblue

2008-02-20 16:31 --------- d-----w C:\Programfiler\Microsoft ActiveSync

2008-02-20 14:29 --------- d-----w C:\Programfiler\MultiProg

2008-02-20 14:24 --------- d-----w C:\Programfiler\Fellesfiler\Adobe

2008-02-20 14:24 --------- d-----w C:\Documents and Settings\Nils Vågslid\Programdata\Lavasoft

2008-02-20 14:20 --------- d--h--w C:\Programfiler\InstallShield Installation Information

2008-02-20 14:05 --------- d-----w C:\Programfiler\HyperSnap-DX 5

2008-02-20 14:03 --------- d-----w C:\Programfiler\NoAdware4

2008-02-20 13:55 --------- d-----w C:\Documents and Settings\Nils Vågslid\Programdata\LimeWire

2008-02-19 18:49 --------- d-----w C:\Documents and Settings\Nils Vågslid\Programdata\WholeSecurity

2008-02-19 16:54 --------- d-----w C:\Programfiler\Fellesfiler\InstallShield

2008-02-08 20:06 --------- d-----w C:\Programfiler\PartyGaming.Net

2008-02-07 22:18 --------- d-----w C:\Programfiler\ESET

2008-01-23 17:15 --------- d-----w C:\Programfiler\LimeWire

2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll

2008-01-02 17:42 --------- d-----w C:\Programfiler\FREE Hi-Q Recorder

2007-12-19 22:58 347,136 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll

2007-12-18 09:51 179,584 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys

2007-12-08 05:17 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll

2007-12-06 11:05 625,664 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe

2007-12-06 11:04 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe

2007-12-06 11:00 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe

2007-12-06 04:59 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll

2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\oleaut32.dll

2007-12-04 18:42 550,912 ------w C:\WINDOWS\SYSTEM32\oleaut32.dll

2007-07-15 10:35 165,687 ----a-w C:\Programfiler\AKGBackup.zip

2007-02-23 11:01 7,680 ----a-w C:\Programfiler\inspectr.exe

2007-02-08 08:41 21,822,168 ----a-w C:\Programfiler\AdbeRdr80_en_US.exe

2006-10-22 15:37 2,746,504 ----a-w C:\Programfiler\ToolbarSetup.exe

2006-10-07 06:33 14,342,722 ----a-w C:\Programfiler\3gp-video-converter-21501.exe

2006-08-26 13:01 42,875,509 ----a-w C:\Programfiler\NSWBE06901IN.exe

2006-08-26 10:10 45,592,097 ----a-w C:\Programfiler\NIS06910NO.exe

2006-01-05 19:46 55 ----a-w C:\Programfiler\FixWelch.log

2006-01-04 20:05 1,101,152 ----a-w C:\Programfiler\Windows-KB890830-V1.11-ENU.exe

2006-01-04 19:48 175,256 ----a-w C:\Programfiler\FixWelch.exe

2006-01-04 19:42 135,360 ----a-w C:\Programfiler\FixBlastD.exe

2006-01-04 19:38 55 ----a-w C:\Programfiler\FixBlast.log

2005-11-13 19:38 229,376 ----a-w C:\Programfiler\GprogLic.exe

2005-09-03 08:45 28,888 ----a-w C:\Documents and Settings\Nils Vågslid\Programdata\GDIPFONTCACHEV1.DAT

2005-06-01 10:33 28,888 ----a-w C:\Documents and Settings\Kamilla\Programdata\GDIPFONTCACHEV1.DAT

2005-04-22 16:22 3,177,871 ----a-w C:\Programfiler\HS5Setup.exe

2005-04-20 21:11 13,606,992 ----a-w C:\Programfiler\counterspy_download.exe

2005-03-29 14:01 2,128,042 ----a-w C:\Programfiler\txpeng473.exe

2005-02-10 13:17 1,406,698 ----a-w C:\Programfiler\wsftp67.exe

2005-02-10 08:40 3,347,057 ----a-w C:\Programfiler\SFTPMSI.exe

2005-01-30 21:23 22,464,616 ----a-w C:\Programfiler\iTunesSetup.exe

2005-01-30 10:38 1,802,961 ----a-w C:\Programfiler\installere_online.exe

2005-01-12 08:16 2,452,326 ----a-w C:\Programfiler\DCPlusPlus-0.668.exe

2004-12-30 17:15 48,469,595 ----a-w C:\Programfiler\GuitarPort v2[1].51.0 Installer.exe

2004-09-30 21:28 809 ----a-w C:\Programfiler\Fellesfiler\Gratulerer.txt

2004-06-25 23:00 71,680 ----a-w C:\Documents and Settings\Nils Vågslid\conax.exe

2004-05-14 14:26 49,152 ----a-w C:\Documents and Settings\Nils Vågslid\update.exe

2004-01-08 23:00 58,368 ----a-w C:\Documents and Settings\Nils Vågslid\detect.exe

2003-11-23 13:51 4,948,240 ----a-w C:\Programfiler\SetupDl.exe

2003-10-12 09:11 836,608 ----a-w C:\Programfiler\iview385.exe

2003-10-04 16:20 19,208,239 ----a-w C:\Programfiler\ecdc_v5.3.5.10_plt_enu.exe

2003-10-04 15:56 835,895 ----a-w C:\Programfiler\DriveUp5.3.5j.exe

2003-10-04 15:42 6,909,867 ----a-w C:\Programfiler\engine_v6.1.1.17.exe

2003-10-04 15:31 170,019 ----a-w C:\Programfiler\DU20030911.exe

2003-10-04 14:13 1,545,218 ----a-w C:\Programfiler\dMC-r9.exe

2003-10-04 12:10 1,291,552 ----a-w C:\Programfiler\WindowsXP-KB823980-x86-NOR.exe

2003-10-04 11:49 135,360 ----a-w C:\Programfiler\FixBlast.exe

2003-09-20 08:35 1,717 ----a-w C:\Programfiler\default.ins

2003-09-08 10:52 4,033 ----a-w C:\Programfiler\Internet

2003-04-16 11:29 164,624 ----a-w C:\Programfiler\kmd.exe

2003-04-16 10:29 770,048 ----a-w C:\Programfiler\winmx331.exe

2001-03-07 15:40 777,216 ----a-w C:\Programfiler\sslsvc.dll

2000-09-28 15:08 24,576 ----a-w C:\Programfiler\Stub.exe

2000-09-28 12:24 997 ----a-w C:\Programfiler\client.crt

2000-09-28 12:24 946 ----a-w C:\Programfiler\client.key

2000-09-28 12:24 428 ----a-w C:\Programfiler\sslsvc.cnt

2000-09-28 12:24 23,029 ----a-w C:\Programfiler\sslsvc.hlp

2000-09-28 12:24 1,005 ----a-w C:\Programfiler\ipswitch.crt

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:03 15360]

"ABCBACKUP"="C:\PROGRA~1\URGENT~1\ubackup.exe" [2007-04-20 15:21 4597760]

"H/PC Connection Agent"="C:\Programfiler\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]

"SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

"Uniblue RegistryBooster 2"="C:\Programfiler\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59 155648]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59 126976]

"DiTask.exe"="C:\Programfiler\Eicon\Diva\DiTask.exe" [2002-04-10 10:21 143360]

"Divamon.exe"="C:\Programfiler\Eicon\Diva\Divamon.exe" [2002-04-10 10:28 32768]

"Eicon TechnologyLAN_DAEMON"="C:\Programfiler\Eicon\Diva\watch.exe" [2002-04-10 10:27 192512]

"CGServer"="C:\Programfiler\Eicon\Diva\cgserver.exe" [2002-04-10 10:26 40960]

"AdaptecDirectCD"="C:\Programfiler\DirectCD\DirectCD.exe" [2000-10-30 04:00 643072]

"MediaFace Integration"="C:\Programfiler\Fellowes\MediaFACE 4.0\SetHook.exe" [2002-09-17 18:31 53248]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"Sony Ericsson PC Suite"="C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744]

"eBayToolbar"="C:\Programfiler\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2006-10-10 07:29 484856]

"iTunesHelper"="C:\Programfiler\iTunes\iTunesHelper.exe" [2006-06-14 16:24 278528]

"QuickTime Task"="C:\Programfiler\QuickTime\qttask.exe" [2006-11-22 09:41 282624]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 14:40 155648]

"nod32kui"="C:\Programfiler\Eset\nod32kui.exe" [2007-10-03 21:21 949376]

"SSBkgdUpdate"="C:\Programfiler\Fellesfiler\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]

"PaperPort PTD"="C:\Programfiler\Dell Printers\paperport\pptd40nt.exe" [2007-05-08 15:45 30248]

"IndexSearch"="C:\Programfiler\Dell Printers\paperport\IndexSearch.exe" [2007-05-08 15:43 46632]

"DLPSP"="C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2007-07-25 15:25 393944]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:03 15360]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

Adobe Reader Speed Launch.lnk - C:\Programfiler\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048]

Adobe Reader Synchronizer.lnk - C:\Programfiler\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]

Microsoft Office.lnk - C:\Programfiler\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

NPFTrayIcon.lnk - C:\Programfiler\Nordic Pirat Forum\NPFTrayIcon.exe [2004-07-26 21:16:52 615424]

Ulead Photo Express Calendar Checker For My Custom Edition.lnk - C:\Programfiler\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe [2003-04-01 23:16:55 57344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoViewOnDrive"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

R0 DiMaint;Eicon Maintenance Driver;C:\WINDOWS\system32\DRIVERS\DISDN\dimaint.sys [2002-12-04 14:49]

R2 DiCapi;Eicon CAPI 2.0 Driver;C:\WINDOWS\system32\DRIVERS\DISDN\capi202k.sys [2001-06-12 14:27]

R2 DiPort;Eicon Port Driver;C:\WINDOWS\system32\DRIVERS\DISDN\diport40.sys [2002-10-16 15:32]

R2 DLSDB;Dell Printer Status Database;C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE [2006-12-07 16:52]

R3 cmeu0wdm;CardMan 2020;C:\WINDOWS\system32\DRIVERS\cmeu0wdm.sys [2005-05-23 09:30]

R3 DiWan;Eicon Driver for all Diva Client cards;C:\WINDOWS\system32\DRIVERS\DISDN\Diwan.sys [2002-10-03 16:35]

R3 GPWADrv;Service for L6 GuitarPort Driver (WDM);C:\WINDOWS\system32\Drivers\GPWADrv.sys [2004-10-25 22:09]

R3 L6DP;L6DP;C:\WINDOWS\system32\Drivers\l6dp.sys [2002-07-16 04:39]

S2 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;"C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-02-27 13:59]

S3 Mp3Drv;Typhoon_ MusicBox Mp3 Player Control Driver;C:\WINDOWS\system32\Drivers\Mp3Drv.sys [2003-06-20 08:47]

S3 OMNUSB;Omnikey AG CardMan 2020 USB-smartkortleser;C:\WINDOWS\system32\DRIVERS\sccmusbm.sys [2001-08-17 20:51]

S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41]

S3 StScsi;StScsi;C:\WINDOWS\system32\DRIVERS\StScsi.sys [2003-06-20 08:47]

S4 viaagp;VIA AGP-bussfilter;C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 07:07]

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-20 19:32:22

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-02-20 19:33:49

ComboFix-quarantined-files.txt 2008-02-20 18:33:33

.

2008-02-14 02:04:57 --- E O F ---

Ny HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:56:25, on 20.02.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\Programfiler\Eicon\Diva\DiTask.exe

C:\Programfiler\Eicon\Diva\Divamon.exe

C:\Programfiler\Eicon\Diva\watch.exe

C:\Programfiler\Eicon\Diva\cgserver.exe

C:\Programfiler\Fellowes\MediaFACE 4.0\SetHook.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\Programfiler\eBay\eBay Toolbar2\eBayTBDaemon.exe

C:\Programfiler\Eicon\Diva\diinfo.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Eset\nod32kui.exe

C:\Programfiler\Dell Printers\paperport\pptd40nt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\URGENT~1\ubackup.exe

C:\Programfiler\Microsoft ActiveSync\wcescomm.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE

C:\Programfiler\VeriSign\NAVI\naviagent.exe

C:\Programfiler\Eset\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Nordic Pirat Forum\NPFTrayIcon.exe

C:\Programfiler\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe

C:\WINDOWS\system32\wuauclt.exe