[yay LØST] Kan noen sjekke mine 2 logger ?! Vundo Fix fant ingen oO

Moff · 30. mai 2008

Føler jeg har masse dritt på pc en nå

Den har symptomer som for eksempel : Mapper og for eksempel min datamaskin kan plutselig finne på å ikke svare.

En del pop-ups ( kommer plutselig opp filmer om en mann som støvsuger gjørme, mobil reklame hvor det står "den nakne tittern

og denne linken kommer opp i Internet explorer IKKE KLIKK PÅ DEN

Klikk for å se/fjerne innholdet nedenfor

http://85.12.43.74/go/?cmp=nwntvchk&ni...v_4&rid=mm2

ALT går mye tregere enn før

Norton finner trojan vundo stadig vekk og fjerner dem, "alle trusler som er funnet er fjernet" men greiene over fortsetter

Vundo fix fant ingen ting

Men her er hvertfall loggen fra hijackThis

Klikk for å se/fjerne innholdet nedenfor

ALogfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:33:48, on 30.05.2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\Protector Suite QL\psqltray.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Program Files\Windows Mail\WinMail.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

D:\BitLord\BitLord.exe

C:\Users\Lefse Joar\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.defaulthomepage.info

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll

O2 - BHO: (no name) - {56360615-86DC-4753-B01F-84548F1D4B5C} - C:\Windows\system32\awtuvTmK.dll

O2 - BHO: (no name) - {6C92C603-0BA5-4E11-B738-B2C4603BDC70} - C:\Windows\system32\vtUmJddB.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: {d49b221f-3729-427a-d384-7c3cc84bd73d} - {d37db48c-c3c7-483d-a724-9273f122b94d} - C:\Windows\system32\qfsoffuo.dll

O2 - BHO: (no name) - {E243A8E7-6244-49E0-A361-22DBF30FD46C} - C:\Windows\system32\urqNEXrp.dll

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

O4 - HKLM\..\Run: [sVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup

O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto

O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\urqNEXrp.dll,#1

O4 - HKLM\..\Run: [7a417554] rundll32.exe "C:\Windows\system32\rbmatdbt.dll",b

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\LefseJO~1\AppData\Local\Temp\hgGxUMET.dll,#1

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [7a417554] rundll32.exe "C:\Users\LefseJO~1\AppData\Local\Temp\dygkatyd.dll",b

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Startup: Aquarius Soft PC Alarm Clock Pro.lnk = C:\Program Files\Aquarius Soft\PC Alarm Clock Pro\alarm.exe

O4 - Global Startup: Bluetooth Manager.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?NO (file missing)

O13 - Gopher Prefix:

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HD DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 10899 bytes

Evig taknemmeleg for all hjelp :dontgetit:

Combofix Log

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-05-29.1 - Lefse Joar 2008-05-30 12:07:23.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1044.18.851 [GMT 2:00]

Running from: C:\Users\Lefse Joar\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Windows\System32\aKUBcfii.ini

C:\Windows\System32\aKUBcfii.ini2

C:\Windows\system32\aveyumxi.dll

C:\Windows\system32\awturPIy.dll

C:\Windows\system32\awtuvTmK.dll

C:\Windows\System32\BddJmUtv.ini

C:\Windows\System32\BddJmUtv.ini2

C:\Windows\System32\BLTuvGgh.ini

C:\Windows\System32\BLTuvGgh.ini2

C:\Windows\system32\cbXQjiiG.dll

C:\Windows\system32\ccpoiydy.dll

C:\Windows\system32\chqkfjtg.dll

C:\Windows\system32\ecfhtssi.dll

C:\Windows\system32\ekbmvpgl.ini

C:\Windows\system32\eofniwll.dll

C:\Windows\System32\Fgiknqru.ini

C:\Windows\System32\Fgiknqru.ini2

C:\Windows\system32\fgilkkpr.ini

C:\Windows\System32\GiijQXbc.ini

C:\Windows\System32\GiijQXbc.ini2

C:\Windows\system32\hgGvuTLB.dll

C:\Windows\system32\hopbhrlu.dll

C:\Windows\system32\ihwbqbrl.dll

C:\Windows\system32\iifcBUKa.dll

C:\Windows\System32\Ikknmnnn.ini

C:\Windows\System32\Ikknmnnn.ini2

C:\Windows\system32\isxahokb.dll

C:\Windows\system32\jbafargg.ini

C:\Windows\system32\kbyugfcv.ini

C:\Windows\system32\khfeEVpn.dll

C:\Windows\System32\KmTvutwa.ini

C:\Windows\System32\KmTvutwa.ini2

C:\Windows\system32\lixquqlb.dll

C:\Windows\system32\lkmedngg.dll

C:\Windows\system32\lurxcdlj.dll

C:\Windows\system32\mcrh.tmp

C:\Windows\system32\mgkaqqvb.dll

C:\Windows\system32\nfmdkxdf.ini

C:\Windows\system32\nnnmnkkI.dll

C:\Windows\system32\npVEefhk.ini

C:\Windows\System32\npVEefhk.ini2

C:\Windows\system32\nrgeisrb.ini

C:\Windows\system32\oksavanm.dll

C:\Windows\system32\ouiapben.ini

C:\Windows\system32\qfsoffuo.dll

C:\Windows\system32\qitvlkln.ini

C:\Windows\system32\qtmmsvjn.dll

C:\Windows\system32\rbmatdbt.dll

C:\Windows\system32\rgkehtpo.dll

C:\Windows\system32\sfrakntu.ini

C:\Windows\System32\tbdtambr.ini

C:\Windows\system32\twbxvueq.dll

C:\Windows\system32\UpMedia

C:\Windows\system32\urqNEXrp.dll

C:\Windows\system32\urqnkigF.dll

C:\Windows\system32\uwsquqex.dll

C:\Windows\system32\vtUkkIcY.dll

C:\Windows\system32\vtUmJddB.dll

C:\Windows\system32\wjsifxbk.dll

C:\Windows\system32\xggpbfgd.ini

C:\Windows\system32\yahkqxgp.ini

C:\Windows\system32\yasmeglo.dll

C:\Windows\System32\YcIkkUtv.ini

C:\Windows\System32\YcIkkUtv.ini2

C:\Windows\system32\yIPrutwa.ini

C:\Windows\System32\yIPrutwa.ini2

C:\Windows\system32\ywvbibou.dll

.

((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-30 )))))))))))))))))))))))))))))))

.

No new files created in this timespan

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-30 10:16 --------- d-----w C:\Program Files\Common Files\Steam

2008-05-30 10:15 --------- d-----w C:\Program Files\Steam

2008-05-29 21:16 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\dvdcss

2008-05-28 20:11 --------- d-----w C:\Program Files\ThreatExpert Memory Scanner

2008-05-27 16:27 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\LimeWire

2008-05-27 16:09 104,847 ----a-w C:\Users\Lefse Joar\AppData\Roaming\nvModes.dat

2008-05-26 17:35 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-26 17:34 --------- d-----w C:\Program Files\LucasArts

2008-05-25 19:17 174 --sha-w C:\Program Files\desktop.ini

2008-05-25 19:13 --------- d-----w C:\Program Files\Windows Mail

2008-05-25 19:13 --------- d-----w C:\Program Files\Windows Calendar

2008-05-25 18:44 --------- d-----w C:\Program Files\SystemRequirementsLab

2008-05-25 18:18 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-05-25 11:54 --------- d-----w C:\ProgramData\Symantec

2008-05-25 11:46 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF

2008-05-25 11:46 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS

2008-05-25 11:46 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT

2008-05-25 11:46 --------- d-----w C:\Program Files\Symantec

2008-05-25 11:45 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-05-25 11:38 --------- d-----w C:\Program Files\Norton Internet Security

2008-05-15 18:31 --------- d-----w C:\Program Files\Dictionary

2008-05-12 23:21 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\Aquarius Soft

2008-05-12 23:21 --------- d-----w C:\ProgramData\Aquarius Soft

2008-05-12 14:58 --------- d-----w C:\Program Files\CDisplay

2008-05-12 13:03 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\Activision

2008-05-09 06:33 --------- d-----w C:\Program Files\Graph

2008-05-08 19:22 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\ErrorSmart

2008-05-03 13:17 352,256 ----a-w C:\Windows\eSellerateEngine.dll

2008-04-25 20:36 --------- d-----w C:\Program Files\World of Warcraft

2008-04-10 13:19 --------- d-----w C:\Users\Lefse Joar\AppData\Roaming\Ubisoft

2008-04-10 13:07 --------- d-----w C:\ProgramData\Ubisoft

2008-04-10 12:18 --------- d-----w C:\ProgramData\Media Center Programs

2008-04-09 17:32 --------- d-----w C:\Program Files\MSECache

2008-04-02 18:08 --------- d-----w C:\Program Files\GameSpy

2008-04-02 18:04 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys

2008-04-02 18:04 22,328 ----a-w C:\Users\Lefse Joar\AppData\Roaming\PnkBstrK.sys

2008-04-02 18:04 103,736 ----a-w C:\Windows\System32\PnkBstrB.exe

2008-04-02 18:03 669,184 ----a-w C:\Windows\System32\pbsvc.exe

2008-04-02 18:03 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe

2008-04-02 17:42 --------- d-----w C:\Program Files\Electronic Arts

2008-03-24 15:15 21,036 ----atw C:\Windows\System32\SIntfNT.dll

2008-03-24 15:15 15,132 ----atw C:\Windows\System32\SIntf32.dll

2008-03-24 15:15 12,067 ----atw C:\Windows\System32\SIntf16.dll

2008-03-08 04:30 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-03-08 04:30 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-03-08 04:30 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-03-08 04:30 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-03-08 04:30 1,686,528 ----a-w C:\Windows\System32\gameux.dll

2008-03-08 00:37 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll

2008-03-08 00:22 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll

2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll

2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll

2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll

2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe

2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe

2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll

2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll

2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys

2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll

2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll

2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-02-19 05:10 620,088 ----a-w C:\Windows\System32\ci.dll

2008-02-15 02:08 194,560 ----a-w C:\Windows\System32\WebClnt.dll

2008-02-15 02:04 24,064 ----a-w C:\Windows\System32\netcfg.exe

2008-02-15 02:03 22,016 ----a-w C:\Windows\System32\netiougc.exe

2008-02-15 02:03 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll

2008-02-14 23:19 944,184 ----a-w C:\Windows\System32\winload.exe

2007-09-26 19:09 0 ----a-w C:\Users\Lefse Joar\AppData\Roaming\wklnhst.dat

.

------- Sigcheck -------

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]

@={F2F31467-B1AC-4df0-AE79-FD5FA085E22B}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]

@={A3E208F7-0E3A-4182-A7A6-B169D5D691AA}

[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]

2006-12-03 18:03 2854912 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]

2006-12-03 18:03 2854912 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 14:36 413696]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]

"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-29 18:21 1271032]

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 16:16 171464]

"AlcoholAutomount"="D:\Alcohol 120\axcmd.exe" [ ]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KeNotify"="C:\Program Files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 18:14 34352]

"SVPWUTIL"="C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 22:42 438272]

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 13:48 577536]

"RtHDVCpl"="RtHDVCpl.exe" [2007-06-13 07:11 4489216 C:\Windows\RtHDVCpl.exe]

"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 11:39 411192]

"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 17:49 55416]

"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-05-23 16:57 509496]

"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 17:32 538744]

"HWSetup"="\HWSetup.exe" [ ]

"NDSTray.exe"="NDSTray.exe" []

"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2006-12-03 17:29 49168]

"Desktop SMS"="C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 11:51 1507328]

"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 17:40 413696]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 04:53 894512]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 16:00 571024]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 14:37 174872]

"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 17:49 33048]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00 267064]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-24 08:20 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-24 08:20 8534560]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-24 08:20 81920]

"ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [ ]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-02-20 14:17 115816]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-02-27 15:31:34 2756608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

C:\Windows\system32\psqlpwd.dll 2006-12-03 17:50 90112 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{FCB8D8C1-84B3-4C2E-8F41-D63BEC129936}"= Profile=Private|C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{33DADA24-9E4D-4EB6-91B0-388B41B666F7}"= UDP:D:\Spill\game.dat:The Battle for Middle-earth

"{8C892362-B69D-48F7-B8B7-EB8DE84E76D7}"= TCP:D:\Spill\game.dat:The Battle for Middle-earth

"{836F2060-CE16-4318-8A5F-3D56FC9CFD76}"= UDP:C:\Program Files\EA GAMES\Kampen om Midgard\game.dat:Kampen om Midgard

"{A22B0921-346D-44F8-8B24-8AFB6D40B21D}"= TCP:C:\Program Files\EA GAMES\Kampen om Midgard\game.dat:Kampen om Midgard

"{9954BA49-5F0B-4750-ACC3-D78FB4D1E9BA}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA

"{7FE20B85-C19E-46F1-836D-65E202C9AC0B}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA

"{1A4C7269-A414-4011-8139-F065974CFF0C}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB

"{E72417DB-C7D5-4F39-A28E-C19F6BD1C392}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB

"{DF7D4531-88FE-49DB-A5A2-B7B8320CFFF8}"= UDP:D:\Spill\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

"{D49271EF-D1AB-48C8-8A9B-E45803996474}"= TCP:D:\Spill\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

"{E50224F9-7C20-4FDB-92C8-7F6654E332A6}"= Disabled:UDP:D:\Spill\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10

"{18345D8D-545E-4350-8852-9A8697E47BB5}"= Disabled:TCP:D:\Spill\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10

"{C50E8251-9CB0-4725-A0E9-E04B13895FFC}"= Disabled:UDP:D:\Spill\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9

"{5E4CB04E-D529-4692-9626-8144B3B047E6}"= Disabled:TCP:D:\Spill\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9

"{8698867E-02B5-4BA7-AD51-12A79D409FF5}"= Disabled:UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32

"{45C71581-9B9E-4BF5-AF15-F2007850228A}"= Disabled:TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32

"{7DF0D160-C823-4846-B27D-7B94138607A9}"= Disabled:UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32

"{5A893ACE-C8A6-43B4-859F-CE532B2F719D}"= Disabled:TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32

"{B525E38E-D6CD-42DF-9890-6F6B74948A64}"= Disabled:UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{78AC45CB-5194-4E04-BC91-2E73328FF02F}"= Disabled:TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{C220BCD0-CF04-4909-8A54-5190718430EE}"= Disabled:UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{321A65E5-7B63-406F-9083-1DDDEFFF4D61}"= Disabled:TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

"{AFC06DAC-7FA5-4D91-A462-C4CFC83EBA6A}"= Disabled:UDP:D:\LimeWire\LimeWire.exe:LimeWire

"{F14DFA60-B6B4-4260-9E7D-89AD5AD2A993}"= Disabled:TCP:D:\LimeWire\LimeWire.exe:LimeWire

"{646DA9AE-E86F-46FC-AB7A-6F7C30BE6F3A}"= Disabled:C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

R0 CplIR;Embedded IR Driver;C:\Windows\system32\DRIVERS\CplIR.SYS [2007-03-06 16:01]

R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 01:11]

R0 LPCFilter;LPC Lower Filter Driver;C:\Windows\system32\DRIVERS\LPCFilter.sys [2006-07-28 17:25]

R0 tos_sps32;TOSHIBA tos_sps32 Service;C:\Windows\system32\DRIVERS\tos_sps32.sys [2007-04-29 14:54]

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080529.001\IDSvix86.sys [2008-05-13 00:27]

R2 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-02-20 14:15]

R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\TOSHIBA\TOSHIBA HD DVD PLAYER\TNaviSrv.exe [2007-05-26 08:55]

R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 22:55]

R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-05-30 09:07]

R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-02-20 14:21]

R3 TcUsb;TC USB Kernel Driver;C:\Windows\system32\Drivers\tcusb.sys [2006-12-03 17:21]

R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 13:50]

R3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 17:32]

R3 UVCFTR;UVCFTR;C:\Windows\system32\Drivers\UVCFTR_S.SYS [2007-04-16 11:19]

S3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2006-11-02 09:30]

S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2007-01-18 16:40]

S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2007-01-18 16:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04565bcb-762f-11dc-806f-001b381d8b30}]

\shell\AutoRun\command - H:\Install.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{415fb467-757d-11dc-be45-001b381d8b30}]

\shell\AutoRun\command - E:\setup\rsrc\autorun.exe

\shell\dinstall\command - E:\Directx\dxsetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cc61a17-1139-11dd-8631-ff5b0663d321}]

\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\start.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff9f14a9-98de-11dc-ad3a-00037aca2fea}]

\shell\AutoRun\command - I:\LaunchU3.exe

*Newly Created Service* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

"2008-05-30 01:30:00 C:\Windows\Tasks\ErrorSmart Scheduled Scan.job"

- C:\Program Files\ErrorSmart\ErrorSmart.ex

- C:\Program Files\ErrorSmar

"2008-05-26 20:06:01 C:\Windows\Tasks\Norton Internet Security Online - Kjør fullstendig systemsøk - Lefse Joar.job"

Endret 31. mai 2008 av Moff

snippsat · 30. mai 2008

Ja combofix ryddet bra opp.

---

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser og"svar ja til og reparere"

---

Last ned oppdatere og kjør full scan SAS free

Post loggen fra SAS (preferences->statistics/logs)

---

Restart og en ny HijackThis logg.

Moff · 30. mai 2008

Tusen takk for svar SNIPPSAT !

her er nye logger

HijackThis

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:48, on 2008-05-30

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Protector Suite QL\psqltray.exe

C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\Windows Mail\WinMail.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Users\Lefse Joar\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157