Spyware/virus på jobb pc(Hijack this)

Cloud · 24. april 2008

Fått virus på en pc på jobben.

Får ikke kjørt SAS, men kjørt Comobix, CCleaner og HiJack This.

Combifix

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-04-22.5 - Administrator 2008-04-24 16:17:08.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.227 [GMT 2:00]

Running from: C:\Documents and Settings\Administrator.XXL\Skrivebord\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Programfiler\akl

C:\Programfiler\akl\akl.dll

C:\Programfiler\akl\akl.exe

C:\Programfiler\akl\uninstall.exe

C:\Programfiler\akl\unsetup.exe

C:\Programfiler\Inet Delivery

C:\Programfiler\Inet Delivery\inetdl.exe

C:\Programfiler\Inet Delivery\intdel.exe

C:\WINDOWS\a.bat

C:\WINDOWS\base64.tmp

C:\WINDOWS\bdn.com

C:\WINDOWS\FVProtect.exe

C:\WINDOWS\iTunesMusic.exe

C:\WINDOWS\mslagent

C:\WINDOWS\mslagent\2_mslagent.dll

C:\WINDOWS\mslagent\mslagent.exe

C:\WINDOWS\mslagent\uninstall.exe

C:\WINDOWS\mssecu.exe

C:\WINDOWS\system32\bsva-egihsg52.exe

C:\WINDOWS\system32\emesx.dll

C:\WINDOWS\userconfig9x.dll

C:\WINDOWS\Web\def.htm

C:\WINDOWS\winsystem.exe

C:\WINDOWS\zip1.tmp

C:\WINDOWS\zip2.tmp

C:\WINDOWS\zip3.tmp

C:\WINDOWS\zipped.tmp

.

((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))

.

2008-04-24 16:15 . 2008-04-24 16:15 98,304 --a------ C:\WINDOWS\system32\dofcxcju.exe

2008-04-24 15:41 . 2008-04-24 15:41 <DIR> d-------- C:\Programfiler\CCleaner

2008-04-24 15:33 . 2008-04-24 15:33 <DIR> d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard

2008-04-24 15:32 . 2008-04-24 15:32 <DIR> d-------- C:\Programfiler\Opera

2008-04-24 15:23 . 2008-04-24 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.XXL\Programdata\TmpRecentIcons

2008-04-24 15:10 . 2008-04-23 20:46 7,168 --a------ C:\Documents and Settings\Administrator.XXL\cftmon.exe

2008-04-23 22:18 . 2008-04-23 22:18 <DIR> d-------- C:\Documents and Settings\geni\Programdata\TmpRecentIcons

2008-04-23 20:57 . 2008-04-23 20:46 7,168 --a------ C:\Documents and Settings\LocalService\cftmon.exe

2008-04-23 20:46 . 2008-04-23 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\ehkzovwl

2008-04-23 20:46 . 2008-04-23 20:46 7,168 --a------ C:\Documents and Settings\geni\cftmon.exe

2008-04-17 12:55 . 2008-04-17 12:55 <DIR> d-------- C:\Documents and Settings\geni\Programdata\DVMS

2008-04-17 12:53 . 2008-04-17 12:53 <DIR> d-------- C:\Programfiler\DVMS

2008-04-17 12:52 . 2008-04-17 12:52 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\DVMS

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-24 13:54 3,420 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP

2008-04-24 13:39 --------- d-----w C:\Programfiler\Trend Micro

2008-04-24 08:27 --------- d-----w C:\Programfiler\Google

2008-04-23 18:46 98,304 ----a-w C:\WINDOWS\system32\wledargv.exe

2008-04-23 18:46 65,536 ----a-w C:\epnhxax.exe

2008-04-23 18:46 61,874 ----a-w C:\WINDOWS\ydhqzop.sys

2008-04-23 12:19 94,208 ----a-w C:\WINDOWS\olgdqarf.exe

2008-04-23 12:19 81,920 ----a-w C:\WINDOWS\wxvgsdbq.exe

2008-04-23 12:19 217,088 ----a-w C:\WINDOWS\qnmargolewk.dll

2008-04-23 12:19 212,992 ----a-w C:\WINDOWS\wdpoefan.dll

2008-04-23 12:19 188,416 ----a-w C:\WINDOWS\vadokmxt.dll

2008-04-23 12:19 155,648 ----a-w C:\WINDOWS\dpevflbg.dll

2008-04-14 09:13 --------- d-----w C:\Documents and Settings\geni\Programdata\ICAClient

2008-03-20 08:11 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-20 08:11 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys

2008-03-01 16:35 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll

2008-02-29 08:58 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe

2008-02-29 08:58 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe

2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-02-20 06:52 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 06:52 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll

2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

2008-02-20 05:39 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll

2008-02-20 05:39 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll

2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll

.

((((((((((((((((((((((((((((( snapshot@2008-04-24_16.16.13.94 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\hoproxy.dll

+ 2008-04-24 14:15:37 4,096 ----a-w C:\WINDOWS\system32\hoproxy.dll

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\hxiwlgpm.dat

+ 2008-04-24 14:15:36 4,096 ----a-w C:\WINDOWS\system32\hxiwlgpm.dat

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\hxiwlgpm.exe

+ 2008-04-24 14:15:36 4,096 ----a-w C:\WINDOWS\system32\hxiwlgpm.exe

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\mwin32.exe

+ 2008-04-24 14:15:37 4,096 ----a-w C:\WINDOWS\system32\mwin32.exe

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\sncntr.exe

+ 2008-04-24 14:15:37 4,096 ----a-w C:\WINDOWS\system32\sncntr.exe

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\taack.dat

+ 2008-04-24 14:15:36 4,096 ----a-w C:\WINDOWS\system32\taack.dat

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\taack.exe

+ 2008-04-24 14:15:36 4,096 ----a-w C:\WINDOWS\system32\taack.exe

- 2008-04-23 18:46:18 4,096 ----a-w C:\WINDOWS\system32\winlogonpc.exe

+ 2008-04-24 14:15:38 4,096 ----a-w C:\WINDOWS\system32\winlogonpc.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2513A321-CB50-4C5F-91C5-80342AFACFB1}]

C:\WINDOWS\system32\adobepnl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62E2E094-F989-48C6-B947-6E79DA2294F9}]

C:\WINDOWS\system32\winapi32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AEAFB69D-EDE2-47C8-BDBA-D8938DE059D3}]

2008-04-23 14:19 217088 --a------ C:\WINDOWS\qnmargolewk.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CE66268D-0208-4D9E-8BC7-12D91072A34D}"= "C:\WINDOWS\dpevflbg.dll" [2008-04-23 14:19 155648]

[HKEY_CLASSES_ROOT\clsid\{ce66268d-0208-4d9e-8bc7-12d91072a34d}]

[HKEY_CLASSES_ROOT\dpevflbg.1]

[HKEY_CLASSES_ROOT\TypeLib\{D9C28083-E28D-4AB3-B109-82758B1B484C}]

[HKEY_CLASSES_ROOT\dpevflbg]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:00 15360]

"bganywkl"="C:\WINDOWS\system32\dofcxcju.exe" [2008-04-24 16:15 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-05-06 17:52 155648]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-05-06 17:48 118784]

"Smapp"="C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe" [2003-07-30 10:08 143360]

"SSC_UserPrompt"="C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-09-13 13:08 218240]

"SetRefresh"="C:\Programfiler\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 20:01 525824]

"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 10:00 143360]

"OfficeScanNT Monitor"="C:\Programfiler\Trend Micro\OfficeScan Client\pccntmon.exe" [2005-04-19 00:52 335872]

"Transponder"="C:\WINDOWS\system32\susp.exe" [ ]

"Windows Defender"="C:\Programfiler\Windows Defender\MSASCui.exe" [2006-04-03 18:12 777424]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:00 15360]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

Hurtigstart for Adobe Reader.lnk - C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"SaVTXtKNcI"= C:\Documents and Settings\All Users\Programdata\ehkzovwl\cvshidcp.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]

Source= file:///C:\WINDOWS\privacy_danger\index.htm

FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"vadokmxt"= {8D77CD95-EA5C-4791-B87E-48310EA70B85} - C:\WINDOWS\vadokmxt.dll [2008-04-23 14:19 188416]

"wdpoefan"= {DA45875A-87F4-47A9-BB24-ABF3D98C68EE} - C:\WINDOWS\wdpoefan.dll [2008-04-23 14:19 212992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtutndu]

awtuTNDU.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programfiler\\Microsoft ActiveSync\\wcescomm.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

S2 HZQBWMCX;HZQBWMCX;C:\WINDOWS\system32\hzqbwmcx.uvs []

.

Contents of the 'Scheduled Tasks' folder

"2008-04-22 00:19:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Programfiler\Windows Defender\MpCmdRun.exe

"2008-04-23 18:56:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Programfiler\Symantec\LiveUpdate\NDetect.exe

.

**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-24 16:18:14

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HZQBWMCX]

"ImagePath"="\??\C:\WINDOWS\system32\hzqbwmcx.uvs"

.

Completion time: 2008-04-24 16:19:04

ComboFix-quarantined-files.txt 2008-04-24 14:18:45

ComboFix2.txt 2008-04-24 14:16:28

Pre-Run: 31,359,721,472 byte ledig

Post-Run: 31,352,070,144 byte ledig

181 --- E O F --- 2008-04-19 01:40:40

HiJack This

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:27, on 2008-04-24

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Trend Micro\OfficeScan Client\ntrtscan.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\Programfiler\Trend Micro\OfficeScan Client\tmlisten.exe

C:\Programfiler\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\All Users\Programdata\ehkzovwl\cvshidcp.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe

C:\WINDOWS\system32\dofcxcju.exe

C:\Programfiler\Trend Micro\OfficeScan Client\pccntmon.exe

C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\explorer.exe

C:\Programfiler\Java\jre1.6.0_01\bin\jucheck.exe

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: adobepnl.ADOBE_PANEL - {2513A321-CB50-4C5F-91C5-80342AFACFB1} - C:\WINDOWS\system32\adobepnl.dll (file missing)

O2 - BHO: winapi32.MyBHO - {62E2E094-F989-48C6-B947-6E79DA2294F9} - C:\WINDOWS\system32\winapi32.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: DVA Gate - {AEAFB69D-EDE2-47C8-BDBA-D8938DE059D3} - C:\WINDOWS\qnmargolewk.dll

O3 - Toolbar: dpevflbg - {CE66268D-0208-4D9E-8BC7-12D91072A34D} - C:\WINDOWS\dpevflbg.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [smapp] C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM\..\Run: [setRefresh] C:\Programfiler\Compaq\SetRefresh\SetRefresh.exe

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programfiler\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow

O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\system32\susp.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bganywkl] C:\WINDOWS\system32\dofcxcju.exe

O4 - HKLM\..\Policies\Explorer\Run: [saVTXtKNcI] C:\Documents and Settings\All Users\Programdata\ehkzovwl\cvshidcp.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Opprett mobil favoritt - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra 'Tools' menuitem: Opprett mobil favoritt... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.bravida.no

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xxl.no

O17 - HKLM\Software\..\Telephony: DomainName = xxl.no

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xxl.no

O20 - Winlogon Notify: awtutndu - awtuTNDU.dll (file missing)

O21 - SSODL: vadokmxt - {8D77CD95-EA5C-4791-B87E-48310EA70B85} - C:\WINDOWS\vadokmxt.dll

O21 - SSODL: wdpoefan - {DA45875A-87F4-47A9-BB24-ABF3D98C68EE} - C:\WINDOWS\wdpoefan.dll

O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programfiler\Trend Micro\OfficeScan Client\ntrtscan.exe

O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programfiler\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programfiler\Trend Micro\OfficeScan Client\tmlisten.exe

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--

End of file - 6815 bytes

EDIT: Fått instalert SAS etter at combofix hadde gjort sitt.

Kommer med update etter hvert.

Endret 24. april 2008 av Cloud

norbat · 24. april 2008

Etter at du har kjørt SAS, er det fint om du lager ny combofix-logg + hjt-logg. (Du tar bare og bytter ut de du har lagt ut over)

Cloud · 24. april 2008

HiJack this:

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:59, on 2008-04-24

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Trend Micro\OfficeScan Client\ntrtscan.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\Programfiler\Trend Micro\OfficeScan Client\tmlisten.exe

C:\Programfiler\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

C:\WINDOWS\TEMP\ABB027.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\UsrPrmpt.exe

C:\Programfiler\Trend Micro\OfficeScan Client\pccntmon.exe

C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\userinit.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe