kan noen sjekke logger

C 22 · 28. juni 2008

Pga treigt internett i det siste tenkte jeg at det var på tide å sjekke Hijackthis og Combofix logger på nytt, bare for å forsikre meg at det ikke er noe galt. Kan noen sjekke at det ikke er noe galt med disse loggene?

Ble ekstra mistenksom når et bilde av en tekopp dukket opp da jeg avinstallerte spybot search and destroy (antar at dette er teatimer funksjonen, men tenkte at en sjekk kunne være greit likevel)

Hikackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:10:23, on 28.06.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Windows\Samsung\PanelMgr\SSMMgr.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\COMODO\Firewall\cfp.exe

E:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\soffice.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\Trend Micro\test\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dundee.ac.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: (no name) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - (no file)

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h

O4 - HKLM\..\Run: [GrooveMonitor] "E:\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\ (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'Inernettbruker 3')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 11765 bytes

Combofix:

ComboFix 08-06-20.4 - Christian 28.06.2008 10:58:25.5 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.945 [GMT 1:00]

Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))

.

2008-06-14 17:12 . 23.04.2008 05:42 428,544 --a------ C:\Windows\System32\EncDec.dll

2008-06-14 17:12 . 23.04.2008 05:42 293,376 --a------ C:\Windows\System32\psisdecd.dll

2008-06-14 17:12 . 23.04.2008 05:41 218,624 --a------ C:\Windows\System32\psisrndr.ax

2008-06-14 17:11 . 23.04.2008 05:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax

2008-06-11 19:51 . 25.04.2008 03:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb

2008-06-11 19:51 . 26.04.2008 09:08 1,314,816 --a------ C:\Windows\System32\quartz.dll

2008-06-11 19:51 . 25.04.2008 05:35 826,880 --a------ C:\Windows\System32\wininet.dll

2008-06-11 19:51 . 10.05.2008 02:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys

2008-06-08 15:02 . 08.06.2008 15:02 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-06-03 20:14 . 03.06.2008 20:14 <DIR> d-------- C:\PerfLogs

2008-06-03 19:18 . 19.01.2008 08:43 3,600,440 --a------ C:\Windows\System32\ntkrnlpa.exe

2008-06-03 19:18 . 19.01.2008 08:43 3,548,728 --a------ C:\Windows\System32\ntoskrnl.exe

2008-06-03 19:18 . 19.01.2008 08:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe

2008-06-03 19:18 . 19.01.2008 08:36 1,541,120 --a------ C:\Windows\System32\onex.dll

2008-06-03 19:18 . 19.01.2008 08:29 705,536 --a------ C:\Windows\System32\imagesp1.dll

2008-06-03 19:18 . 19.01.2008 05:10 681,984 --a------ C:\Windows\System32\drivers\spsys.sys

2008-06-03 19:18 . 19.01.2008 08:42 51,768 --a------ C:\Windows\System32\PSHED.DLL

2008-06-03 19:16 . 19.01.2008 04:12 3,662,296 --a------ C:\Windows\System32\locale.nls

2008-06-03 19:15 . 19.01.2008 08:35 4,875,776 --a------ C:\Windows\System32\NlsData0009.dll

2008-06-03 19:14 . 19.01.2008 08:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll

2008-06-03 19:13 . 19.01.2008 08:35 3,072,000 --a------ C:\Windows\System32\networkmap.dll

2008-06-03 19:12 . 19.01.2008 08:36 2,588,160 --a------ C:\Windows\System32\UIHub.dll

2008-06-03 19:11 . 19.01.2008 08:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll

2008-06-03 19:10 . 19.01.2008 06:36 76,288 --a------ C:\Windows\System32\drivers\dxg.sys

2008-06-03 19:09 . 19.01.2008 07:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL

2008-06-03 19:08 . 19.01.2008 08:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe

2008-06-03 19:06 . 19.01.2008 08:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll

2008-06-03 19:06 . 19.01.2008 08:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll

2008-06-03 19:06 . 19.01.2008 08:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll

2008-06-03 19:05 . 19.01.2008 08:36 218,624 --a------ C:\Windows\System32\wdscore.dll

2008-06-03 19:05 . 19.01.2008 08:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe

2008-06-03 19:03 . 19.01.2008 08:34 305,152 --a------ C:\Windows\System32\msdelta.dll

2008-06-03 19:03 . 19.01.2008 08:34 258,560 --a------ C:\Windows\System32\dpx.dll

2008-06-03 19:03 . 19.01.2008 08:34 246,784 --a------ C:\Windows\System32\drvstore.dll

2008-06-03 19:03 . 19.01.2008 08:35 35,328 --a------ C:\Windows\System32\mspatcha.dll

2008-06-03 17:23 . 28.06.2008 10:57 <DIR> d-------- C:\327882R2FWJFW

2008-05-31 12:59 . 26.06.2008 21:21 <DIR> d-------- C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss

2008-05-29 16:11 . 29.05.2008 16:11 <DIR> d-------- C:\Program Files\2K Games

2008-05-29 16:09 . 26.05.2005 15:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll

2008-05-28 10:09 . 08.03.2008 03:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll

2008-05-28 10:09 . 08.03.2008 05:21 1,695,744 --a------ C:\Windows\System32\gameux.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-27 17:50 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype

2008-06-27 15:09 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM

2008-06-12 07:59 --------- d-----w C:\Program Files\Windows Mail

2008-06-06 21:50 --------- d-----w C:\Program Files\SUPERAntiSpyware

2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Sidebar

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Journal

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Defender

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Collaboration

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Calendar

2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-06-03 16:41 --------- d-----w C:\ProgramData\Microsoft Help

2008-06-03 14:59 --------- d-----w C:\Program Files\Winamp

2008-06-03 14:58 --------- d-----w C:\ProgramData\Apple Computer

2008-06-03 14:54 --------- d-----w C:\ProgramData\Symantec

2008-06-03 14:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-06-03 14:53 --------- d-----w C:\Program Files\Creative

2008-06-03 14:51 --------- d-----w C:\Program Files\Cyanide

2008-05-30 17:38 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Winamp

2008-05-29 15:11 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-27 20:24 85,008 ----a-w C:\Windows\system32\drivers\cmdguard.sys

2008-05-27 20:24 25,104 ----a-w C:\Windows\system32\drivers\cmdhlp.sys

2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll

2008-05-27 12:06 --------- d-----w C:\Program Files\Activision

2008-05-12 16:41 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com

2008-05-12 16:40 --------- d-----w C:\Users\Christian\AppData\Roaming\SUPERAntiSpyware.com

2008-05-12 16:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-05-05 19:20 --------- d-----w C:\Program Files\Common Files\Adobe

2008-04-09 10:49 108,144 ----a-w C:\Windows\System32\CmdLineExt.dll

2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat

2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat

2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat

2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys

2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys

2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [19.01.2008 08:33 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [19.01.2008 08:36 2153472 C:\Windows\System32\oobefldr.dll]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [21.05.2007 10:48 433840]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [19.01.2007 11:54 5674352]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [19.01.2008 08:33 125952]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [31.05.2005 00:04 1415824]

"SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [26.09.2007 23:23 40960]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [12.11.2007 16:48 21760296]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [19.01.2008 08:33 202240]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [06.06.2008 22:50 1506544]

"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [18.05.2007 16:11 4472832 C:\Windows\RtHDVCpl.exe]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [27.10.2006 12:50 815104]

"NDSTray.exe"="NDSTray.exe" []

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [02.04.2007 12:48 577536]

"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [29.03.2007 10:39 411192]

"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [07.12.2006 16:49 55416]

"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [23.05.2007 15:57 509496]

"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [26.04.2007 18:56 538744]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [27.04.2007 14:08 138008]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [27.04.2007 14:08 154392]

"Persistence"="C:\Windows\system32\igfxpers.exe" [27.04.2007 14:08 133912]

"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [10.04.2007 16:40 413696]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [04.05.2007 12:05 571024]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [12.02.2007 13:37 174872]

"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [13.03.2007 16:49 33048]

"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [06.02.2007 00:52 849280]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11.06.2007 10:25 6731312]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [02.11.2006 13:35 176128]

"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [30.11.2006 08:50 112216]

"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [17.11.2006 13:39 136768]

"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [03.01.2007 04:47 520192]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [29.06.2007 06:24 286720]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10.02.2008 11:34 185896]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [15.01.2008 23:54 37376]

"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [23.05.2008 12:37 1575680]

"GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [24.08.2007 07:00 33648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11.01.2008 22:16 39792]

"Skytel"="Skytel.exe" [25.05.2007 15:56 1826816 C:\Windows\SkyTel.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [23.05.2008 10:39 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19.04.2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{1701CFDE-AB38-4D64-A409-4D8F7665700A}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

"{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"DoNotAllowExceptions"= 0 (0x0)

R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [11.03.2007 00:11]

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [27.05.2008 21:24]

R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [27.05.2008 21:24]

R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [08.12.2006 18:50]

R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [23.04.2007 20:13]

R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [09.04.2007 15:13]

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-28 11:01:32

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 28.06.2008 11:02:36

ComboFix-quarantined-files.txt 2008-06-28 10:02:28

ComboFix2.txt 2008-06-03 15:36:31

ComboFix3.txt 2008-05-04 21:02:44

ComboFix4.txt 2008-04-23 17:54:48

ComboFix5.txt 2008-03-03 16:13:09

Pre-Run: 27,359,789,056 byte ledig

Post-Run: 27,114,217,472 byte ledig

206 --- E O F --- 2008-06-27 06:24:22

På forhånd tusen takk for all hjelp

norbat · 28. juni 2008

Loggene dine ser fine ut :thumbup:

Du kan fjerne følgende linje med hjt:

O2 - BHO: (no name) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - (no file)

Det kan være en ide å slette temp-filer etc. Du kan bruke CCleaner:

Last ned CCleaner.

Start programmet. Gå til 'Valg'->'Avansert'. Fjern avkryssingen framfor: "Bare slett midlertidige filer som er eldre enn 48 timer" Klikk på 'Renser' og deretter 'Kjør CCleaner'.

Du kan også kjøre 'Register' (-rens). Du vil bli spurt om å ta backup før du sletter det ccleaner finner. Det sier du ja til. Kjør register-rensen flere ganger til den ikke finner flere feil.

Restart pc etterpå.

Du bør avinstallere combofix da dette prog. og heller laste ned ny når du får behov for det. Du fjerner det ved å skrive combofix /u i kjør-feltet (start->kjør)

Thomas. · 28. juni 2008

* borte *

Endret 28. juni 2008 av php_user

C 22 · 1. juli 2008

Tusen takk for hjelpen!

Litt flaut å spørre om dette allerede, men kan noen sjekke logger på nytt?

Åpnet en email om at en e-post jeg sendte før helgen ikke var kommet frem, og ble litt mistenksom siden den kom fra en annen adresse enn den jeg sendte den oprinnelige e-posten til ...

Sikkert bare et annet frima som driver mailtjenesten, men tenkte jeg kunne få det sjekket for sikkerhets skyld

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:46:11, on 01.07.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Windows\Samsung\PanelMgr\SSMMgr.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\COMODO\Firewall\cfp.exe

E:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\soffice.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Windows\system32\conime.exe

C:\Windows\Explorer.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\test\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dundee.ac.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll