[løst] Problem med nettleser virus eller spywere? [/løst]

Kakebakelate · 20. april 2008

Har fått er rart problem IE begynner å åpne så mange sider den kan når jeg slår på pcen. Problemet hadde jeg først med Opera og ingen av de andre nettleserene. Men når jeg fjernet Opera hoppet problemet over til IE. Jeg har prøvd antivirusscan og scan med SAS uten at det har hjulpet noe.

Kjører Xp pro.

Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 14:46:31, on 20.04.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.17184)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Motorola\SMSERIAL\sm56hlpr.exe

C:\Programfiler\Compal\Wireless Select Switch\WLSS.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\Razer\Diamondback\razerhid.exe

C:\Programfiler\Compal\Wow Video&Audio\WVAMain.exe

C:\Windows\System32\nvdai.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\vsnp2uvc.exe

C:\Programfiler\Protector Suite QL\psqltray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe

C:\Programfiler\Notebook Hardware Control\nhc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDClock.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDMedia.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Razer\Diamondback\razerofa.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\cmd.exe

C:\Programfiler\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Runar\Skrivebord\HijackThis.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [sMSERIAL] C:\Programfiler\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [WLSS] C:\Programfiler\Compal\Wireless Select Switch\WLSS.exe

O4 - HKLM\..\Run: [PSQLLauncher] "C:\Programfiler\Protector Suite QL\launcher.exe" /startup

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Dimondback] C:\Programfiler\Razer\Diamondback\razerhid.exe

O4 - HKLM\..\Run: [Wow Video&Audio] C:\Programfiler\Compal\Wow Video&Audio\WVAMain.exe

O4 - HKLM\..\Run: [nvdai] C:\Windows\System32\nvdai.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Launch LCDMon] "C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe"

O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Programfiler\Notebook Hardware Control\nhc.exe" -quiet

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: OneNote 2007 Screen Clipper og Launcher.lnk = C:\Programfiler\Microsoft Office\Office12\ONENOTEM.EXE

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\programfiler\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1205616014875

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programfiler\Fellesfiler\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: psfus - C:\WINDOWS\system32\psqlpwd.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

Combofix

ComboFix 08-04-18.3 - Runar 2008-04-20 15:22:23.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.1373 [GMT 2:00]

Running from: C:\Documents and Settings\Runar\Skrivebord\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-03-20 to 2008-04-20 )))))))))))))))))))))))))))))))

.

2008-04-20 10:32 . 2008-04-20 10:32 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\SUPERAntiSpyware.com

2008-04-20 10:16 . 2008-04-20 10:16 124 --a------ C:\Zen Micro Media Explorer.lnk

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> dr------- C:\Documents and Settings\Administrator\Start-meny

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d--h----- C:\Documents and Settings\Administrator\Skrivere

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d-------- C:\Documents and Settings\Administrator\Skrivebord

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d--h----- C:\Documents and Settings\Administrator\Siste

2008-04-20 10:15 . 2008-03-15 22:06 <DIR> d-------- C:\Documents and Settings\Administrator\Programdata\Intel

2008-04-20 10:15 . 2008-03-15 22:06 <DIR> dr-h----- C:\Documents and Settings\Administrator\Programdata

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d-------- C:\Documents and Settings\Administrator\Mine dokumenter

2008-04-20 10:15 . 2008-03-15 21:41 <DIR> d--h----- C:\Documents and Settings\Administrator\Maler

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d--h----- C:\Documents and Settings\Administrator\Lokale innstillinger

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d-------- C:\Documents and Settings\Administrator\Favoritter

2008-04-20 10:15 . 2008-03-15 22:34 <DIR> d--h----- C:\Documents and Settings\Administrator\AndrMask

2008-04-20 10:15 . 2008-04-20 10:15 <DIR> d-------- C:\Documents and Settings\Administrator

2008-04-20 10:15 . 2008-04-20 15:26 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG

2008-04-19 17:48 . 2008-04-20 04:40 <DIR> dr-h----- C:\Documents and Settings\Runar\Siste

2008-04-18 23:24 . 2008-04-18 23:24 268 --ah----- C:\sqmdata00.sqm

2008-04-18 23:24 . 2008-04-18 23:24 244 --ah----- C:\sqmnoopt00.sqm

2008-04-18 23:24 . 2008-04-18 23:24 160 --ah----- C:\sqmnoopt01.sqm

2008-04-18 23:24 . 2008-04-18 23:24 148 --ah----- C:\sqmdata02.sqm

2008-04-18 23:24 . 2008-04-18 23:24 136 --ah----- C:\sqmnoopt02.sqm

2008-04-18 23:24 . 2008-04-18 23:24 136 --ah----- C:\sqmdata01.sqm

2008-04-16 19:31 . 2008-04-20 04:47 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\TrackMania

2008-04-16 19:24 . 2008-04-16 19:26 <DIR> d-------- C:\Programfiler\TmNationsForever

2008-04-16 13:09 . 2008-04-16 14:11 <DIR> d-------- C:\Programfiler\TrackMania Nations ESWC

2008-04-15 22:23 . 2008-04-15 22:25 <DIR> d-------- C:\WINDOWS\system32\NtmsData

2008-04-14 19:03 . 2008-04-14 19:03 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\Sports Interactive

2008-04-14 18:54 . 2008-04-14 18:57 <DIR> d--h----- C:\Programfiler\Zero G Registry

2008-04-14 18:54 . 2008-04-14 18:54 <DIR> d-------- C:\Programfiler\Sports Interactive

2008-04-14 18:53 . 2008-04-14 18:53 <DIR> d--h----- C:\Documents and Settings\Runar\InstallAnywhere

2008-04-14 15:37 . 2008-04-14 15:37 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll

2008-04-12 18:29 . 2008-04-12 18:30 <DIR> d-------- C:\Programfiler\Guitar Pro 5

2008-04-12 16:51 . 2008-04-12 16:51 <DIR> d-------- C:\Programfiler\LucasArts

2008-04-07 13:51 . 2008-04-07 13:51 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

2008-04-06 23:30 . 2008-04-06 23:30 <DIR> d-------- C:\WINDOWS\system32\AGEIA

2008-04-06 23:30 . 2008-04-06 23:31 <DIR> d-------- C:\Programfiler\AGEIA Technologies

2008-04-06 23:27 . 2008-04-06 23:44 20,480 --a------ C:\WINDOWS\system32\H@tKeysH@@k.DLL

2008-04-06 23:01 . 2008-04-06 23:01 <DIR> d-------- C:\Programfiler\tw

2008-04-05 22:49 . 2008-04-06 03:54 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\Gearbox Software

2008-04-05 17:05 . 2007-06-01 10:33 2,772,992 --a------ C:\WINDOWS\system32\NETw4r32.dll

2008-04-05 17:05 . 2007-05-28 09:03 2,207,232 --a------ C:\WINDOWS\system32\drivers\NETw4x32.sys

2008-04-05 17:05 . 2007-06-01 10:33 684,032 --a------ C:\WINDOWS\system32\NETw4c32.dll

2008-04-04 18:05 . 2008-04-20 10:32 <DIR> d-------- C:\Programfiler\SUPERAntiSpyware

2008-04-04 18:05 . 2008-04-04 18:05 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\SUPERAntiSpyware.com

2008-04-03 22:14 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys

2008-04-03 22:14 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys

2008-04-03 16:17 . 2008-04-03 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Office Genuine Advantage

2008-04-02 12:17 . 1996-09-11 15:33 48,640 --a------ C:\WINDOWS\system32\INETWH32.dll

2008-04-02 12:15 . 2008-04-04 15:28 <DIR> d-------- C:\Programfiler\modelator

2008-04-02 12:13 . 2008-04-02 12:13 <DIR> d-------- C:\Documents and Settings\Runar\WINDOWS

2008-04-02 12:13 . 1996-07-18 13:06 297,472 --a------ C:\WINDOWS\uninst.exe

2008-03-28 20:39 . 2008-03-28 20:41 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\Command & Conquer 3 Tiberium Wars

2008-03-26 02:26 . 2008-03-26 02:26 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\dvdcss

2008-03-24 01:19 . 2008-03-24 01:19 <DIR> d-------- C:\Programfiler\Trend Micro

2008-03-22 15:11 . 2008-03-22 17:18 <DIR> d-------- C:\Documents and Settings\Runar\Programdata\Command & Conquer 3 Kane's Wrath

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-20 13:25 22,528 ----a-w C:\WINDOWS\system32\drivers\nhcDriver.sys

2008-04-20 08:26 --------- d-----w C:\Programfiler\Opera

2008-04-20 06:52 --------- d-----w C:\Documents and Settings\Runar\Programdata\AVG7

2008-04-20 01:32 --------- d-----w C:\Documents and Settings\Runar\Programdata\uTorrent

2008-04-19 15:12 --------- d-----w C:\Programfiler\Steam

2008-04-16 07:49 --------- d-----w C:\Documents and Settings\All Users\Programdata\OrdnettPluss

2008-04-12 14:51 --------- d--h--w C:\Programfiler\InstallShield Installation Information

2008-04-10 01:03 --------- d-----w C:\Documents and Settings\All Users\Programdata\Microsoft Help

2008-04-07 14:49 5,120 ----a-w C:\WINDOWS\system32\BReWErS.dll

2008-04-06 21:30 --------- d-----w C:\Programfiler\Fellesfiler\Wise Installation Wizard

2008-04-06 01:54 --------- d-----w C:\Programfiler\Ubisoft

2008-04-05 15:05 --------- d-----w C:\Programfiler\Intel

2008-04-05 13:55 356,352 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe

2008-03-31 16:46 --------- d-----w C:\Programfiler\Electronic Arts

2008-03-27 19:03 --------- d-----w C:\Programfiler\Warcraft III

2008-03-26 23:14 --------- d-----w C:\Programfiler\Notebook Hardware Control

2008-03-22 08:00 --------- d-----w C:\Documents and Settings\All Users\Programdata\avg7

2008-03-20 13:23 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-03-20 13:21 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2008-03-20 08:11 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-19 14:19 --------- d-----w C:\Programfiler\Logitech

2008-03-19 14:19 --------- d-----w C:\Programfiler\Fellesfiler\Logitech

2008-03-19 13:53 22,328 ----a-w C:\Documents and Settings\Runar\Programdata\PnkBstrK.sys

2008-03-19 13:11 --------- d-----w C:\Programfiler\portal

2008-03-19 11:18 --------- d-----w C:\Programfiler\Fellesfiler\Adobe

2008-03-19 09:50 --------- d-----w C:\Programfiler\Realtek

2008-03-18 19:06 --------- d-----w C:\Programfiler\Activision

2008-03-17 19:36 --------- d-----w C:\Programfiler\Microsoft Works

2008-03-17 19:35 --------- d-----w C:\Programfiler\Microsoft.NET

2008-03-17 17:10 --------- d-----w C:\Programfiler\CCleaner

2008-03-16 20:44 --------- d-----w C:\Documents and Settings\All Users\Programdata\FLEXnet

2008-03-16 19:24 --------- d-----w C:\Programfiler\Bonjour

2008-03-16 18:59 --------- d-----w C:\Documents and Settings\Runar\Programdata\vlc

2008-03-16 18:28 --------- d-----w C:\Programfiler\VideoLAN

2008-03-16 12:38 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2008-03-16 11:44 --------- d-----w C:\Programfiler\EA GAMES

2008-03-16 09:46 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

2008-03-16 09:46 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

2008-03-16 09:46 --------- d-----w C:\Documents and Settings\LocalService\Programdata\AVG7

2008-03-16 09:45 --------- d-----w C:\Documents and Settings\All Users\Programdata\Grisoft

2008-03-16 09:43 --------- d-----w C:\Programfiler\Fellesfiler\Macrovision Shared

2008-03-16 01:42 --------- d-----w C:\Programfiler\MSXML 6.0

2008-03-16 01:32 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2008-03-16 01:32 --------- d--h--r C:\Documents and Settings\Runar\Programdata\SecuROM

2008-03-16 01:26 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe

2008-03-16 00:43 --------- d-----w C:\Documents and Settings\All Users\Programdata\Trymedia

2008-03-15 23:45 --------- d-----w C:\Programfiler\Ventrilo

2008-03-15 23:07 --------- dcsh--w C:\Programfiler\Fellesfiler\WindowsLiveInstaller

2008-03-15 23:07 --------- d-----w C:\Programfiler\Windows Live

2008-03-15 23:01 --------- d-----w C:\Documents and Settings\All Users\Programdata\WLInstaller

2008-03-15 22:22 --------- d-----w C:\Programfiler\uTorrent

2008-03-15 21:47 --------- d-----w C:\Documents and Settings\Runar\Programdata\Microsoft Games

2008-03-15 21:28 --------- d-----w C:\Programfiler\Razer

2008-03-15 21:09 --------- d-----w C:\Programfiler\DAEMON Tools Lite

2008-03-15 21:00 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-03-15 20:59 --------- d-----w C:\Documents and Settings\Runar\Programdata\DAEMON Tools

2008-03-15 20:16 --------- d-----w C:\Programfiler\MediaMonkey

2008-03-15 20:11 --------- d-----w C:\Documents and Settings\All Users\Programdata\XP32

2008-03-15 20:11 --------- d-----w C:\Documents and Settings\All Users\Programdata\nView_Profiles

2008-03-15 20:06 --------- d-----w C:\Documents and Settings\Runar\Programdata\Intel

2008-03-15 20:06 --------- d-----w C:\Documents and Settings\NetworkService\Programdata\Intel

2008-03-15 20:06 --------- d-----w C:\Documents and Settings\LocalService\Programdata\Intel

2008-03-15 20:05 --------- d-----w C:\Documents and Settings\All Users\Programdata\Intel

2008-03-15 20:04 --------- d-----w C:\Programfiler\Protector Suite QL

2008-03-15 20:02 --------- d-----w C:\Documents and Settings\All Users\Programdata\UIB

2008-03-15 20:01 --------- d-----w C:\Programfiler\Broadcom

2008-03-15 20:00 --------- d-----w C:\Programfiler\Fellesfiler\snp2uvc

2008-03-15 20:00 --------- d-----w C:\Documents and Settings\Runar\Programdata\InstallShield

2008-03-15 19:59 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2008-03-15 19:58 --------- d-----w C:\Programfiler\Motorola

2008-03-15 19:58 --------- d-----w C:\Programfiler\Compal

2008-03-15 19:58 --------- d-----w C:\Documents and Settings\All Users\Programdata\Vista64

2008-03-15 19:58 --------- d-----w C:\Documents and Settings\All Users\Programdata\Vista32

2008-03-15 19:56 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-03-15 19:45 --------- d-----w C:\Programfiler\microsoft frontpage

2008-03-15 19:43 --------- d-----w C:\Programfiler\Fellesfiler\Tjenester

2008-03-13 18:40 --------- d-----w C:\Documents and Settings\Runar\Programdata\Kunnskapsforlaget

2008-03-13 09:35 --------- d-----w C:\Programfiler\Kunnskapsforlaget

2008-03-12 23:17 --------- d-----w C:\Documents and Settings\Runar\Programdata\Hamachi

2008-03-11 22:41 --------- d-----w C:\Documents and Settings\Runar\Programdata\Ubisoft

2008-03-11 22:41 --------- d-----w C:\Documents and Settings\All Users\Programdata\Ubisoft

2008-03-03 19:01 830,464 ----a-w C:\WINDOWS\system32\wininet.dll

2008-03-03 19:01 434,176 ----a-w C:\WINDOWS\system32\vbscript.dll

2008-03-03 19:01 156,160 ----a-w C:\WINDOWS\system32\msls31.dll

2008-03-03 19:01 142,848 ------w C:\WINDOWS\system32\IESetting.dll

2008-03-03 18:53 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll

2008-03-03 18:52 41,984 ----a-w C:\WINDOWS\system32\licmgr10.dll

2008-03-03 18:52 17,920 ----a-w C:\WINDOWS\system32\corpol.dll

2008-03-03 18:51 69,120 ----a-w C:\WINDOWS\system32\iesetup.dll

2008-03-03 18:51 69,120 ----a-w C:\WINDOWS\system32\admparse.dll

2008-03-03 18:50 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll

2008-03-03 18:50 45,568 ----a-w C:\WINDOWS\system32\mshta.exe

2008-03-03 18:50 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll

2008-03-03 09:28 --------- d-----w C:\Documents and Settings\Runar\Programdata\Talkback

2008-03-01 15:59 --------- d-----w C:\Programfiler\BestGameEver

2008-02-27 20:05 --------- d-----w C:\Documents and Settings\Runar\Programdata\Ventrilo

2008-02-27 17:12 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys

2008-02-27 16:39 --------- d-----w C:\Programfiler\Hamachi

2008-02-25 16:02 --------- d-----w C:\Documents and Settings\All Users\Programdata\Creative

2008-02-25 16:00 --------- d-----w C:\Programfiler\Creative

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]

@={F2F31467-B1AC-4df0-AE79-FD5FA085E22B}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]

@={A3E208F7-0E3A-4182-A7A6-B169D5D691AA}

[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]

2007-03-28 20:59 2953216 --a------ C:\Programfiler\Protector Suite QL\farchns.dll

[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]

2007-03-28 20:59 2953216 --a------ C:\Programfiler\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]

"SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SMSERIAL"="C:\Programfiler\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 08:34 634880]

"WLSS"="C:\Programfiler\Compal\Wireless Select Switch\WLSS.exe" [2007-04-23 19:55 190000]

"PSQLLauncher"="C:\Programfiler\Protector Suite QL\launcher.exe" [2007-03-28 20:23 49168]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]

"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]

"Dimondback"="C:\Programfiler\Razer\Diamondback\razerhid.exe" [2007-02-14 12:15 147456]

"Wow Video&Audio"="C:\Programfiler\Compal\Wow Video&Audio\WVAMain.exe" [2007-05-03 18:51 951856]

"nvdai"="C:\Windows\System32\nvdai.exe" [2008-01-25 22:48 155648]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 08:26 579584]

"snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 12:48 569344]

"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16:47 16859648 C:\WINDOWS\RTHDCPL.exe]

"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"Launch LCDMon"="C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe" [2006-07-19 04:39 549376]

"NotebookHardwareControl"="C:\Programfiler\Notebook Hardware Control\nhc.exe" [2007-05-04 02:33 2629632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:03 15360]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-16 11:45 219136]

C:\Documents and Settings\Runar\Start-meny\Programmer\Oppstart\

OneNote 2007 Screen Clipper og Launcher.lnk - C:\Programfiler\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 21:24:54 98632]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

C:\WINDOWS\system32\psqlpwd.dll 2007-03-28 20:46 90112 C:\WINDOWS\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programfiler\\uTorrent\\uTorrent.exe"=

"C:\\Programfiler\\Messenger\\msmsgs.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\Programfiler\\Grisoft\\AVG7\\avginet.exe"=

"C:\\Programfiler\\Grisoft\\AVG7\\avgamsvr.exe"=

"C:\\Programfiler\\Grisoft\\AVG7\\avgcc.exe"=

"C:\\Programfiler\\Grisoft\\AVG7\\avgemc.exe"=

"C:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"C:\\Programfiler\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Programfiler\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=

"C:\\Programfiler\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=

"C:\\Programfiler\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=

"C:\\Programfiler\\EA GAMES\\Battlefield 2\\BF2.exe"=

"C:\\Programfiler\\Sports Interactive\\Football Manager 2008\\fm.exe"=

R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 11:16]

R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-18 03:55]

R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2005-04-24 23:43]

R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2007-03-28 20:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b4dedff-e902-11dc-ab74-0013e8c10e67}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Scan.hta

.

Contents of the 'Scheduled Tasks' folder

"2008-04-20 13:26:42 C:\WINDOWS\Tasks\Oppdater Ordnett Pluss.job"

- C:\Programfiler\Kunnskapsforlaget\Ordnett Pluss\updater.exe

.

**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-20 15:25:36

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\Protector Suite QL\psqltray.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDClock.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDMedia.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Programfiler\Razer\Diamondback\razertra.exe

C:\Programfiler\Razer\Diamondback\razerofa.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Programfiler\Internet Explorer\iexplore.exe

.

**************************************************************************

.

Completion time: 2008-04-20 15:30:24 - machine was rebooted

ComboFix-quarantined-files.txt 2008-04-20 13:30:13

Pre-Run: 43,273,687,040 byte ledig

Post-Run: 43,183,550,464 byte ledig

279 --- E O F --- 2008-04-11 01:04:23

Endret 22. april 2008 av Runarbs

norbat · 20. april 2008

Hvilken sider er det som 'spretter' fram?

Endret 21. april 2008 av norbat

Kakebakelate · 20. april 2008

Når det samme skjedde i Opera var det en link til Charlesblake files wordpress.com hitler.jpg. Husker ikke den addressen i hodet, hadde bare deler av den skrevet ned en plass. Når det gjelder IE så kommer det ikke opp noe link, mest sansynelig pga at IE "spretter" opp før laptopen har koblet seg til trådløs nettet. Og når det kommer til rundt 64 sider så låser IE seg. Og nå er plutselig problemet borte etter at IE har låst seg. Det kom også opp ei rute med cmd etter at jeg fjernet Opera om at et eller annet ikke klarte å finne "Charlesblake files wordpress com hitler"

norbat · 20. april 2008

Klikk: Start->Kjør

Skriv: msconfig

Velg arkfanen oppstart

Se om du finner noe som heter nvdai. Hvis, så fjerner du merket framfor, klikk OK og restart PC-en.

Se om det fortsatt er problemer.

Kakebakelate · 20. april 2008

Nå funker alt som det skal, tusen takk norbat.

norbat · 20. april 2008

Da kunne det være interessant å se om fila er en 'bad one'

Gå til nettstedet http://virusscan.jotti.org/

Øverst på siden kan du laste opp følgende fil for sjekk:

C:\Windows\System32\nvdai.exe

Hvis det blir funnet noe, kan du godt kopiere resultatet og poste det.

Kakebakelate · 21. april 2008

Fant litt faenskap ja:

AntiVir Found TR/Agent.155648.14

Avast Found Win32:Rootkit-gen

BitDefender Found DeepScan:Generic.Malware.Sp2p!.940B9F72

norbat · 21. april 2008

Du kan bruke utforsker til å finne og slette fila:

C:\Windows\System32\nvdai.exe

Post deretter en ny HJT-logg.

Kakebakelate · 21. april 2008

Har slettet nvdai.exe nå

Hijackthis logg:

Logfile of HijackThis v1.99.1

Scan saved at 21:40:29, on 21.04.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.17184)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Motorola\SMSERIAL\sm56hlpr.exe

C:\Programfiler\Compal\Wireless Select Switch\WLSS.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\Razer\Diamondback\razerhid.exe

C:\Programfiler\Compal\Wow Video&Audio\WVAMain.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\WINDOWS\vsnp2uvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\Protector Suite QL\psqltray.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\lcdmon.exe

C:\Programfiler\Notebook Hardware Control\nhc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDClock.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\Fellesfiler\Logitech\LCD Manager\Applets\LCDMedia.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Razer\Diamondback\razertra.exe

C:\Programfiler\MediaMonkey\MediaMonkey.exe

C:\Programfiler\Razer\Diamondback\razerofa.exe

C:\Programfiler\Windows Live\Messenger\msnmsgr.exe

C:\Programfiler\Windows Live\Messenger\usnsvc.exe

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\Ventrilo\Ventrilo.exe

C:\Documents and Settings\Runar\Programdata\Opera\Opera\profile\cache4\temporary_download\hijackthis_sfx.exe

C:\Program Files\HijackThis\HijackThis.exe