[LØST] Virus i system32 mappen

Thomas. · 25. juni 2008

Jeg har vist et virus der..

Jeg har tatt SS av det:

Hva skal jeg gjøre ?

Endret 28. juni 2008 av php_user

Thomas. · 25. juni 2008

Det samme kom opp igjen.. (PDM.exe)

Bare nå kom det fra SearchProtocolHost.exe (system32 mappa)

PerB · 26. juni 2008

Har du forsøkt å søke på nettet?

I Wikipedia kan du lese følgende:

In software Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs) within the Microsoft Windows operating system.

At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in Windows XP Professional can run the following command at the system prompt to get a breakdown ......

På google med PDM.exe:

The file "pdm.exe" is known to be created under the following filename:

%ProgramFiles%\pdm\pdm.exe

Note: %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following threats are known to be associated with the file "pdm.exe":

Threat Alias Number of Incidents

Application.Ardamax_Keylogger [PC Tools] 2

not-a-virus:Monitor.Win32.Ardamax.dp [Kaspersky Lab] 1

Spyware.Ardakey [symantec]

For SearchProtocolHost.exe:

The process SearchProtocolHost.exe or Microsoft Windows Search Protocol Host belongs to the software Microsoft® Windows® Operating System or SearchProtocolHost.exe by Microsoft Corporation (www.microsoft.com).

Description: File SearchProtocolHost.exe is located in the folder C:\Windows\System32 or sometimes in a subfolder of C:\Windows. Known file sizes on Windows XP are 182784 bytes (65% of all occurrence), 204288 bytes, 156160 bytes.

The program is not visible. It is a trustworthy file from Microsoft. It is not a Windows system file. Therefore the technical security rating is 14% dangerous.

Important: Some malware camouflage themselves as SearchProtocolHost.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the SearchProtocolHost.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.

Edit: Noen tillegg.

Endret 26. juni 2008 av PerB

Snorre · 26. juni 2008

Denne tråden er feilpostet. Vi har en egen kategori for "Antivirusprogrammer og datasikkerhet". Alle spørsmål om virus, spyware, rootkits, og hvordan man forebygger mot og blir kvitt disse kan postes der. For å finne kategorien kan du gå inn på:

Forum > Programvare > Antivirusprogrammer og datasikkerhet

Flytter tråden for deg nå, og lar det ligge en lenke igjen i denne kategorien.

Snorre

*Tråd flyttes*

snippsat · 26. juni 2008

Last ned HijackThis legg i egen mappe på skrivebordet.

Start programmet og velg "Trykk scan og save log"

Post HijackThis.txt

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Thomas. · 26. juni 2008

Last ned HijackThis legg i egen mappe på skrivebordet.
Start programmet og velg "Trykk scan og save log"

Post HijackThis.txt

Her er loggen:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:38:27, on 26.06.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Windows\OEM02Mon.exe

C:\Program Files\Java\jre1.6.0\bin\jusched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Dell\MediaDirect\PCMService.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\CyberLink\Shared Files\brs.exe

C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Fingerprint Reader Suite\psqltray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\iTunes\iTunes.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Thomas\Desktop\f\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer levert av Dell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ProAct - {2FF811E6-8925-4084-A649-C159955E67E8} - C:\Windows\system32\ks94.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup

O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"

O4 - HKLM\..\Run: [bDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O13 - Gopher Prefix:

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe

O23 - Service: Apache2.2 - Unknown owner - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe (file missing)

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: wampapache - Apache Software Foundation - c:\WAMP\bin\apache\apache2.2.8\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\WAMP\bin\mysql\mysql5.0.51a\bin\mysqld-nt.exe

--

End of file - 12266 bytes

Last Combofix ned ,legg på skrivebordet.
Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Logg:

ComboFix 08-06-20.4 - Thomas 2008-06-26 12:48:33.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.1929 [GMT 2:00]

Running from: C:\Users\Thomas\Desktop\ComboFix.exe

* Created a new restore point

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat

C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat

C:\Users\Thomas\AppData\Roaming\inst.exe

C:\Windows\system32\drivers\npf.sys

C:\Windows\system32\packet.dll

C:\Windows\system32\pthreadVC.dll

C:\Windows\system32\wpcap.dll

----- BITS: Possible infected sites -----

hxxp://theinstalls.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))

.

2008-06-25 23:23 . 2008-06-25 23:23 18,944 --a------ C:\Windows\System32\ks94.dll

2008-06-25 23:22 . 2008-06-25 23:22 18,944 --a------ C:\Windows\System32\ksisys.dll

2008-06-25 23:22 . 2008-06-25 23:22 18,944 --a------ C:\Windows\System32\dopadio.dll

2008-06-25 23:21 . 2008-06-25 23:24 <DIR> d-------- C:\Program Files\Deluxe Ski Jump 3

2008-06-25 22:45 . 2008-06-25 22:46 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\GetRightToGo

2008-06-25 22:45 . 2008-06-25 22:45 <DIR> d-------- C:\Downloads

2008-06-24 18:05 . 2008-06-24 18:24 <DIR> d-------- C:\Program Files\nusphere

2008-06-23 11:36 . 2008-06-23 11:36 <DIR> d-------- C:\Program Files\SoftByte Labs

2008-06-23 10:40 . 2008-06-23 10:40 <DIR> d-------- C:\Program Files\Rockstar Games

2008-06-21 09:43 . 2008-06-21 09:43 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-06-20 22:54 . 2008-06-20 22:54 <DIR> d-------- C:\Program Files\SpeedFan

2008-06-20 22:54 . 2008-06-20 22:54 45 --a------ C:\Windows\System32\initdebug.nfo

2008-06-20 18:32 . 2008-06-20 18:32 <DIR> d-------- C:\Program Files\iTunes

2008-06-20 18:32 . 2008-06-20 18:32 <DIR> d-------- C:\Program Files\iPod

2008-06-20 18:26 . 2008-06-20 18:26 <DIR> d-------- C:\Program Files\Common Files\Apple

2008-06-20 17:33 . 2005-05-26 15:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll

2008-06-20 16:01 . 2008-06-20 16:01 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf

2008-06-20 14:58 . 2008-06-21 00:09 156 --a------ C:\Windows\Twunk001.MTX

2008-06-20 14:58 . 2008-06-21 00:09 2 --a------ C:\Windows\Twain001.Mtx

2008-06-20 14:58 . 2008-06-20 14:58 0 --a------ C:\Windows\Twunk002.MTX

2008-06-20 14:55 . 2008-06-20 14:55 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\Sony

2008-06-20 14:55 . 2008-06-20 14:55 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\Publish Providers

2008-06-20 14:50 . 2008-06-20 14:50 <DIR> d-------- C:\Users\All Users\Sony

2008-06-20 14:50 . 2008-06-20 14:50 <DIR> d-------- C:\ProgramData\Sony

2008-06-20 14:50 . 2008-06-20 14:50 <DIR> d-------- C:\Program Files\Sony

2008-06-20 14:49 . 2008-06-20 14:49 <DIR> d-------- C:\Program Files\Sony Setup

2008-06-16 23:33 . 2008-06-16 23:34 <DIR> d-------- C:\Program Files\Magic Video Converter

2008-06-16 23:33 . 2004-05-26 21:37 719,872 --a------ C:\Windows\System32\devil.dll

2008-06-16 23:33 . 2003-03-19 11:03 544,768 --a------ C:\Windows\System32\msvcr71d.dll

2008-06-16 23:33 . 2002-01-05 14:37 344,064 --a------ C:\Windows\System32\msvcr70.dll

2008-06-16 23:33 . 2006-09-16 19:44 314,368 --a------ C:\Windows\System32\avisynth.dll

2008-06-16 17:01 . 2004-08-18 03:34 442,368 --a------ C:\Windows\System32\vp6vfw.dll

2008-06-15 22:28 . 2008-06-16 18:01 <DIR> d-------- C:\Program Files\Tensons

2008-06-15 15:01 . 2008-06-15 15:01 <DIR> d-------- C:\Users\All Users\NFS Underground

2008-06-15 15:01 . 2008-06-15 15:01 <DIR> d-------- C:\ProgramData\NFS Underground

2008-06-15 00:18 . 2008-06-15 14:47 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\ImgBurn

2008-06-15 00:16 . 2008-06-15 00:16 <DIR> d-------- C:\Program Files\ImgBurn

2008-06-14 11:08 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll

2008-06-14 11:08 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll

2008-06-14 11:08 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax

2008-06-14 11:08 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax

2008-06-13 16:15 . 2008-01-19 09:43 3,600,440 --a------ C:\Windows\System32\ntkrnlpa.exe

2008-06-13 16:15 . 2008-01-19 09:43 3,548,728 --a------ C:\Windows\System32\ntoskrnl.exe

2008-06-13 16:15 . 2008-01-19 09:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe

2008-06-13 16:15 . 2008-01-19 09:36 1,541,120 --a------ C:\Windows\System32\onex.dll

2008-06-13 16:15 . 2008-01-19 09:42 51,768 --a------ C:\Windows\System32\PSHED.DLL

2008-06-13 16:12 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll

2008-06-13 16:11 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr

2008-06-13 16:10 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL

2008-06-13 16:09 . 2008-01-19 09:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe

2008-06-13 16:09 . 2008-01-05 13:31 145,455 --a------ C:\Windows\System32\perfmon.msc

2008-06-13 16:09 . 2008-01-05 13:22 144,909 --a------ C:\Windows\System32\fsmgmt.msc

2008-06-13 16:09 . 2008-01-05 13:31 3 --a------ C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf

2008-06-13 16:08 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll

2008-06-13 16:08 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll

2008-06-13 16:08 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll

2008-06-13 16:07 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll

2008-06-13 16:07 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe

2008-06-13 16:05 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll

2008-06-13 16:05 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll

2008-06-13 16:05 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll

2008-06-13 16:05 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll

2008-06-13 16:04 . 2008-01-19 07:53 19,456 --a------ C:\Windows\System32\drivers\bthenum.sys

2008-06-10 03:02 . 2008-06-10 03:02 <DIR> d-------- C:\Program Files\MSXML 4.0

2008-06-09 16:02 . 2008-06-15 01:36 <DIR> d-------- C:\perflogs

2008-06-09 15:41 . 2008-06-09 15:41 510,464 --a------ C:\Windows\System32\PDM.exe

2008-06-09 15:41 . 2005-11-13 00:08 180,224 --a------ C:\Windows\System32\RapidshareHacking.exe

2008-06-09 15:41 . 2008-04-22 13:14 8,192 --a------ C:\Windows\System32\PDM.006

2008-06-09 15:41 . 2008-06-09 05:15 2,712 --a------ C:\Windows\System32\PDM.001

2008-06-09 15:41 . 2008-06-08 17:41 358 --a------ C:\Windows\System32\akv.cfg

2008-06-09 15:41 . 2008-06-09 05:15 344 --a------ C:\Windows\System32\PDM.002

2008-06-09 15:41 . 2008-06-09 05:15 342 --a------ C:\Windows\System32\PDM.005

2008-06-09 15:41 . 2008-06-09 05:14 5 --a------ C:\Windows\System32\test

2008-06-08 20:00 . 2008-06-08 20:00 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\Nero

2008-06-08 19:56 . 2008-06-08 19:56 <DIR> d-------- C:\Users\All Users\Nero

2008-06-08 19:56 . 2008-06-08 19:56 <DIR> d-------- C:\ProgramData\Nero

2008-06-08 19:56 . 2008-06-08 19:56 <DIR> d-------- C:\Program Files\Nero

2008-06-08 19:56 . 2008-06-08 19:58 <DIR> d-------- C:\Program Files\Common Files\Nero

2008-06-07 13:36 . 2008-06-07 13:40 <DIR> d-------- C:\Program Files\FGP

2008-05-30 14:56 . 2008-05-30 14:56 <DIR> d-------- C:\Users\Thomas\AppData\Roaming\Template

2008-05-30 14:55 . 2008-05-30 14:56 92 --a------ C:\Users\Thomas\AppData\Roaming\wklnhst.dat

2008-05-28 14:25 . 2008-03-08 04:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll

2008-05-28 14:25 . 2008-03-08 06:21 1,695,744 --a------ C:\Windows\System32\gameux.dll

2008-05-27 10:50 . 2008-05-27 10:50 90,112 --a------ C:\Windows\System32\QuickTimeVR.qtx

2008-05-27 10:50 . 2008-05-27 10:50 57,344 --a------ C:\Windows\System32\QuickTime.qts

2008-05-26 19:00 . 2008-05-26 19:00 <DIR> d-------- C:\Program Files\Infogrames

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-25 21:30 --------- d-----w C:\Users\Thomas\AppData\Roaming\uTorrent

2008-06-25 21:24 27,430 ----a-w C:\Users\Thomas\AppData\Roaming\nvModes.dat

2008-06-24 16:24 --------- d-----w C:\Users\Thomas\AppData\Roaming\NuSphere

2008-06-23 09:36 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-06-23 09:36 --------- d-----w C:\Program Files\WinPcap

2008-06-22 17:13 --------- d-----w C:\Program Files\Image-Line

2008-06-20 22:15 --------- d---a-w C:\ProgramData\TEMP

2008-06-20 16:32 --------- d-----w C:\ProgramData\Apple Computer

2008-06-20 16:30 --------- d-----w C:\Program Files\QuickTime

2008-06-20 12:50 --------- d-----w C:\Program Files\VstPlugins

2008-06-20 06:37 96,520 ----a-w C:\Windows\system32\drivers\avgldx86.sys

2008-06-20 06:37 69,128 ----a-w C:\Windows\system32\drivers\avgwfpx.sys

2008-06-20 06:37 12,936 ----a-w C:\Windows\system32\drivers\avgrkx86.sys

2008-06-20 06:37 10,520 ----a-w C:\Windows\System32\avgrsstx.dll

2008-06-16 13:55 --------- d-----w C:\Program Files\Common Files\Adobe

2008-06-14 23:49 174 --sha-w C:\Program Files\desktop.ini

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Sidebar

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Mail

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Journal

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Defender

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Collaboration

2008-06-14 23:40 --------- d-----w C:\Program Files\Windows Calendar

2008-06-14 23:34 --------- d-----w C:\ProgramData\NVIDIA

2008-06-14 23:22 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-06-14 23:22 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-06-14 23:05 --------- d-----w C:\Program Files\Opera

2008-06-14 22:43 --------- d-----w C:\Program Files\MagicISO

2008-05-30 12:33 --------- d-----w C:\ProgramData\avg8

2008-05-28 18:11 --------- d-----w C:\ProgramData\Microsoft Help

2008-05-23 21:33 --------- d-----w C:\Users\Thomas\AppData\Roaming\FileZilla

2008-05-18 14:53 --------- d-----w C:\Users\Thomas\AppData\Roaming\Apple Computer

2008-05-18 14:50 --------- d-----w C:\Program Files\Apple Software Update

2008-05-12 12:53 --------- d-----w C:\Users\Thomas\AppData\Roaming\Download Manager

2008-05-10 01:33 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys

2008-05-09 12:40 --------- d-----w C:\Program Files\Google

2008-05-02 11:12 --------- d-----w C:\Users\Thomas\AppData\Roaming\Vso

2008-05-02 11:11 47,360 ----a-w C:\Windows\system32\drivers\pcouffin.sys

2008-05-02 11:11 47,360 ----a-w C:\Users\Thomas\AppData\Roaming\pcouffin.sys

2008-05-02 11:00 --------- d-----w C:\Users\Thomas\AppData\Roaming\CyberLink

2008-05-02 11:00 --------- d-----w C:\ProgramData\CyberLink

2008-05-02 10:59 --------- d-----w C:\Program Files\Common Files\CyberLink

2008-05-02 10:56 --------- d-----w C:\Program Files\CyberLink

2008-05-02 10:55 505,128 ----a-w C:\Windows\System32\msvcp71.dll

2008-05-02 10:55 353,576 ----a-w C:\Windows\System32\msvcr71.dll

2008-05-02 10:55 29,480 ----a-w C:\Windows\System32\msxml3a.dll

2008-05-02 09:04 --------- d-----w C:\Program Files\Microsoft Works

2008-05-02 09:03 --------- d-----w C:\Program Files\MSBuild

2008-05-02 09:00 --------- d-----w C:\Program Files\Microsoft.NET

2008-05-02 08:50 --------- d-----w C:\Program Files\Microsoft Visual Studio 8

2008-04-29 03:54 181,760 ----a-w C:\Windows\System32\fsquirt.exe

2008-04-29 01:42 29,184 ----a-w C:\Windows\system32\drivers\BTHUSB.SYS

2008-04-29 01:42 220,160 ----a-w C:\Windows\system32\drivers\bthport.sys

2008-04-28 15:18 --------- d-----w C:\Program Files\Apache Software Foundation

2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll

2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll

2008-04-02 16:01 2,560 ----a-w C:\Windows\_MSRSTRT.EXE

2008-03-26 20:02 21 ---ha-w C:\qpmd8379.bin

2008-03-26 20:01 36,864 ----a-w C:\Windows\System32\cfperfmon_8.dll

2008-03-05 08:18 76 --sh--r C:\Windows\CT4CET.bin

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]

@={F2F31467-B1AC-4df0-AE79-FD5FA085E22B}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]

@={A3E208F7-0E3A-4182-A7A6-B169D5D691AA}

[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]

2007-04-17 01:13 721408 --a------ C:\Program Files\Fingerprint Reader Suite\farchns.dll

[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]

2007-04-17 01:13 721408 --a------ C:\Program Files\Fingerprint Reader Suite\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-05 10:27 68856]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 08:03 17920]

"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-09-07 10:50 159744]

"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-28 07:51 36864]

"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-03-05 10:14 77824]

"PSQLLauncher"="C:\Program Files\Fingerprint Reader Suite\launcher.exe" [2007-04-17 00:50 49168]

"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 18:43 118784]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 15:00 174872]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-05 10:27 1838592]

"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 17:39 189736]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-20 08:37 1231128]

"RegistryMechanic"="" []

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]

"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]

"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]

"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2008-03-21 10:21 91432]

"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 17:29 2221352]

"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-12-03 06:28 405504]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 21:24 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 21:24 8497696]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 21:24 81920]

"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 21:24 86016]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 19:55:50 703280]

QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-09-07 18:27:08 1180952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

C:\Windows\system32\psqlpwd.dll 2007-04-17 01:04 86528 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{537AA1EE-1FF3-4289-B93B-5A151A559062}"= C:\Program Files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect

"{90F331AB-EF9D-49CE-9785-8F6A7E6E2E24}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program

"{6EC79BFD-88B5-40B2-98B9-3773C23911F5}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine

"{DE9D9F40-D88F-4B03-8C0D-DFA5740AAABA}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server

"{1AB9B7CC-62D2-41A7-BBB1-85509F0D31A1}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{3F310063-A459-4735-B62A-33736DDD0829}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{5A24759B-EF3F-4429-ADB4-EF34E15A1C68}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"{104DFCAD-1E9D-47CC-808D-BBB11393594F}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe

"{6259906D-159A-4C74-917A-4F5DB3B679A0}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe

"TCP Query User{28EE6A68-597A-4F3D-933A-261B391AA73B}C:\\users\\thomas\\desktop\\counter-strike v1.6\\counter-strike v1.6\\hl.exe"= UDP:C:\users\thomas\desktop\counter-strike v1.6\counter-strike v1.6\hl.exe:hl.exe

"UDP Query User{5EA63969-16D7-4DF8-8B03-8CB66C30CD49}C:\\users\\thomas\\desktop\\counter-strike v1.6\\counter-strike v1.6\\hl.exe"= TCP:C:\users\thomas\desktop\counter-strike v1.6\counter-strike v1.6\hl.exe:hl.exe

"{7A3D9836-01AE-43D0-BE66-075986423D72}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{10ECA484-A00A-4429-A215-249F5C140862}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{470E2D45-F3D0-48D9-AB3B-252CB8CE0FA0}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{EFA619F7-E892-4031-AC35-BBC4B8A4AD18}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{117AA113-E6D9-4FE2-AF7E-25F8C92584A5}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{9B1A1582-DE67-4375-898A-19EACA28EBD3}"= C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.EXE:CyberLink PowerDVD 8.0

"{34C5F569-F033-4DA7-BADB-7189BD5195FC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{F9E4C988-F42C-4714-8F3A-58F31F0F91B6}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{EC7598A4-4980-4008-AA50-5BE66C3CB55F}"= UDP:C:\Program Files\nusphere\phped\Srv.exe:NuSphere PhpED SRV web server

"{2D0238C2-FC4A-463B-84AE-536D3CC92A65}"= TCP:C:\Program Files\nusphere\phped\Srv.exe:NuSphere PhpED SRV web server

"{743BA8C9-5CEC-490C-8D0C-48A704308F56}"= UDP:C:\Program Files\nusphere\phped\debugger\DbgListener.exe:NuSphere PhpED Dbg Listener

"{EBF13851-56E5-465F-8C6E-639F1FB6B837}"= TCP:C:\Program Files\nusphere\phped\debugger\DbgListener.exe:NuSphere PhpED Dbg Listener

"{C55A4729-5003-4A87-A1DB-604D6CC2BD31}"= UDP:C:\Program Files\nusphere\phped\phped.exe:NuSphere PhpED Embedded browser

"{91FD1E0A-CDBF-4C45-8B2E-5449C7161F95}"= TCP:C:\Program Files\nusphere\phped\phped.exe:NuSphere PhpED Embedded browser

R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-06-20 08:37]

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-06-20 08:37]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files\CyberLink\PowerDVD8\000.fcl [2008-02-01 17:24]

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-12-03 06:27]

R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-20 08:37]

R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-20 08:37]

R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-08-28 07:51]

R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-28 07:51]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

S2 Apache2.2;Apache2.2;"C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice []

S3 btwaudio;Bluetooth-lydenhet;C:\Windows\system32\drivers\btwaudio.sys [2006-11-07 03:37]

S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2006-11-07 01:13]

S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-07 01:13]

S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

S3 wampapache;wampapache;"c:\WAMP\bin\apache\apache2.2.8\bin\httpd.exe" -k runservice []

S3 wampmysqld;wampmysqld;c:\WAMP\bin\mysql\mysql5.0.51a\bin\mysqld-nt.exe wampmysqld []

S4 iaNvStor;Intel® Turbo Memory Controller;C:\Windows\system32\drivers\ianvstor.sys [2007-09-07 11:27]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

.

Contents of the 'Scheduled Tasks' folder

"2008-03-14 19:13:06 C:\Windows\Tasks\Se etter oppdateringer for Windows Live Toolbar.job"

- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-26 12:54:41

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Windows\System32\audiodg.exe

C:\Program Files\Fingerprint Reader Suite\upeksvr.exe

C:\Windows\System32\wlanext.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Windows\System32\IoctlSvc.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Windows\System32\stacsv.exe

C:\PROGRA~1\AVG\AVG8\avgam.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Windows\System32\conime.exe

C:\Program Files\Fingerprint Reader Suite\psqltray.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\DellTPad\hidfind.exe

C:\Program Files\DellTPad\ApntEx.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\System32\wbem\WMIADAP.exe

C:\Windows\servicing\TrustedInstaller.exe

.

**************************************************************************

.

Completion time: 2008-06-26 13:01:32 - machine was rebooted

ComboFix-quarantined-files.txt 2008-06-26 11:01:09

Pre-Run: 159,756,382,208 byte ledig

Post-Run: 159,650,988,032 byte ledig

324 --- E O F --- 2008-06-26 10:08:00

Endret 26. juni 2008 av php_user

snippsat · 26. juni 2008

Kopiere fet tekst under bildet->åpne notisblokk og lim inn.

Lagre på skrivebordet som CFScript.txt

Gjør som på bildet combofix vil starte,Post logg c:\combofix.txt

File::

C:\Windows\System32\ks94.dll

C:\Windows\System32\ksisys.dll

C:\Windows\System32\PDM.exe

C:\Windows\System32\dopadio.dll

---

Start HijackThis "scan" finn disse linjene merk dem,så trykk fix checked.

O2 - BHO: ProAct - {2FF811E6-8925-4084-A649-C159955E67E8} - C:\Windows\system32\ks94.dll

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - (no file)

---

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser"svar ja til og reparere"(kjør en par ganger til alle feil er borte)

---

Last ned oppdatere og kjør full scan SAS free

Post loggen fra SAS (preferences->statistics/logs)

---

Restart

---

Lag en ny hijackthis logg.

Ardamax Keylogger er dette noe du har innstalert?

http://www.ardamax.com/keylogger/

Endret 26. juni 2008 av SNIPPSAT

Thomas. · 26. juni 2008

les post nr 11..

Endret 26. juni 2008 av php_user

r2d290 · 26. juni 2008

Hvis du fulgte veilidningen til snippsat, skal du ha postet en logg fra SUPERAntiSpyware. Jeg tipper at dette programmet fjernet de filene du ikke fant i HijackThis. Post logg fra SAS

Post ny HijackThis-logg, så ser vi fort hva som fortsatt er der

Du svarte heller ikke på spørsmålet om du selv installerte adamax keylogger

Ardamax Keylogger er dette noe du har innstalert?
http://www.ardamax.com/keylogger/

Endret 26. juni 2008 av r2d290

Thomas. · 26. juni 2008

Hvis du fulgte veilidningen til snippsat, skal du ha postet en logg fra SUPERAntiSpyware. Jeg tipper at dette programmet fjernet de filene du ikke fant i HijackThis. Post logg fra SAS

Post ny HijackThis-logg, så ser vi fort hva som fortsatt er der

Du svarte heller ikke på spørsmålet om du selv installerte adamax keylogger

Har ikke kommet så langt

Driver å scanner med SAS nå.

Ardamax Keylogger er dette noe du har innstalert?
http://www.ardamax.com/keylogger/

Det har jeg ikke instalert nei..

Endret 26. juni 2008 av php_user

Thomas. · 26. juni 2008

Kopiere fet tekst under bildet->åpne notisblokk og lim inn.
Lagre på skrivebordet som CFScript.txt

Gjør som på bildet combofix vil starte,Post logg c:\combofix.txt

File::

C:\Windows\System32\ks94.dll

C:\Windows\System32\ksisys.dll

C:\Windows\System32\PDM.exe

C:\Windows\System32\dopadio.dll

---

Start HijackThis "scan" finn disse linjene merk dem,så trykk fix checked.

O2 - BHO: ProAct - {2FF811E6-8925-4084-A649-C159955E67E8} - C:\Windows\system32\ks94.dll

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - (no file)

---

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser"svar ja til og reparere"(kjør en par ganger til alle feil er borte)

---

Last ned oppdatere og kjør full scan SAS free

Post loggen fra SAS (preferences->statistics/logs)

---

Restart

---

Lag en ny hijackthis logg.

Ardamax Keylogger er dette noe du har innstalert?

http://www.ardamax.com/keylogger/

hijackthis logg:

ComboFix 08-06-20.4 - Thomas 2008-06-26 15:52:55.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.2045 [GMT 2:00]

Running from: C:\Users\Thomas\Desktop\ComboFix.exe

Command switches used :: C:\Users\Thomas\Desktop\CFScript.txt

* Created a new restore point

FILE ::

C:\Windows\System32\dopadio.dll

C:\Windows\System32\ks94.dll

C:\Windows\System32\ksisys.dll

C:\Windows\System32\PDM.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Windows\System32\dopadio.dll

C:\Windows\System32\ks94.dll

C:\Windows\System32\ksisys.dll

C:\Windows\System32\PDM.exe

.

((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))

.

2008-06-26 13:30 . 2008-02-28 14:26 1,414,440 --a------ C:\Windows\System32\ShellManager310E2D762.dll

2008-06-26 13:30 . 2008-02-28 14:01 774,144 --a------ C:\Windows\System32\NEROINSTAEC43759.DB

2008-06-26 13:29 . 2008-06-26 13:29 0 --a------ C:\Windows\Irremote.ini