Sjekking av logger - treig internett-tilkobling

C 22 · 9. juli 2008

Fikk en melding fra firewallen tidligere i dag om at rundll32.exe prøvde å "create process, execute image" av en mp3 fil...

er dette normalt? prøver å venne meg til firewall, og da er det lett for å bli litt mistenksom når en får varsel om noe en ikke hadde forventet

Kan noen sjekke loggene?

Combofix:

ComboFix 08-07-08.5 - Christian 09.07.2008 10:48:33.7 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.779 [GMT 1:00]

Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe

* Created a new restore point

* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2008-06-09 to 2008-07-09 )))))))))))))))))))))))))))))))

.

No new files created in this timespan

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-08 18:06 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype

2008-07-08 16:45 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM

2008-07-08 15:14 --------- d-----w C:\ProgramData\Apple

2008-07-08 15:14 --------- d-----w C:\Program Files\Common Files\Apple

2008-06-28 11:52 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller

2008-06-28 11:52 --------- d-----w C:\Program Files\Windows Live

2008-06-28 11:50 --------- d-----w C:\ProgramData\WLInstaller

2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy

2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss

2008-06-12 07:59 --------- d-----w C:\Program Files\Windows Mail

2008-06-08 14:02 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-06-06 21:50 --------- d-----w C:\Program Files\SUPERAntiSpyware

2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Sidebar

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Journal

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Defender

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Collaboration

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Calendar

2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-06-03 16:41 --------- d-----w C:\ProgramData\Microsoft Help

2008-06-03 14:59 --------- d-----w C:\Program Files\Winamp

2008-06-03 14:58 --------- d-----w C:\ProgramData\Apple Computer

2008-06-03 14:54 --------- d-----w C:\ProgramData\Symantec

2008-06-03 14:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-06-03 14:53 --------- d-----w C:\Program Files\Creative

2008-06-03 14:51 --------- d-----w C:\Program Files\Cyanide

2008-05-30 17:38 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Winamp

2008-05-29 15:11 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-29 15:11 --------- d-----w C:\Program Files\2K Games

2008-05-27 20:24 85,008 ----a-w C:\Windows\system32\drivers\cmdguard.sys

2008-05-27 20:24 25,104 ----a-w C:\Windows\system32\drivers\cmdhlp.sys

2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll

2008-05-27 12:06 --------- d-----w C:\Program Files\Activision

2008-05-12 16:41 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com

2008-05-12 16:40 --------- d-----w C:\Users\Christian\AppData\Roaming\SUPERAntiSpyware.com

2008-05-12 16:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-05-10 01:33 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys

2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll

2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll

2008-04-23 04:42 428,544 ----a-w C:\Windows\System32\EncDec.dll

2008-04-23 04:42 293,376 ----a-w C:\Windows\System32\psisdecd.dll

2008-04-09 10:49 108,144 ----a-w C:\Windows\System32\CmdLineExt.dll

2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat

2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat

2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat

2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys

2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys

2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [19.01.2008 08:33 1233920]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [21.05.2007 10:48 433840]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [19.01.2008 08:33 125952]

"SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [26.09.2007 23:23 40960]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [12.11.2007 16:48 21760296]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [19.01.2008 08:33 202240]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [06.06.2008 22:50 1506544]

"WindowsWelcomeCenter"="oobefldr.dll" [19.01.2008 08:36 2153472 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [27.10.2006 12:50 815104]

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [02.04.2007 12:48 577536]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [27.04.2007 14:08 138008]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [27.04.2007 14:08 154392]

"Persistence"="C:\Windows\system32\igfxpers.exe" [27.04.2007 14:08 133912]

"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [10.04.2007 16:40 413696]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [04.05.2007 12:05 571024]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [12.02.2007 13:37 174872]

"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [13.03.2007 16:49 33048]

"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [06.02.2007 00:52 849280]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11.06.2007 10:25 6731312]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [02.11.2006 13:35 176128]

"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [30.11.2006 08:50 112216]

"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [17.11.2006 13:39 136768]

"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [03.01.2007 04:47 520192]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [29.06.2007 06:24 286720]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10.02.2008 11:34 185896]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [15.01.2008 23:54 37376]

"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [23.05.2008 12:37 1575680]

"GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [24.08.2007 07:00 33648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11.01.2008 22:16 39792]

"RtHDVCpl"="RtHDVCpl.exe" [18.05.2007 16:11 4472832 C:\Windows\RtHDVCpl.exe]

"Skytel"="Skytel.exe" [25.05.2007 15:56 1826816 C:\Windows\SkyTel.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [23.05.2008 10:39 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

19.04.2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

"{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

"{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"DoNotAllowExceptions"= 0 (0x0)

R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [11.03.2007 00:11]

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [27.05.2008 21:24]

R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [27.05.2008 21:24]

R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [08.12.2006 18:50]

R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [09.04.2007 15:13]

*Newly Created Service* - CATCHME

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe

HKCU-Run-CTSyncU.exe - C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

HKLM-Run-NDSTray.exe - NDSTray.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-09 10:51:34

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 09.07.2008 10:52:45

ComboFix-quarantined-files.txt 2008-07-09 09:52:37

ComboFix2.txt 2008-07-01 14:38:54

Finner ikke meldingstekst for melding nummer 0x2379 i meldingsfilen for Application.

Post-Run: 27,724,910,592 byte ledig

174 --- E O F --- 2008-07-07 06:43:20

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:54:31, on 09.07.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Windows\Samsung\PanelMgr\SSMMgr.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\COMODO\Firewall\cfp.exe

E:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\soffice.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

E:\Microsoft Office\Office12\WINWORD.EXE

C:\Windows\system32\conime.exe

C:\Windows\Explorer.exe

C:\Windows\system32\notepad.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\test\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dundee.ac.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - (no file)

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h

O4 - HKLM\..\Run: [GrooveMonitor] "E:\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\ (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'Inernettbruker 3')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 11619 bytes

Tusen takk for hjelp!

forresten - skal kjøpe meg ny pc rundt månedsskiftet, og lurer på å kjøpe et antivirusprogram også. Er det noen som da kan anbefales? eller kan en like gjerne bruke gratisprogrammer?

Edit: leste det som stod i sikkerhetsguiden, men det var så mange programmer som var listet opp der. er det noen av disse som er bedre enn andre?

Endret 11. juli 2008 av C 22

Bludd · 9. juli 2008

Loggene ser greie ut for min del.

rundll brukes jo til å starte dll-filer i en prosess og mp3-filer skal da vel ikke kunne startes slik.

Rar melding. Har du den eksakte meldingen?

Antivirus? Jeg liker Symantec Antivirus Corporate edition, men jeg tror jeg er et mindretall når det gjelder entusiastene her. AVG har jo fått pepper for å skape mye unødvendig web-trafikk i det siste, men de har vel gitt ut en patch på det.

Endret 9. juli 2008 av Bludd

C 22 · 9. juli 2008

Loggene ser greie ut for min del.

rundll brukes jo til å starte dll-filer i en prosess og mp3-filer skal da vel ikke kunne startes slik.

Rar melding. Har du den eksakte meldingen?

Antivirus? Jeg liker Symantec Antivirus Corporate edition, men jeg tror jeg er et mindretall når det gjelder entusiastene her. AVG har jo fått pepper for å skape mye unødvendig web-trafikk i det siste, men de har vel gitt ut en patch på det.

Har ikke den eksakte meldingen lenger.

men i Comodo sin liste over events står det

application:

c:\Windows\System32\rundll32.exe

Action:

Create process, execute file

og målet var en mp3 fil.

Fikk tilsvarende meldinger litt senere til en .vtd og en .dlg fil i spillet beyond divinity, og en .wmf fil i office mappen clipart...

Har brukt office, men har ikke prøvd å spille mp3en eller spillet i dag. derfor jeg synes det var en mistenksom melding...

Bludd · 9. juli 2008

Merker du at noe ikke fungerer når du sier nei?

C 22 · 9. juli 2008

Merker du at noe ikke fungerer når du sier nei?

Nei. har blokkert de, men alt fungerer som normalt

C 22 · 9. juli 2008

Merker du at noe ikke fungerer når du sier nei?

Nei. har blokkert de, men alt fungerer som normalt

På listen over active connections i Comodo finner jeg også filen wininit.exe. leste et sted at det er et virus, men hverken Mcafee eller SAS reagerer på den... finner den ikke på listen i Hijackthis eller Combofix heller...

når jeg ser på den i system32 mappen står det at den er laget av Microsoft...

er det bare i XP at det er et virus? (jeg kjører vista)

snippsat · 9. juli 2008

Loggene ser bra ut.

