[Løst] sjekking av logger

[C 22]

Hei

 

Maskinen min har vært avsindig treig ved oppstart i dag. Mulig det bare er tilfeldigheter, men kan noen sjekke loggene for sikkerhets skyld?

 

Setter stor pris på all hjelp

 

Hijackthis:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:23:35, on 28.07.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Windows\Samsung\PanelMgr\SSMMgr.exe

C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\COMODO\Firewall\cfp.exe

E:\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\soffice.exe

C:\test\test.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dundee.ac.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h

O4 - HKLM\..\Run: [GrooveMonitor] "E:\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\ (User 'Inernettbruker 3')

O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'Inernettbruker 3')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - (no file)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

 

--

End of file - 10832 bytes

 

 

 

 

Combofix:

 

 

 

ComboFix 08-07-27.5 - Christian 28.07.2008 15:08:24.14 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.852 [GMT 1:00]

Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe

* Created a new restore point

* Resident AV is active

 

.

 

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 )))))))))))))))))))))))))))))))

.

 

2008-07-28 12:49 . 2008-07-28 12:49 685,056 --a------ C:\Windows\isRS-000.tmp

2008-07-19 12:32 . 2008-07-23 20:09 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys

2008-07-19 12:26 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll

2008-07-19 12:26 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll

2008-07-19 12:26 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll

2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Inernettbruker 3\AppData\Roaming\Malwarebytes

2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Christian\AppData\Roaming\Malwarebytes

2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\Users\All Users\Malwarebytes

2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\ProgramData\Malwarebytes

2008-07-18 16:17 . 2008-07-28 12:53 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-07-18 16:17 . 2008-07-23 20:09 17,144 --a------ C:\Windows\System32\drivers\mbam.sys

2008-07-18 09:21 . 2008-07-28 15:08 <DIR> d-------- C:\QUARANTINE

2008-07-15 21:32 . 2008-07-15 21:32 <DIR> d-------- C:\Users\Sikker internettbruk\McAfee

2008-07-11 13:02 . 2008-07-14 20:04 <DIR> d-------- C:\test

2008-07-09 08:23 . 2008-04-26 09:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe

2008-07-09 08:23 . 2008-04-26 09:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe

2008-07-09 08:23 . 2008-04-12 04:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll

2008-06-28 12:51 . 2008-06-28 12:52 <DIR> d-------- C:\Program Files\Windows Live

2008-06-28 12:51 . 2008-06-28 12:52 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller

2008-06-28 12:50 . 2008-06-28 12:50 <DIR> d-------- C:\Users\All Users\WLInstaller

2008-06-28 12:50 . 2008-06-28 12:50 <DIR> d-------- C:\ProgramData\WLInstaller

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-19 21:37 --------- d-----w C:\ProgramData\Microsoft Help

2008-07-19 21:34 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype

2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail

2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM

2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios

2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy

2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss

2008-06-08 14:02 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-06-06 21:50 --------- d-----w C:\Program Files\SUPERAntiSpyware

2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Sidebar

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Journal

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Defender

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Collaboration

2008-06-03 19:19 --------- d-----w C:\Program Files\Windows Calendar

2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-06-03 14:59 --------- d-----w C:\Program Files\Winamp

2008-06-03 14:58 --------- d-----w C:\ProgramData\Apple Computer

2008-06-03 14:54 --------- d-----w C:\ProgramData\Symantec

2008-06-03 14:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-06-03 14:53 --------- d-----w C:\Program Files\Creative

2008-06-03 14:51 --------- d-----w C:\Program Files\Cyanide

2008-05-30 17:38 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Winamp

2008-05-29 15:11 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-29 15:11 --------- d-----w C:\Program Files\2K Games

2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll

2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll

2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll

2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll

2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll

2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll

2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe

2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe

2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat

2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat

2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat

2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys

2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys

2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-21 10:48 433840]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]

"SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [2007-09-26 23:23 40960]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-06 22:50 1506544]

"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 12:50 815104]

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-04-27 14:08 138008]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-04-27 14:08 154392]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-04-27 14:08 133912]

"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 13:37 174872]

"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 16:49 33048]

"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 00:52 849280]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:35 176128]

"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 08:50 112216]

"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768]

"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-03 04:47 520192]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-10 11:34 185896]

"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 12:37 1575680]

"GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"RtHDVCpl"="RtHDVCpl.exe" [2007-05-18 16:11 4472832 C:\Windows\RtHDVCpl.exe]

"Skytel"="Skytel.exe" [2007-05-25 15:56 1826816 C:\Windows\SkyTel.exe]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-23 10:39 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"= C:\Windows\system32\guard32.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

"InternetSettingsDisableNotify"=dword:00000001

"AutoUpdateDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service

"TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program

"{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete

"{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords

"{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

"{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword

"{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"DoNotAllowExceptions"= 0 (0x0)

 

R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 00:11]

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-27 21:24]

R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-27 21:24]

R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 18:50]

R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 15:13]

.

.

------- Supplementary Scan -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.dundee.ac.uk/

 

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-28 15:11:27

Windows 6.0.6001 Service Pack 1 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-07-28 15:12:36

ComboFix-quarantined-files.txt 2008-07-28 14:12:28

ComboFix2.txt 2008-07-19 15:31:29

 

Pre-Run: 28,367,241,216 byte ledig

Post-Run: 28,227,960,832 byte ledig

 

185 --- E O F --- 2008-07-28 11:51:35

 

 

 

 

MBAM:

 

 

 

Malwarebytes' Anti-Malware 1.23

Database version: 985

Windows 6.0.6001 Service Pack 1

 

15:05:48 28.07.2008

mbam-log-7-28-2008 (15-05-48).txt

 

Scan type: Full Scan (C:\|E:\|F:\|)

Objects scanned: 178238

Time elapsed: 2 hour(s), 3 minute(s), 10 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

(No malicious items detected)

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

(No malicious items detected)

 

 

Endret 3. august 2008 av C 22

[norbat]

Noe sein respons på tråden, men bedre seint enn aldri

 

Hvordan går det med tregheten - fortsatt problemer?

[C 22]

Noe sein respons på tråden, men bedre seint enn aldri

 

Hvordan går det med tregheten - fortsatt problemer?

 

Ser ut som alt går som normalt nå

var bare den ene dagen maskinen gikk helt hinsides tregt.

Ville ha en sjekk siden jeg vet at det går mye virus på universitetsnettverket her for tiden, men utenom tregheten den dagen har jeg ikke merket noe mer.

Men loggene er rene?

[norbat]

Ja, loggene viser ingen malwarefiler

 

surf trygt.

[C 22]

Ja, loggene viser ingen malwarefiler

 

surf trygt.

 

Tusen takk for hjelpen