LØST! spyware attack + hijackthislog

[grumme]

Først og fremst: Muchos kudos til dere som kommer med gode råd og rettledning her på forumet! Flott jobb! Sykt frustrerende når maskina kødder seg.

 

Så: Har selvfølgelig fått spywareproblemer på min maskin. 2 stk er funnet: en vundo variant og en til som jeg nu ikke kommer på... (sender innleget fra en annen maskin... Kom ikke inn på forumet med den syke maskinen)

 

Her er min hijackthis log (kjørte først sas):

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:58:05, on 15.05.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe

C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\Rundll32.exe

C:\WINDOWS\system32\CAP3RSK.EXE

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

www.google.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://filehippo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL

= http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {021078D7-A046-448C-B104-D067F2E0661C} - (no file)

O2 - BHO: Yahoo! Toolbar Helper -

{02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Spybot-S&D IE Protection -

{53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper -

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} -

C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {AC2BCF97-675E-4373-9E88-8ABBA236F432} - (no file)

O2 - BHO: (no name) - {C2EA321B-C786-406E-ADBA-89600E32BB03} - (no file)

O2 - BHO: {0bdda0fc-1f68-0d08-7484-4cf4ede4cccc} -

{cccc4ede-4fc4-4847-80d0-86f1cf0addb0} -

C:\WINDOWS\system32\fcbwgrao.dll

O2 - BHO: (no name) - {F1B2B165-FBF2-4EB3-98FF-9CF5506062B5} -

C:\WINDOWS\system32\cbXPhigE.dll (file missing)

O3 - Toolbar: &TerraTec Home Cinema -

{AD6E6555-FB2C-47D4-8339-3E2965509877} -

C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88}

- C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA

Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir

PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program

Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft

Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [CAP3ON]

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program

Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe

bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program

Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [bMbbe976ac] Rundll32.exe

"C:\WINDOWS\system32\fbxgbfum.dll",s

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search

& Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program

Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

(User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

(User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

(User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

(User 'Default user')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk =

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Canon LASER SHOT LBP-1120-statusvindue.LNK =

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Send to OneNote -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}

- C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583}

- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}

- C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class)

- C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class)

-

http://www.update.microsoft.com/microsoftu...b?1189970428296

O18 - Protocol: grooveLocalGWS -

{88FED34C-F0CA-4636-A375-3CB6248B04CD} -

C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program

Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft -

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler

(AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir

PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService)

- Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition

Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program

Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero

BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common

Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC

Connectivity Solution\ServiceLayer.exe

 

--

End of file - 8895 bytes

Endret 17. mai 2008 av grumme

[r2d290]

vil gjerne se loggen som SAS lagde. Start programmet, velg preferences->statestics/logs

 

edit: det ser ut som du har lagt loggen inn i word eller et annet tekstredigeringsprogram som automatisk setter linjeskift for å tilpasse teksten til et A4-ark.

Dette gjør det mindre oversiktlig å lese loggen (da vi må lese to og to linjer), og analyseprogrammer får problemer med å lese loggen.

 

Prøv å få postet loggen sånn som den skal være (notisbok vil beholde linjene riktig).

Endret 15. mai 2008 av r2d290

[grumme]

vil gjerne se loggen som SAS lagde. Start programmet, velg preferences->statestics/logs

 

edit: det ser ut som du har lagt loggen inn i word eller et annet tekstredigeringsprogram som automatisk setter linjeskift for å tilpasse teksten til et A4-ark.

Dette gjør det mindre oversiktlig å lese loggen (da vi må lese to og to linjer), og analyseprogrammer får problemer med å lese loggen.

 

Prøv å få postet loggen sånn som den skal være (notisbok vil beholde linjene riktig).

 

 

Awright!

Takk takk for kjapt svar. Her er saslogen min, via notepad:

 

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 05/15/2008 at 04:12 PM

 

Application Version : 4.0.1154

 

Core Rules Database Version : 3461

Trace Rules Database Version: 1452

 

Scan type : Complete Scan

Total Scan Time : 00:28:54

 

Memory items scanned : 457

Memory threats detected : 2

Registry items scanned : 6300

Registry threats detected : 5

File items scanned : 14424

File threats detected : 26

 

Trojan.Vundo-Variant/Small

C:\WINDOWS\SYSTEM32\CBXPHIGE.DLL

C:\WINDOWS\SYSTEM32\CBXPHIGE.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A9692C80-3C5B-46D2-9BBA-52513D1261A3}

HKCR\CLSID\{A9692C80-3C5B-46D2-9BBA-52513D1261A3}

HKCR\CLSID\{A9692C80-3C5B-46D2-9BBA-52513D1261A3}\InprocServer32

HKCR\CLSID\{A9692C80-3C5B-46D2-9BBA-52513D1261A3}\InprocServer32#ThreadingModel

Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\cbXPhigE

 

Adware.Vundo Variant/Resident

C:\WINDOWS\SYSTEM32\KHFCRLMJ.DLL

C:\WINDOWS\SYSTEM32\KHFCRLMJ.DLL

 

Adware.Tracking Cookie

C:\Documents and Settings\munin\Cookies\[email protected][1].txt

C:\Documents and Settings\munin\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\guest@doubleclick[2].txt

C:\Documents and Settings\Guest\Cookies\guest@serving-sys[2].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\guest@statcounter[1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\guest@imrworldwide[2].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][2].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\guest@advertising[1].txt

C:\Documents and Settings\Guest\Cookies\guest@tradedoubler[2].txt

C:\Documents and Settings\Guest\Cookies\guest@tradedoubler[1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Guest\Cookies\[email protected][2].txt

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt

C:\Documents and Settings\Psychomona\Cookies\[email protected][1].txt

 

Trojan.Unknown Origin

C:\DOCUMENTS AND SETTINGS\PSYCHOMONA\LOCAL SETTINGS\TEMP\SUQPCYSF.EXE

C:\WINDOWS\SYSTEM32\XIFUWYER.EXE

[r2d290]

og så fortsetter du med en combofix-logg uten ekstra innsatt linjer

[grumme]

Hei!

 

FIkk kjørt i gang combofix, men maskina RESTARTA seg... Tips?

[snippsat]

Combofix restarter pcen,den skal gjøre det.

 

Se nå under root c:\(ikke mapper)

Finne combofix.txt denne loggen poster du.

Endret 16. mai 2008 av SNIPPSAT

[grumme]

Takk mann!

Omsider!:

 

 

ComboFix 08-05-15.3 - munin 2008-05-16 22:01:38.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.622 [GMT 2:00]

Running from: C:\Documents and Settings\munin\Desktop\ComboFix.exe

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\pskt.ini

.

---- Previous Run -------

.

C:\WINDOWS\pskt.ini

C:\WINDOWS\system32\aytwvqvb.ini

C:\WINDOWS\system32\JmlRCfhk.ini

C:\WINDOWS\system32\JmlRCfhk.ini2

C:\WINDOWS\system32\lcedmqai.ini

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\rprfclyf.ini

 

.

((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 )))))))))))))))))))))))))))))))

.

 

2008-05-15 15:16 . 2008-05-15 15:33 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-05-15 15:16 . 2008-05-15 15:16 <DIR> d-------- C:\Documents and Settings\munin\Application Data\SUPERAntiSpyware.com

2008-05-15 15:16 . 2008-05-15 15:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2008-05-15 15:02 . 2008-05-15 15:02 133,120 --a------ C:\WINDOWS\system32\fcbwgrao.dll

2008-05-15 14:54 . 2008-05-15 14:54 116,736 --a------ C:\WINDOWS\system32\fylcfrpr.dll

2008-05-15 14:36 . 2008-05-15 14:36 126,464 --a------ C:\WINDOWS\system32\uglmajud.dll

2008-05-14 12:50 . 2008-05-14 13:19 <DIR> d-------- C:\Program Files\Panda Security

2008-05-14 12:01 . 2008-05-14 12:01 113,664 --a------ C:\WINDOWS\system32\bvqvwtya.dll

2008-05-14 11:58 . 2008-05-14 11:58 131,584 --a------ C:\WINDOWS\system32\mnjdbwsu.dll

2008-05-14 11:56 . 2008-05-14 11:56 124,416 --a------ C:\WINDOWS\system32\fbxgbfum.dll

2008-05-13 11:17 . 2007-10-24 13:53 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys

2008-05-13 09:45 . 2008-05-13 09:45 <DIR> d-------- C:\Program Files\Trend Micro

2008-05-13 08:47 . 2008-05-13 08:50 <DIR> d-------- C:\Program Files\SpywareBlaster

2008-05-13 08:47 . 2008-05-15 15:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2008-05-13 08:47 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX

2008-05-13 08:08 . 2008-05-13 08:08 115,712 --a------ C:\WINDOWS\system32\iaqmdecl.dll

2008-05-13 08:02 . 2008-05-13 08:02 132,096 --a------ C:\WINDOWS\system32\fespwinl.dll

2008-05-13 08:00 . 2008-05-13 08:00 125,952 --a------ C:\WINDOWS\system32\gfjlolky.dll

2008-05-13 08:00 . 2008-05-16 21:57 109,825 --a------ C:\WINDOWS\BMbbe976ac.xml

2008-05-12 22:59 . 2008-05-12 22:59 <DIR> d-------- C:\Documents and Settings\Psychomona\Application Data\Ahead

2008-05-11 16:26 . 2008-05-11 16:58 <DIR> d-------- C:\Documents and Settings\munin\Application Data\gtk-2.0

2008-05-11 16:26 . 2008-05-11 16:26 <DIR> d-------- C:\Documents and Settings\munin\.thumbnails

2008-05-11 16:25 . 2008-05-11 16:58 <DIR> d-------- C:\Documents and Settings\munin\.gimp-2.4

2008-05-11 16:24 . 2008-05-11 16:24 <DIR> d-------- C:\Program Files\GIMP-2.0

2008-05-11 16:21 . 2008-05-13 13:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-05-11 16:21 . 2008-05-11 16:21 1,409 --a------ C:\WINDOWS\QTFont.for

2008-05-06 11:55 . 2008-05-06 11:55 <DIR> d-------- C:\Program Files\Common Files\Adobe

2008-04-28 09:38 . 2008-04-28 09:38 <DIR> d-------- C:\WINDOWS\PrimoPDF4

2008-04-28 09:38 . 2008-04-28 09:38 <DIR> d-------- C:\Program Files\activePDF

2008-04-28 09:38 . 2006-12-11 22:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-16 11:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-05-14 22:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help

2008-05-13 11:21 --------- d-----w C:\Documents and Settings\munin\Application Data\uTorrent

2008-05-12 11:48 --------- d-----w C:\Program Files\MediaMonkey

2008-04-30 14:18 --------- d-----w C:\Program Files\uTorrent

2008-04-23 08:28 --------- d-----w C:\Program Files\CCleaner

2008-04-22 20:37 --------- d-----w C:\Documents and Settings\munin\Application Data\Ahead

2008-04-03 15:16 --------- d-----w C:\Program Files\IKEA HomePlanner

2008-04-01 12:17 --------- d-----w C:\Program Files\Java

2008-03-30 20:54 --------- d-----w C:\Program Files\Soulseek

2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-20 13:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-05 11:33 737,280 ----a-w C:\WINDOWS\iun6002.exe

2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{021078D7-A046-448C-B104-D067F2E0661C}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC2BCF97-675E-4373-9E88-8ABBA236F432}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2EA321B-C786-406E-ADBA-89600E32BB03}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cccc4ede-4fc4-4847-80d0-86f1cf0addb0}]

2008-05-15 15:02 133120 --a------ C:\WINDOWS\system32\fcbwgrao.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-07-02 15:36 527360]

 

[HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 09:27 153136]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51 131072]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 17:18 262401]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

"CAP3ON"="C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-08-06 09:00 22528]

"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10 271360]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-15 00:43 286720]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"BMbbe976ac"="C:\WINDOWS\system32\fbxgbfum.dll" [2008-05-14 11:56 124416]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1241088]

 

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\Psychomona\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\munin\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Canon LASER SHOT LBP-1120-statusvindue.LNK - C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE [2007-09-18 22:47:07 30720]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

"VIDC.YV12"= yv12vfw.dll

"msacm.ac3filter"= ac3filter.acm

"msacm.divxa32"= divxa32.acm

"VIDC.ACDV"= ACDV.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]

--a------ 2004-09-13 13:37 1695827 C:\Program Files\ABIT\ABIT uGuru\uGuru.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]

--a------ 2004-11-08 14:23 4489302 C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

"C:\\Program Files\\ABIT\\ABIT uGuru\\FlashMenu.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"=

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"C:\\Program Files\\Soulseek\\slsk.exe"=

 

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2006-01-12 12:56]

R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys [2004-11-01 12:21]

R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys [2004-08-04 13:56]

R3 3xHybrid;Cinergy 600 TV Radio service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-12-04 16:13]

S3 Cap7134;Cinergy 600 TV Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-08-08 13:47]

S3 IKStealthPlug;IK Multimedia StealthPlug Low-Level Driver;C:\WINDOWS\system32\Drivers\IKStealthPlugLL.sys [2006-09-11 13:00]

S3 Memctl;Memctl;C:\Program Files\ABIT\ABIT uGuru\Memctl.sys [2001-11-29 04:49]

S3 TTTv600;Cinergy 600 TV Tuner (MK2);C:\WINDOWS\system32\DRIVERS\PhTvTune.sys [2003-11-04 13:39]

S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys [2007-10-31 15:09]

 

.

Contents of the 'Scheduled Tasks' folder

"2008-05-16 15:10:29 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-16 22:04:10

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-05-16 22:04:43

ComboFix-quarantined-files.txt 2008-05-16 20:04:36

 

Pre-Run: 48,414,482,432 bytes free

Post-Run: 48,406,925,312 bytes free

 

175 --- E O F --- 2008-05-16 12:04:27

[norbat]

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Post loggen.

File::

C:\WINDOWS\system32\fcbwgrao.dll

C:\WINDOWS\system32\fylcfrpr.dll

C:\WINDOWS\system32\uglmajud.dll

C:\WINDOWS\system32\bvqvwtya.dll

C:\WINDOWS\system32\mnjdbwsu.dll

C:\WINDOWS\system32\fbxgbfum.dll

C:\WINDOWS\system32\iaqmdecl.dll

C:\WINDOWS\system32\fespwinl.dll

C:\WINDOWS\system32\gfjlolky.dll

C:\WINDOWS\BMbbe976ac.xml

 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{021078D7-A046-448C-B104-D067F2E0661C}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC2BCF97-675E-4373-9E88-8ABBA236F432}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2EA321B-C786-406E-ADBA-89600E32BB03}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cccc4ede-4fc4-4847-80d0-86f1cf0addb0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BMbbe976ac"=-

Endret 16. mai 2008 av norbat

[grumme]

Her er den!

 

 

 

ComboFix 08-05-15.3 - munin 2008-05-16 23:20:17.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.524 [GMT 2:00]

Running from: C:\Documents and Settings\munin\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\munin\Desktop\CFScript.txt

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

 

FILE ::

C:\WINDOWS\BMbbe976ac.xml

C:\WINDOWS\system32\bvqvwtya.dll

C:\WINDOWS\system32\fbxgbfum.dll

C:\WINDOWS\system32\fcbwgrao.dll

C:\WINDOWS\system32\fespwinl.dll

C:\WINDOWS\system32\fylcfrpr.dll

C:\WINDOWS\system32\gfjlolky.dll

C:\WINDOWS\system32\iaqmdecl.dll

C:\WINDOWS\system32\mnjdbwsu.dll

C:\WINDOWS\system32\uglmajud.dll

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\BMbbe976ac.xml

C:\WINDOWS\system32\bvqvwtya.dll

C:\WINDOWS\system32\fbxgbfum.dll

C:\WINDOWS\system32\fcbwgrao.dll

C:\WINDOWS\system32\fespwinl.dll

C:\WINDOWS\system32\fylcfrpr.dll

C:\WINDOWS\system32\gfjlolky.dll

C:\WINDOWS\system32\iaqmdecl.dll

C:\WINDOWS\system32\mnjdbwsu.dll

C:\WINDOWS\system32\uglmajud.dll

 

.

((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 )))))))))))))))))))))))))))))))

.

 

2008-05-15 15:16 . 2008-05-15 15:33 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-05-15 15:16 . 2008-05-15 15:16 <DIR> d-------- C:\Documents and Settings\munin\Application Data\SUPERAntiSpyware.com

2008-05-15 15:16 . 2008-05-15 15:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2008-05-14 12:50 . 2008-05-14 13:19 <DIR> d-------- C:\Program Files\Panda Security

2008-05-13 11:17 . 2007-10-24 13:53 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys

2008-05-13 09:45 . 2008-05-13 09:45 <DIR> d-------- C:\Program Files\Trend Micro

2008-05-13 08:47 . 2008-05-13 08:50 <DIR> d-------- C:\Program Files\SpywareBlaster

2008-05-13 08:47 . 2008-05-15 15:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2008-05-13 08:47 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX

2008-05-12 22:59 . 2008-05-12 22:59 <DIR> d-------- C:\Documents and Settings\Psychomona\Application Data\Ahead

2008-05-11 16:26 . 2008-05-11 16:58 <DIR> d-------- C:\Documents and Settings\munin\Application Data\gtk-2.0

2008-05-11 16:26 . 2008-05-11 16:26 <DIR> d-------- C:\Documents and Settings\munin\.thumbnails

2008-05-11 16:25 . 2008-05-11 16:58 <DIR> d-------- C:\Documents and Settings\munin\.gimp-2.4

2008-05-11 16:24 . 2008-05-11 16:24 <DIR> d-------- C:\Program Files\GIMP-2.0

2008-05-11 16:21 . 2008-05-13 13:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-05-11 16:21 . 2008-05-11 16:21 1,409 --a------ C:\WINDOWS\QTFont.for

2008-05-06 11:55 . 2008-05-06 11:55 <DIR> d-------- C:\Program Files\Common Files\Adobe

2008-04-28 09:38 . 2008-04-28 09:38 <DIR> d-------- C:\WINDOWS\PrimoPDF4

2008-04-28 09:38 . 2008-04-28 09:38 <DIR> d-------- C:\Program Files\activePDF

2008-04-28 09:38 . 2006-12-11 22:12 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-16 11:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-05-14 22:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help

2008-05-13 11:21 --------- d-----w C:\Documents and Settings\munin\Application Data\uTorrent

2008-05-12 11:48 --------- d-----w C:\Program Files\MediaMonkey

2008-04-30 14:18 --------- d-----w C:\Program Files\uTorrent

2008-04-23 08:28 --------- d-----w C:\Program Files\CCleaner

2008-04-22 20:37 --------- d-----w C:\Documents and Settings\munin\Application Data\Ahead

2008-04-03 15:16 --------- d-----w C:\Program Files\IKEA HomePlanner

2008-04-01 12:17 --------- d-----w C:\Program Files\Java

2008-03-30 20:54 --------- d-----w C:\Program Files\Soulseek

2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-20 13:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-05 11:33 737,280 ----a-w C:\WINDOWS\iun6002.exe

2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-07-02 15:36 527360]

 

[HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 09:27 153136]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51 131072]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 17:18 262401]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

"CAP3ON"="C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-08-06 09:00 22528]

"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10 271360]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-15 00:43 286720]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1241088]

 

C:\Documents and Settings\Guest\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\Psychomona\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\munin\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

 

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Canon LASER SHOT LBP-1120-statusvindue.LNK - C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE [2007-09-18 22:47:07 30720]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

"VIDC.YV12"= yv12vfw.dll

"msacm.ac3filter"= ac3filter.acm

"msacm.divxa32"= divxa32.acm

"VIDC.ACDV"= ACDV.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]

--a------ 2004-09-13 13:37 1695827 C:\Program Files\ABIT\ABIT uGuru\uGuru.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]

--a------ 2004-11-08 14:23 4489302 C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

"C:\\Program Files\\ABIT\\ABIT uGuru\\FlashMenu.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=

"C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"=

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"C:\\Program Files\\Soulseek\\slsk.exe"=

 

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2006-01-12 12:56]

R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys [2004-11-01 12:21]

R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys [2004-08-04 13:56]

R3 3xHybrid;Cinergy 600 TV Radio service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-12-04 16:13]

S3 Cap7134;Cinergy 600 TV Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-08-08 13:47]

S3 IKStealthPlug;IK Multimedia StealthPlug Low-Level Driver;C:\WINDOWS\system32\Drivers\IKStealthPlugLL.sys [2006-09-11 13:00]

S3 Memctl;Memctl;C:\Program Files\ABIT\ABIT uGuru\Memctl.sys [2001-11-29 04:49]

S3 TTTv600;Cinergy 600 TV Tuner (MK2);C:\WINDOWS\system32\DRIVERS\PhTvTune.sys [2003-11-04 13:39]

S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys [2007-10-31 15:09]

 

.

Contents of the 'Scheduled Tasks' folder

"2008-05-16 15:10:29 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-16 23:20:57

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-05-16 23:21:33

ComboFix-quarantined-files.txt 2008-05-16 21:21:21

ComboFix2.txt 2008-05-16 20:04:44

 

Pre-Run: 49,677,934,592 bytes free

Post-Run: 49,666,265,088 bytes free

 

172 --- E O F --- 2008-05-16 12:04:27

[norbat]

Ser fin ut dette.

 

Lag en ny hjt-logg, så tar vi en siste titt.

[grumme]

Sådann:

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:33:33, on 16.05.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\CAP3RSK.EXE

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://filehippo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {021078D7-A046-448C-B104-D067F2E0661C} - (no file)

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {AC2BCF97-675E-4373-9E88-8ABBA236F432} - (no file)

O2 - BHO: (no name) - {C2EA321B-C786-406E-ADBA-89600E32BB03} - (no file)

O2 - BHO: (no name) - {cccc4ede-4fc4-4847-80d0-86f1cf0addb0} - (no file)

O2 - BHO: (no name) - {F1B2B165-FBF2-4EB3-98FF-9CF5506062B5} - (no file)

O3 - Toolbar: &TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [bMbbe976ac] Rundll32.exe "C:\WINDOWS\system32\fbxgbfum.dll",s

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Canon LASER SHOT LBP-1120-statusvindue.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1189970428296

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

 

--

End of file - 8539 bytes

[norbat]

Mulig disse ikke lengre ligger der men....

 

Start hje, velg "Do a system scan only", sett merke framfor følgende linjer og klikk Fix checked:

O2 - BHO: (no name) - {021078D7-A046-448C-B104-D067F2E0661C} - (no file)

O2 - BHO: (no name) - {AC2BCF97-675E-4373-9E88-8ABBA236F432} - (no file)

O2 - BHO: (no name) - {C2EA321B-C786-406E-ADBA-89600E32BB03} - (no file)

O2 - BHO: (no name) - {cccc4ede-4fc4-4847-80d0-86f1cf0addb0} - (no file)

O2 - BHO: (no name) - {F1B2B165-FBF2-4EB3-98FF-9CF5506062B5} - (no file)

O4 - HKLM\..\Run: [bMbbe976ac] Rundll32.exe "C:\WINDOWS\system32\fbxgbfum.dll",s

 

Ut over disse ser loggene dine fine ut.

 

Kjører PC-en ok?

[grumme]

Maskina funker som faen nå ass... De linjene som du satte opp i sist innlegg var ikke i hjt-scanningen..

 

Trnger dem kanskje ikke?

 

forresten, sorry, de ligger der. Skal ta fix checked jeg!

[grumme]

Awright: Nu er det gjort og alt ser bra ut! Takk takktakk! Ufattelig bra!

 

Noget mer?

[norbat]

Gjør det. Det kan være en ide å lukke nettleseren før du klikker Fix checked.

 

Hvis PC-en kjører greit, kan du avinstallere combofix ved å skrive combofix /u fra kjør-feltet (start->kjør).

Dette fjerner programmet og nullstiller systemgjenopprettingen.

 

Surf trygt

[grumme]

Atter: Mange mange takk!!

[r2d290]

Så bra at det løste seg

 

Du kan nå endre emnetittelen på tråden din (siden det virker som at problemet er løst).

 

Rediger førsteinnlegget ditt med FULL redigering, og skriv:

[LØST]

foran emnetittelen din. Dette vil hjelpe til med å gjøre forumet mer ryddig

 

edit: SUPERantispyware beholder du, og scanner regelmessig. Spyware search and destroy kan du godt avinstallere hvis du ønsker det (da SAS tar mer enn search and destoy...

Hijackthis kan etter ønske avinstalleres via legg til/fjern programmer. Programmet er såpass lite at du lett kan laste ned ny verson ved nye problemer...

Endret 16. mai 2008 av r2d290

[grumme]

Jess! Måtte bare teste maskina litt først.

Alt er i skjønneste orden. Dataen funker rba. Gigantisk lettelse.

 

OG: Gratulerer med dagen folkens!

[r2d290]

OG: Gratulerer med dagen folkens!

 

takk det samme