Utrolig mye problemer med dataen.

qwerty1234 · 23. mars 2008

Ja, hallo ^^

Ja, dataen min erelt ute å kjører nå for tiden. Det er kommet virus, det er jeg helt sikker på.

Vi får ikke oppdatert Norton. Da blir den stoppet, og alt klikker. Det kommer stadig opp sånne:

Det pleier å komme en til, men den kommer ikke ofte. Ja, jeg trykker avbryt på disse, hele tiden. Så er startsiden min, det er denne siden:

Det kommer hele tiden masse sånn. Bakgrunnen min er også forandret. Internetten er helt idiotisk, stopper opp, vil ikke dit og dit, og når jeg skal forandre Internet options, så klikker den helt!

Adobe photoshop CS3, klikker også. Når jeg skal ta new, så forsvinner OK, Cancel og diverse andre knapper. Og når jeg får OK til, så kommer det opp at jeg har for mye ting oppe, selv om jeg ikke harnoe somhelst!

ÆØÅ funker ikke på de fleste sidene, og typisk, ikke på de sidene jeg er mest på i alle fall.

Mange programmer vil heller ikke starte, eller så er de helt idiotiske.

Dataen min er helt ute å kjører nå.. Noen som har noen tips til hva jeg kan gjøre?

IcedInsanity · 23. mars 2008

Lag deg en tråd i Antivirusprogrammer og datasikkerhet delen av forumet.

Last ned Hijackthis legg i egen mappe på skrivebordet.

Start programmet og velg "Trykk scan og save log" .

Loggfilen kopierer du og limer inn i posten din.

Så kommer nok noen å ser på det...eg tipper SNIPPSAT hjelper deg..han hjalp meg.

Endret 23. mars 2008 av Diesel_

snippsat · 23. mars 2008

Ja post en hjt-logg.

Ta med en combofix og.

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Helst med skjult tekst [1skjul] logg her [1/skjul] fjern 1 for skjult tekst.

Endret 23. mars 2008 av SNIPPSAT

IcedInsanity · 23. mars 2008

Er det noe framgang MJ ?

qwerty1234 · 23. mars 2008

virker nesten sånn! Det kommer aldri opp sånne ruter mer, i alle fall ikke enda.

Her er HijackThis loggen, eller hva det nå het xd

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:09, on 2008-03-23

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe

C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE

C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ARPWRMSG.EXE

C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\usbtapnp.exe

C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Telenor\Online Start\Telenor.exe

C:\Program Files\DAP\DAP.EXE

C:\Program Files\Common Files\AdvancedCleaner\abhlp.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE

C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {16975C1E-950B-F58A-B187-08ED8F89A6B0} - C:\Program Files\Ynzojsuk\dgejggks.dll

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: speed-bit Toolbar - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} - C:\Program Files\speed-bit\tbspe0.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: The Pirate Bay Toolbar - {a33fa729-d155-4b23-842b-2c665ecabdb6} - C:\Program Files\The_Pirate_Bay\tbThe_.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: speed-bit Toolbar - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} - C:\Program Files\speed-bit\tbspe0.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: emotigt - {AA8B47FF-72C3-45C3-A7F1-8E86D1C65E67} - C:\WINDOWS\emotigt.dll

O3 - Toolbar: The Pirate Bay Toolbar - {a33fa729-d155-4b23-842b-2c665ecabdb6} - C:\Program Files\The_Pirate_Bay\tbThe_.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [uSBTA] C:\WINDOWS\system32\usbtapnp.exe

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Program Files\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP

O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w

O4 - HKLM\..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe

O4 - HKLM\..\Run: [sM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe

O4 - HKLM\..\Run: [AbyssmoClient] C:\Program Files\Common Files\AdvancedCleaner\abhlp.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZJxdm130YYNO

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk

O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Mimmi\Start Menu\Programs\IMVU\Run IMVU.lnk

O9 - Extra button: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

O16 - DPF: {00C1329F-D6C9-46A2-8C3F-23F50977F0A5} (SMUpdateAX Class) - http://www.liquidlab.se/smupdate/stallet/SetupInf.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows...ggPublisher.exe

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.fossebakken.com/controls/IlosoftImageUpload.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: winlft32 - winlft32.dll (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe

O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--

End of file - 18039 bytes

Er det denne du mente med ComboFix?

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-03-22.3 - HP_Administrator 2008-03-23 15:10:47.1 - NTFSx86

Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe

* Created a new restore point

.

TimedOut: progfile.dat

-- Other TimeOuts --

Findstr -MIF:/ sursen

CF2291.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" >progfile.dat"

VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*"

CF2291.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"

Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"

GREP -i "C:\\Program Files\\[^\\]*\\[^\\]*$"

VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"

CF2291.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" >progfile.dat"

VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*"

CF2291.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

C:\Documents and Settings\Gry`s roterom\Desktop\Error Cleaner.url

C:\Documents and Settings\Gry`s roterom\Desktop\Privacy Protector.url

C:\Documents and Settings\Gry`s roterom\Desktop\Spyware&Malware Protection.url

C:\Documents and Settings\Gry`s roterom\Favorites\Error Cleaner.url

C:\Documents and Settings\Gry`s roterom\Favorites\Privacy Protector.url

C:\Documents and Settings\Gry`s roterom\Favorites\Spyware&Malware Protection.url

C:\Documents and Settings\HP_Administrator\Desktop\Error Cleaner.url

C:\Documents and Settings\HP_Administrator\Desktop\Privacy Protector.url

C:\Documents and Settings\HP_Administrator\Desktop\Spyware&Malware Protection.url

C:\Documents and Settings\HP_Administrator\Favorites\Error Cleaner.url

C:\Documents and Settings\HP_Administrator\Favorites\Privacy Protector.url

C:\Documents and Settings\HP_Administrator\Favorites\Spyware&Malware Protection.url

C:\Documents and Settings\Mika Josefine\Application Data\FunWebProducts

C:\Documents and Settings\Mika Josefine\Application Data\FunWebProducts\Data\Mika Josefine\avatar.dat

C:\Documents and Settings\Mika Josefine\Application Data\FunWebProducts\Data\Mika Josefine\register.dat

C:\Documents and Settings\Mika Josefine\Desktop\Error Cleaner.url

C:\Documents and Settings\Mika Josefine\Desktop\Privacy Protector.url

C:\Documents and Settings\Mika Josefine\Desktop\Spyware&Malware Protection.url

C:\Documents and Settings\Mika Josefine\Favorites\Error Cleaner.url

C:\Documents and Settings\Mika Josefine\Favorites\Privacy Protector.url

C:\Documents and Settings\Mika Josefine\Favorites\Spyware&Malware Protection.url

C:\Documents and Settings\Mika\Application Data\FunWebProducts

C:\Documents and Settings\Mika\Application Data\FunWebProducts\Data\Mika\avatar.dat

C:\Documents and Settings\Mika\Application Data\FunWebProducts\Data\Mika\register.dat

C:\Documents and Settings\Mimmi\Desktop\Error Cleaner.url

C:\Documents and Settings\Mimmi\Desktop\Privacy Protector.url

C:\Documents and Settings\Mimmi\Desktop\Spyware&Malware Protection.url

C:\Documents and Settings\Mimmi\Favorites\Error Cleaner.url

C:\Documents and Settings\Mimmi\Favorites\Privacy Protector.url

C:\Documents and Settings\Mimmi\Favorites\Spyware&Malware Protection.url

C:\Program Files\FunWebProducts

C:\Program Files\FunWebProducts\ScreenSaver\Images7220424.urr

C:\Program Files\FunWebProducts\ScreenSaver\Images72D7E7F.urr

C:\Program Files\FunWebProducts\ScreenSaver\Images\16CA0B71.urr

C:\Program Files\FunWebProducts\ScreenSaver\Images\17ACA0DF.urr

C:\Program Files\FunWebProducts\ScreenSaver\Images\409D717F.urr

C:\Program Files\FunWebProducts\ScreenSaver\Images\wrkparam.lst

C:\Program Files\FunWebProducts\Shared016E275.dat

C:\Program Files\FunWebProducts\Shared26A6F84.dat

C:\Program Files\FunWebProducts\Shared421457F.dat

C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html

C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html

C:\Program Files\internet explorer\msimg32.dll

C:\Program Files\MyWebSearch

C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL

C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL

C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL

C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG

C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR

C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE

C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL

C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV

C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT

C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR

C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST

C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE

C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR

C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST

C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL

C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE

C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE

C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE

C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL

C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE

C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL

C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL

C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL

C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\close.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\login.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\unmax.gif

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm

C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico

C:\Program Files\MyWebSearch\bar\Cache001EF3D

C:\Program Files\MyWebSearch\bar\Cache01B59B5

C:\Program Files\MyWebSearch\bar\Cache0383557.bin

C:\Program Files\MyWebSearch\bar\Cache038395F.bin

C:\Program Files\MyWebSearch\bar\Cache0383DD3.bin

C:\Program Files\MyWebSearch\bar\Cache0B31B03

C:\Program Files\MyWebSearch\bar\Cache14115FF

C:\Program Files\MyWebSearch\bar\Cache165F2D3

C:\Program Files\MyWebSearch\bar\Cache1F4054F

C:\Program Files\MyWebSearch\bar\Cache21435E9

C:\Program Files\MyWebSearch\bar\Cache21472D2

C:\Program Files\MyWebSearch\bar\Cache21475B1.bin

C:\Program Files\MyWebSearch\bar\Cache21483DA.bin

C:\Program Files\MyWebSearch\bar\Cache2148FFF.bin

C:\Program Files\MyWebSearch\bar\Cache2149F9F.bin

C:\Program Files\MyWebSearch\bar\Cache214AE55.bin

C:\Program Files\MyWebSearch\bar\Cache214B54A

C:\Program Files\MyWebSearch\bar\Cache214C41F.bin

C:\Program Files\MyWebSearch\bar\Cache214CFA8.bin

C:\Program Files\MyWebSearch\bar\Cache214D9CA.bin

C:\Program Files\MyWebSearch\bar\Cache214E5C0.bin

C:\Program Files\MyWebSearch\bar\Cache214EF55.bin

C:\Program Files\MyWebSearch\bar\Cache214FA23.bin

C:\Program Files\MyWebSearch\bar\Cache3451DC2

C:\Program Files\MyWebSearch\bar\Cache6330C6C

C:\Program Files\MyWebSearch\bar\Cache\10AF945A

C:\Program Files\MyWebSearch\bar\Cache\19F32DCF

C:\Program Files\MyWebSearch\bar\Cache\1FED0C3B

C:\Program Files\MyWebSearch\bar\Cache\1FED3261

C:\Program Files\MyWebSearch\bar\Cache\files.ini

C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S

C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S

C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S

C:\Program Files\MyWebSearch\bar\History\search2

C:\Program Files\MyWebSearch\bar\icons\CM.ICO

C:\Program Files\MyWebSearch\bar\icons\MFC.ICO

C:\Program Files\MyWebSearch\bar\icons\PSS.ICO

C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO

C:\Program Files\MyWebSearch\bar\icons\WB.ICO

C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO

C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S

C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S

C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S

C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S

C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S

C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S

C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S

C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S

C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S

C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S

C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S

C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S

C:\Program Files\MyWebSearch\bar\Search\COMMON.F3S

C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm

C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat

C:\Program Files\MyWebSearch\bar\Settings\setting2.htm

C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak

C:\Program Files\MyWebSearch\bar\Settings\settings.dat

C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak

C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL

C:\Program Files\SecCenter

C:\Program Files\SecCenter\scprot4.exe

C:\Program Files\SecCenter\scprot4.exe.bak

C:\WINDOWS\admgcx.dll

C:\WINDOWS\bdmanager.dll

C:\WINDOWS\dat.txt

C:\WINDOWS\dmdvpnwgp.dll

C:\WINDOWS\fsxloqf.exe

C:\WINDOWS\PerfInfo

C:\WINDOWS\PerfInfo\nDPz8DL0y0uc.exe

C:\WINDOWS\PerfInfo\nDPz8DL0y0ud.exe

C:\WINDOWS\privacy_danger

C:\WINDOWS\privacy_danger\images\capt.gif

C:\WINDOWS\privacy_danger\images\danger.jpg

C:\WINDOWS\privacy_danger\images\down.gif

C:\WINDOWS\privacy_danger\images\spacer.gif

C:\WINDOWS\privacy_danger\index.htm

C:\WINDOWS\rs.txt

C:\WINDOWS\search_res.txt

C:\WINDOWS\system32\_000006_.tmp.dll

C:\WINDOWS\system32\_000007_.tmp.dll

C:\WINDOWS\system32\_000010_.tmp.dll

C:\WINDOWS\system32\_000011_.tmp.dll

C:\WINDOWS\system32\_000012_.tmp.dll

C:\WINDOWS\system32\f3PSSavr.scr

C:\WINDOWS\system32\UpMedia

D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://onsafepro.com

hxxp://softworldnetwork.com

.

((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 )))))))))))))))))))))))))))))))

.

2008-03-23 15:19 . 2008-03-23 15:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-03-23 15:19 . 2008-03-23 15:26 1,409 --a------ C:\WINDOWS\QTFont.for

2008-03-23 15:05 . 2008-03-23 15:05 <DIR> d-------- C:\Program Files\Trend Micro

2008-03-21 15:48 . 2008-03-21 15:48 <DIR> d-------- C:\Documents and Settings\Gry`s roterom\.limewire

2008-03-20 20:46 . 2008-03-20 20:46 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Shared

2008-03-20 20:46 . 2008-03-20 20:47 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Incomplete

2008-03-20 20:45 . 2008-03-23 09:06 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\LimeWire

2008-03-18 21:17 . 2008-03-18 21:20 64,146,632 --a------ C:\nis2008.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-23 14:26 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-03-23 13:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-03-21 15:18 --------- d-----w C:\Documents and Settings\Mika Josefine\Application Data\Skype

2008-03-21 09:41 --------- d-----w C:\Documents and Settings\Mimmi\Application Data\LimeWire

2008-03-21 09:37 --------- d-----w C:\Documents and Settings\Mimmi\Application Data\IMVU

2008-03-08 12:30 --------- d-----w C:\Program Files\DAP

2008-02-27 14:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec

2008-02-26 23:04 --------- d-----w C:\Program Files\Silkroad

2008-02-23 03:54 --------- d-----w C:\Program Files\LimeWire

2008-02-21 14:32 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Jasc Software Inc

2008-02-21 11:39 --------- d-----w C:\Program Files\Common Files\AdvancedCleaner

2008-02-21 11:11 --------- d-----w C:\Documents and Settings\Gry`s roterom\Application Data\LimeWire

2008-02-19 02:03 --------- d-----w C:\Program Files\MSXML 6.0

2008-02-18 11:19 --------- d-----w C:\Program Files\Norton SystemWorks Basic Edition

2008-02-18 08:53 --------- d-----w C:\Documents and Settings\Mimmi\Application Data\Autodesk

2008-02-18 08:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk

2008-02-17 22:55 --------- d-----w C:\Program Files\Common Files\Autodesk Shared

2008-02-17 22:53 --------- d-----w C:\Program Files\Autodesk

2008-02-17 21:17 --------- d-----w C:\Program Files\The_Pirate_Bay

2008-02-17 21:17 --------- d-----w C:\Program Files\Conduit

2008-02-17 21:06 --------- d-----w C:\Program Files\MediaEldoradoCodec

2008-02-17 16:51 172,032 ----a-w C:\WINDOWS\emotigt.dll

2008-02-17 09:58 --------- d-----w C:\Program Files\MediaMonkey

2008-02-17 09:11 --------- d-----w C:\Program Files\IMVU

2008-02-04 13:40 --------- d-----w C:\Program Files\CeWe Color

2008-02-02 16:30 --------- d-----w C:\Documents and Settings\Gry`s roterom\Application Data\AdobeAUM

2008-02-02 00:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet

2008-01-29 19:04 --------- d-----w C:\Program Files\Pivot Stickfigure Animator

2008-01-26 14:32 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-01-26 09:09 --------- d-----w C:\Program Files\YAFSScreen

2008-01-18 18:28 732 ----a-w C:\Documents and Settings\Mimmi\Application Data\wklnhst.dat

2008-01-15 19:08 667,978 ----a-w C:\WINDOWS\unins000.exe

2007-11-25 18:52 131,072 ----a-w C:\Documents and Settings\All Users\Application Data\vadqdkxy.dll

2007-11-25 01:59 131,072 ----a-w C:\Documents and Settings\All Users\Application Data\qjuhgdob.dll

2007-11-23 19:10 131,072 ----a-w C:\Documents and Settings\All Users\Application Data\kvsfutip.dll

2007-11-07 02:16 166 ----a-w C:\Documents and Settings\Gry`s roterom\Application Data\wklnhst.dat

2007-06-10 17:26 790 ----a-w C:\Documents and Settings\Mika\Application Data\wklnhst.dat

2007-06-06 21:23 136 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat

2006-11-17 23:35 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{16975C1E-950B-F58A-B187-08ED8F89A6B0}]

2007-11-25 19:52 131072 --a------ C:\Program Files\Ynzojsuk\dgejggks.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2ba521ac-b9b9-4433-ba45-dba2f02cba5a}]

2007-11-22 17:54 1502232 --a------ C:\Program Files\speed-bit\tbspe0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

2008-02-14 14:54 1555480 --a------ C:\Program Files\The_Pirate_Bay\tbThe_.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{2BA521AC-B9B9-4433-BA45-DBA2F02CBA5A}"= "C:\Program Files\speed-bit\tbspe0.dll" [2007-11-22 17:54 1502232]

"{AA8B47FF-72C3-45C3-A7F1-8E86D1C65E67}"= "C:\WINDOWS\emotigt.dll" [2008-02-17 17:51 172032]

"{A33FA729-D155-4B23-842B-2C665ECABDB6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2008-02-14 14:54 1555480]

[HKEY_CLASSES_ROOT\clsid\{2ba521ac-b9b9-4433-ba45-dba2f02cba5a}]

[HKEY_CLASSES_ROOT\clsid\{aa8b47ff-72c3-45c3-a7f1-8e86d1c65e67}]

[HKEY_CLASSES_ROOT\emotigt.1]

[HKEY_CLASSES_ROOT\TypeLib\{72F08F38-A4C9-4B61-BAB1-6E03F4DB3849}]

[HKEY_CLASSES_ROOT\emotigt]

[HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-01 15:13 68856]

"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-08-18 17:49 307200]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 05:56 64512]

"ftutil2"="ftutil2.dll" [2004-06-07 22:05 106496 C:\WINDOWS\system32\ftutil2.dll]

"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 12:54 16010240 C:\WINDOWS\RTHDCPL.EXE]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 08:19 77312 C:\WINDOWS\arpwrmsg.exe]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 14:35 7634944]

"nwiz"="nwiz.exe" [2006-10-31 14:35 1622016 C:\WINDOWS\system32\nwiz.exe]

"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 07:35 49152]

"DMAScheduler"="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 09:05 90112]

"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 22:14 237568]

"PCDrProfiler"="" []

"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 22:34 249856]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 18:18 49152]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-03 00:06 180269]

"USBTA"="C:\WINDOWS\system32\usbtapnp.exe" [2005-07-04 18:12 118784]

"DXM6Patch_981116"="C:\WINDOWS\p_981116.exe" [1998-11-30 18:04 497376]

"LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe" [2000-06-09 20:32 81920]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]

"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 00:11 771704]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-05 09:42 282624]

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344]

"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]

"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30 517768]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]

"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]

"Telenor Online Start"="C:\Program Files\Telenor\Online Start\Telenor.exe" [2006-11-30 14:51 178312]

"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [2007-10-25 17:35 4568576]

"My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ]

"NSWosCheck"="C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-12-03 01:41 25472]

"SM_IAN"="C:\Program Files\AdvancedCleaner Free\ian_monitor.exe" [ ]

"AbyssmoClient"="C:\Program Files\Common Files\AdvancedCleaner\abhlp.exe" [2007-09-27 10:57 270336]

C:\Documents and Settings\Mimmi\Start Menu\Programs\Startup\

IMVU.lnk - C:\Program Files\IMVU\IMVUClient.exe [2008-01-30 20:14:00 49408]

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-08-16 23:00:00 147456]

C:\Documents and Settings\Gry`s roterom\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-08-16 23:00:00 147456]

C:\Documents and Settings\Mika\Start Menu\Programs\Startup\

IMVU.lnk - C:\Program Files\IMVU\IMVUClient.exe [2008-01-30 20:14:00 49408]

C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-08-16 23:00:00 147456]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-17 15:12:32 110592]

Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-17 15:12:32 110592]

HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 18:40:44 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]

Source= file:///C:\WINDOWS\privacy_danger\index.htm

FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winlft32]

winlft32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"C:\\Program Files\\LimeWire\\LimeWire.exe"=

"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\Adobe\\Photoshop Elements 5.0\\AdobePhotoshopElementsMediaServer.exe"=

"C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=

"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=

"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=

"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=

"C:\\Program Files\\Telenor\\Online Start\\Telenor.exe"=

"C:\\Program Files\\backburner 2\\monitor.exe"=

"C:\\Program Files\\backburner 2\\manager.exe"=

"C:\\Program Files\\backburner 2\\server.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-02-15 03:07]

R3 DUSBTAWAN;DrayTek USB NDISWAN Driver;C:\WINDOWS\system32\DRIVERS\musbwn2k.sys [2001-01-31 11:43]

R3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 18:44]

S3 FakeWDMmdm;DWDMCOMM;C:\WINDOWS\system32\DRIVERS\dusbcomm.sys [2003-03-13 10:13]

S3 mDTA128;miniVigor USB;C:\WINDOWS\system32\DRIVERS\musbta2kc.sys [2005-07-27 15:22]

S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 05:32]

S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 05:32]

S3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-04-01 16:16]

*Newly Created Service* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

"2008-03-17 19:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Kjør fullstendig systemsøk - HP_Administrator.job"

Men etter jeg kjørte ComboFix, virker dataen mye bedre ^^

IcedInsanity · 23. mars 2008

Nå kommer snart SNIPP og ser over loggene tenker eg..du er nok ikke fri for tull enda....

qwerty1234 · 23. mars 2008

Nå kommer snart SNIPP og ser over loggene tenker eg..du er nok ikke fri for tull enda....

Ja, du har vel rett

Håper jeg blir kvitt det etterhvert.

norbat · 23. mars 2008

Fortsett med følgende:

Last ned SAS (gratisversjonen), installer, oppdater og kjør en full (Complete) scan.

Post ny HJT-logg + loggen fra SAS (preferences->statistics/logs), så ser vi hvilken rester som må ryddes bort.

snippsat · 23. mars 2008

Ja dette kan du gjøre.

Ja som norbat sier så hadde nok sas tatt litt mere.

Kan kjøre dette og så en en ny hjt-logg.

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt.

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen.

Post logg c:\combofix

Folder::

C:\Program Files\Common Files\AdvancedCleaner

File::

C:\WINDOWS\emotigt.dll

C:\Documents and Settings\All Users\Application Data\vadqdkxy.dll

C:\Documents and Settings\All Users\Application Data\qjuhgdob.dll

C:\Documents and Settings\All Users\Application Data\kvsfutip.dll

C:\Program Files\Ynzojsuk\dgejggks.dll

C:\Program Files\speed-bit\tbspe0.dll

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ftutil2"=-

"Recguard"=-

"PCDrProfiler"=-

"My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" =-

"SM_IAN"=-

"AbyssmoClient"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winlft32]

"winlft32.dll"=-

Endret 23. mars 2008 av SNIPPSAT

qwerty1234 · 23. mars 2008

Ja dette kan du gjøre.
Ja som norbat sier så hadde nok sas tatt litt mere.

Kan kjøre dette og så en en ny hjt-logg.

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt.

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen.

Post logg c:\combofix

Folder::

C:\Program Files\Common Files\AdvancedCleaner

File::

C:\WINDOWS\emotigt.dll

C:\Documents and Settings\All Users\Application Data\vadqdkxy.dll

C:\Documents and Settings\All Users\Application Data\qjuhgdob.dll

C:\Documents and Settings\All Users\Application Data\kvsfutip.dll

C:\Program Files\Ynzojsuk\dgejggks.dll

C:\Program Files\speed-bit\tbspe0.dll

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ftutil2"=-

"Recguard"=-

"PCDrProfiler"=-

"My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" =-

"SM_IAN"=-

"AbyssmoClient"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winlft32]

"winlft32.dll"=-

Må inrømme at jeg ikke helt forsto det nederste der? ^^

snippsat · 23. mars 2008

Du åpner notisblokk.

Alt som har fet tekst merker du og kopiere.

Så limer du det inn i notisblokk.

Så i notisblokk fil->lagre som CFScript.txt.

Du velger skrivebordet og gjør som på bildet.

IcedInsanity · 23. mars 2008

Altså du bare dra notisblokk skrivebordsikonet bort til Combofix ikonet....og da begynner Combofix å kjøre

qwerty1234 · 23. mars 2008

Det tok utrolig lang tid å scanne dataen for virus.. Den har holdt på i 1 time, og 6 minutter.

IcedInsanity · 23. mars 2008

Det gjør det..er det SAS du bruker?

qwerty1234 · 23. mars 2008

ja, SAS.

Skulle jeg lime inn den nye hjt-loggen? her er den i alle fall ;

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:46, on 2008-03-23

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe

C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE

C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\explorer.exe