Anngående feilmelding der målet var en mp3 fil.

Har du denne i oppstart,husk at 3 part programvare også bruker "rundll32.exe" til og laste inn.

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

wininit.exe = ok.

Den har ansvar for og starte service control manager.

Hadde det virus "wininit.exe" ville combofix fanget det opp eller jeg ville ha sett det i loggen.

Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc.

Surf trygt.

Endret 9. juli 2008 av SNIPPSAT

C 22 · 9. juli 2008

Loggene ser bra ut.

Anngående feilmelding der målet var en mp3 fil.

Har du denne i oppstart,husk at 3 part programvare også bruker "rundll32.exe" til og laste inn.

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

wininit.exe = ok.

Den har ansvar for og starte service control manager.

Hadde det virus ville combofix fanget det opp eller jeg ville ha sett det i loggen.

Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc.

Surf trygt.

Tusen takk for all hjelp!

Helt fantastisk at noen som kan dette tar seg tid til å hjelpe!

r2d290 · 9. juli 2008

Dersom du mener at problemet med maskinen din er løst, kan du endre emnetittelen din, ved å trykke på i førsteposten din, og velge full endring. Øverst der emnetittelen din er, skriver du:

[LØST]

foran emnetittelen din.

Eks: [LØST] Har fått virus på maskinen

Dette vil være med på å holde forumet mer oversiktlig for supporterne, samt at nye folk som får samme problemet lettere vil finne en passende tråd å se i.

-Surf trygt-

C 22 · 11. juli 2008

Hei igjen

Maskinen min har gått litt sakte i det siste (blant annet derfor jeg postet loger tidligere i uken....)

mulig dette bare skyldes mye trafikk på universitetsnettverket, men er det noe annet enn å kjøre Ccleaner jeg kan gjøre for å rydde litt opp?

Legger ved nye loger for å sjekke at det ikke er noe spyware som er skyld i det:

Combofix:

ComboFix 08-07-10.1 - Christian 11.07.2008 14:13:58.11 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.914 [GMT 1:00]

Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))

.

2008-07-11 14:11 . 11.07.2008 14:12 <DIR> d-------- C:\327882R2FWJFW

2008-07-11 13:02 . 11.07.2008 13:06 <DIR> d-------- C:\test

2008-07-09 16:06 . 09.07.2008 16:06 <DIR> d-------- C:\Users\All Users\Apple

2008-07-09 16:06 . 09.07.2008 16:06 <DIR> d-------- C:\ProgramData\Apple

2008-07-09 16:06 . 09.07.2008 16:06 <DIR> d-------- C:\Program Files\Common Files\Apple

2008-07-09 08:23 . 26.04.2008 09:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe

2008-07-09 08:23 . 26.04.2008 09:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe

2008-07-09 08:23 . 12.04.2008 04:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll

2008-06-28 12:51 . 28.06.2008 12:52 <DIR> d-------- C:\Program Files\Windows Live

2008-06-28 12:51 . 28.06.2008 12:52 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller

2008-06-28 12:50 . 28.06.2008 12:50 <DIR> d-------- C:\Users\All Users\WLInstaller

2008-06-28 12:50 . 28.06.2008 12:50 <DIR> d-------- C:\ProgramData\WLInstaller

2008-06-14 17:12 . 23.04.2008 05:42 428,544 --a------ C:\Windows\System32\EncDec.dll

2008-06-14 17:12 . 23.04.2008 05:42 293,376 --a------ C:\Windows\System32\psisdecd.dll

2008-06-14 17:12 . 23.04.2008 05:41 218,624 --a------ C:\Windows\System32\psisrndr.ax

2008-06-14 17:11 . 23.04.2008 05:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax

2008-06-11 19:51 . 25.04.2008 03:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb

2008-06-11 19:51 . 26.04.2008 09:08 1,314,816 --a------ C:\Windows\System32\quartz.dll

2008-06-11 19:51 . 25.04.2008 05:35 826,880 --a------ C:\Windows\System32\wininet.dll

2008-06-11 19:51 . 10.05.2008 02:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-10 21:25 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype

2008-07-10 07:15 --------- d-----w C:\ProgramData\Microsoft Help

2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail

2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM

2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios