C 22 Skrevet 13. august 2008 Del Skrevet 13. august 2008 (endret) Hei Mbam fant tidligere i dag en infisert registry key - HKEY_LOCAL_MACHINE\SOFTWARE\SEC (Rogue.SecureExpertCleaner). Etter å ha restartet, og kjørt mbam på nytt som administrator virker det som jeg nå er kvitt den. Kan noen sjekke at det ikke er noe mer som er galt? Combofix: ComboFix 08-08-12.01 - Christian 13.08.2008 12:28:31.15 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.914 [GMT 1:00] Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 11:17 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype 2008-08-12 17:54 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-12 15:37 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware 2008-07-30 19:07 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys 2008-07-30 19:07 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys 2008-07-28 21:28 --------- d-----w C:\Users\Sikker internettbruk\AppData\Roaming\Malwarebytes 2008-07-19 21:37 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-18 15:18 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Malwarebytes 2008-07-18 15:18 --------- d-----w C:\Users\Christian\AppData\Roaming\Malwarebytes 2008-07-18 15:17 --------- d-----w C:\ProgramData\Malwarebytes 2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail 2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM 2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios 2008-06-28 11:52 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-28 11:52 --------- d-----w C:\Program Files\Windows Live 2008-06-28 11:50 --------- d-----w C:\ProgramData\WLInstaller 2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss 2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll 2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll 2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll 2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini 2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll 2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll 2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll 2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll 2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll 2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll 2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll 2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll 2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll 2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll 2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll 2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll 2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll 2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll 2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin 2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat 2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat 2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat 2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys 2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys 2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-21 10:48 433840] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [2007-09-26 23:23 40960] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-06 22:50 1506544] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 12:50 815104] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-04-27 14:08 138008] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-04-27 14:08 154392] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-04-27 14:08 133912] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 13:37 174872] "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 16:49 33048] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 00:52 849280] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:35 176128] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 08:50 112216] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768] "Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-03 04:47 520192] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-10 11:34 185896] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 12:37 1575680] "GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-18 16:11 4472832 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-25 15:56 1826816 C:\Windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-23 10:39 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\Windows\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 00:11] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-27 21:24] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-27 21:24] R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 18:50] R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 15:13] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\h11uardi.default\ ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 12:31:20 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-13 12:32:37 ComboFix-quarantined-files.txt 2008-08-13 11:32:29 ComboFix2.txt 2008-07-28 14:12:37 Pre-Run: Finner ikke meldingstekst for melding nummer 0x2379 i meldingsfilen for Application. Post-Run: 36,818,436,096 byte ledig 172 --- E O F --- 2008-08-13 11:11:25 MBAM: Malwarebytes' Anti-Malware 1.24 Database version: 1012 Windows 6.0.6001 Service Pack 1 10:37:39 13.08.2008 mbam-log-8-13-2008 (10-37-39).txt Scan type: Full Scan (C:\|E:\|F:\|) Objects scanned: 178605 Time elapsed: 2 hour(s), 4 minute(s), 32 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) HJt: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:42:32, on 13.08.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Windows\System32\wpcumi.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\COMODO\Firewall\cfp.exe E:\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe C:\Windows\ehome\ehtray.exe C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\soffice.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Windows\system32\conime.exe C:\Windows\Explorer.exe E:\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\test\test.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dundee.ac.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [GrooveMonitor] "E:\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [skytel] Skytel.exe O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\ O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE') O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Inernettbruker 3') O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sODCPreLoad] C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe C:\PROGRA~1\IBM\Lotus\Symphony\data\.sodc\ (User 'Inernettbruker 3') O4 - HKUS\S-1-5-21-1042471630-2520023515-1693159874-1003\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'Inernettbruker 3') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - (no file) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O13 - Gopher Prefix: O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 10852 bytes Har jeg blitt kvitt alt nå, eller er det mer som bør fjernes? På forhånd tusen takk for all hjelp Endret 14. august 2008 av C 22 Lenke til kommentar
Svenni212000 Skrevet 13. august 2008 Del Skrevet 13. august 2008 Kan ikke med første øyekast se noe virus eller spyware infiserte filer. Du kan dog kjøre kontroll med Avira AntiVir Rescue System Som sagt, så ser det ikke ut som det er mer infiserte filer å fjerne. Men det er noen programmer/tjenester som du kan deaktivere fra å starte sammen med Widnwos, samt noen programmer du kan bytte mot bedre versjoner. Lenke til kommentar
r2d290 Skrevet 13. august 2008 Del Skrevet 13. august 2008 Vent litt med å installere Avira. Du har enten installert, eller ikke fullstendig klart å avinstallere Norton AV. Det er viktig å ikke ha to Antivirusprogram. Fortell meg om du bruker norton eller ikke. Du har dessuten McAfee installert, så flere antivirusprogram frarådes på det sterkeste (da dette skaper konflikt). Fortell hvilket du vil fortsette å bruke: Norton, McAfee eller Avira (som er et av de beste gratis antivirusprogram du får). Loggene ser greie ut. Du bør oppdatere Java Det er viktig å bruke den seneste versjonen av Java, siden tidligere versjoner kan inneholde sikkerhetshull som vil øke sansynligheten for at du blir infisert igjen. Det ser ut til at din verjson av Java er utdatert Oppdatere Java: Trykk på følgende link, og last ned nyeste versjon av Java (Ikke beta):http://java.sun.com/javase/downloads/index.jsp [*]Gå til Start > Kontrollpanel > Legg til/fjern programmer. [*]Søk i listen over alle tidligere versjoner av Java (JRE, J2SE Runtime, J2RE osv.... ) Alle disse versjonene bør ha dette bildet foran: Velg alle du finner, og trykk på Fjern [*]Deretter installerer du den Java-versjonen som du lastet ned i starten. Fortell hvordan det gikk med oppdateringen, da problemer med oppdatering kan indikere flere malware på systemet ditt. Lenke til kommentar
C 22 Skrevet 13. august 2008 Forfatter Del Skrevet 13. august 2008 Vent litt med å installere Avira. Du har enten installert, eller ikke fullstendig klart å avinstallere Norton AV. Det er viktig å ikke ha to Antivirusprogram. Fortell meg om du bruker norton eller ikke. Du har dessuten McAfee installert, så flere antivirusprogram frarådes på det sterkeste (da dette skaper konflikt). Fortell hvilket du vil fortsette å bruke: Norton, McAfee eller Avira (som er et av de beste gratis antivirusprogram du får). bruker ikke norton. Var sikker på at jeg var blitt kvitt den nå, men den gang ei. Har ikke vært spesielt fornøyd med Mcafee så langt, så jeg tror jeg vil prøve Avira nå. Skal oppdatere Java. Hvordan får jeg fjernet siste rest av Norton? Lenke til kommentar
r2d290 Skrevet 13. august 2008 Del Skrevet 13. august 2008 Hvis du skal ha vekk brannmuren til norton også, gjør du som nedenfor. Hvis du ikke vil fjerne brannmuren, fjerner du de to nederste linjene i kodeboksen. Trykk Start - Alle Programmer - Tilbehør - Notisblokk Kopier og Lim inn teksten i kodeboksen nedenfor, inn i Notisblokken: File:: [Direkte adresse til en fil] Folder:: [Direkte adresse til en mappe] Register:: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=- Lagre det som CFScript Dra CFScript over ComboFix.exe som ligger på Skrivebordet, slik animasjonen nedenfor viser. Dette vil starte ComboFix igjen. Hvis maskinen ber om en omstart, lar du den gjøre det med én gang. Post innholdet til ComboFix.txt inn i ditt neste svar på forumet. Husk å avinstallere McAfee før du går i gang med å installere Avira. Post gjerne en combofix-logg for å være sikker på at alle rester av McAfee er fjernet også. Merker du ikke lenger noen problem med maskina di? Du bør oppdatere Java Det er viktig å bruke den seneste versjonen av Java, siden tidligere versjoner kan inneholde sikkerhetshull som vil øke sansynligheten for at du blir infisert igjen. Det ser ut til at din verjson av Java er utdatert Oppdatere Java: Trykk på følgende link, og last ned nyeste versjon av Java (Ikke beta):http://java.sun.com/javase/downloads/index.jsp [*]Gå til Start > Kontrollpanel > Legg til/fjern programmer. [*]Søk i listen over alle tidligere versjoner av Java (JRE, J2SE Runtime, J2RE osv.... ) Alle disse versjonene bør ha dette bildet foran: Velg alle du finner, og trykk på Fjern [*]Deretter installerer du den Java-versjonen som du lastet ned i starten. Fortell hvordan det gikk med oppdateringen, da problemer med oppdatering kan indikere flere malware på systemet ditt. Lenke til kommentar
C 22 Skrevet 13. august 2008 Forfatter Del Skrevet 13. august 2008 (endret) Merker du ikke lenger noen problem med maskina di? Du bør oppdatere Java Det er viktig å bruke den seneste versjonen av Java, siden tidligere versjoner kan inneholde sikkerhetshull som vil øke sansynligheten for at du blir infisert igjen. Det ser ut til at din verjson av Java er utdatert Oppdatere Java: Trykk på følgende link, og last ned nyeste versjon av Java (Ikke beta):http://java.sun.com/javase/downloads/index.jsp [*]Gå til Start > Kontrollpanel > Legg til/fjern programmer. [*]Søk i listen over alle tidligere versjoner av Java (JRE, J2SE Runtime, J2RE osv.... ) Alle disse versjonene bør ha dette bildet foran: Velg alle du finner, og trykk på Fjern [*]Deretter installerer du den Java-versjonen som du lastet ned i starten. Fortell hvordan det gikk med oppdateringen, da problemer med oppdatering kan indikere flere malware på systemet ditt. Java hadde riktig ikon, og det er nå fjernet. Edit: trenger jeg egentlig å ha java installert? kommer ikke lenger på hvorfor jeg har det, og tenker det da kan være like greit å bare installere en ny versjon når jeg finner ut hva jeg trenger det til... Har kjørt combofix på nytt, men har ikke byttet fra Mcafee til Avira helt enda. Her er den nye combofix logen: ComboFix 08-08-12.01 - Christian 13.08.2008 16:26:51.16 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.962 [GMT 1:00] Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe Command switches used :: C:\Users\Inernettbruker 3\Desktop\CFScript.txt * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))) . 2008-08-13 12:26 . 2008-08-13 16:26 <DIR> d-------- C:\327882R2FWJFW 2008-07-28 22:28 . 2008-07-28 22:28 <DIR> d-------- C:\Users\Sikker internettbruk\AppData\Roaming\Malwarebytes 2008-07-28 18:32 . 2008-05-27 05:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin 2008-07-28 18:32 . 2008-05-27 06:17 34,816 --a------ C:\Windows\System32\msscb.dll 2008-07-28 18:32 . 2008-05-27 05:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-07-28 18:32 . 2008-05-27 06:17 11,776 --a------ C:\Windows\System32\msshooks.dll 2008-07-19 12:32 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-07-19 12:26 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-07-19 12:26 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-07-19 12:26 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Inernettbruker 3\AppData\Roaming\Malwarebytes 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Christian\AppData\Roaming\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-07-18 16:17 . 2008-08-12 16:37 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-18 16:17 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys 2008-07-18 09:21 . 2008-08-13 16:26 <DIR> d-------- C:\QUARANTINE 2008-07-15 21:32 . 2008-07-15 21:32 <DIR> d-------- C:\Users\Sikker internettbruk\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 11:17 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype 2008-08-12 17:54 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-19 21:37 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail 2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM 2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios 2008-06-28 11:52 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-28 11:52 --------- d-----w C:\Program Files\Windows Live 2008-06-28 11:50 --------- d-----w C:\ProgramData\WLInstaller 2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss 2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini 2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll 2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll 2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll 2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll 2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll 2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll 2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll 2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll 2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll 2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll 2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll 2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll 2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat 2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat 2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat 2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys 2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys 2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-08-13_12.32.11.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-13 10:32:11 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2008-08-13 12:59:13 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-08-13 15:16:41 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-08-13 15:16:41 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-08-13 10:41:33 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 15:17:37 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 15:17:37 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-08-13 10:41:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-08-13 15:17:32 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-08-13 15:17:32 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-08-13 11:14:27 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat + 2008-08-13 12:59:21 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat - 2008-08-13 07:15:22 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin + 2008-08-13 15:18:46 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin - 2008-08-13 07:15:22 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-08-13 15:18:46 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-08-13 10:41:48 66,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-08-13 15:18:42 66,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-21 10:48 433840] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [2007-09-26 23:23 40960] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-06 22:50 1506544] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 12:50 815104] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-04-27 14:08 138008] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-04-27 14:08 154392] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-04-27 14:08 133912] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 13:37 174872] "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 16:49 33048] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 00:52 849280] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:35 176128] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 08:50 112216] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768] "Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-03 04:47 520192] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-10 11:34 185896] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 12:37 1575680] "GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-18 16:11 4472832 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-25 15:56 1826816 C:\Windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-23 10:39 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\Windows\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 00:11] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-27 21:24] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-27 21:24] R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 18:50] R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 15:13] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 16:30:29 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-13 16:31:47 ComboFix-quarantined-files.txt 2008-08-13 15:31:40 ComboFix2.txt 2008-08-13 11:32:39 ComboFix3.txt 2008-07-28 14:12:37 Pre-Run: 34,906,640,384 byte ledig Post-Run: 34,656,645,120 byte ledig 196 --- E O F --- 2008-08-13 11:11:25 Merker ingen problemer (men eneste som gjorde at jeg merket at jeg hadde en infeksjon i registeret var at mbam fant den...) Endret 13. august 2008 av C 22 Lenke til kommentar
r2d290 Skrevet 13. august 2008 Del Skrevet 13. august 2008 Jeg lagde en feil i det forrige CFScriptet. Prøv igjen: Register:: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=- Lenke til kommentar
C 22 Skrevet 13. august 2008 Forfatter Del Skrevet 13. august 2008 Jeg lagde en feil i det forrige CFScriptet. Prøv igjen: Register:: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=- Da har jeg gjort det. Ny logg: ComboFix 08-08-12.01 - Christian 13.08.2008 18:16:29.17 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.978 [GMT 1:00] Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe Command switches used :: C:\Users\Inernettbruker 3\Desktop\CFScript.txt * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))) . 2008-07-28 22:28 . 2008-07-28 22:28 <DIR> d-------- C:\Users\Sikker internettbruk\AppData\Roaming\Malwarebytes 2008-07-28 18:32 . 2008-05-27 05:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin 2008-07-28 18:32 . 2008-05-27 06:17 34,816 --a------ C:\Windows\System32\msscb.dll 2008-07-28 18:32 . 2008-05-27 05:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-07-28 18:32 . 2008-05-27 06:17 11,776 --a------ C:\Windows\System32\msshooks.dll 2008-07-19 12:32 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-07-19 12:26 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-07-19 12:26 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-07-19 12:26 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Inernettbruker 3\AppData\Roaming\Malwarebytes 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Christian\AppData\Roaming\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-07-18 16:17 . 2008-08-12 16:37 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-18 16:17 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys 2008-07-18 09:21 . 2008-08-13 18:16 <DIR> d-------- C:\QUARANTINE 2008-07-15 21:32 . 2008-07-15 21:32 <DIR> d-------- C:\Users\Sikker internettbruk\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 11:17 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype 2008-08-12 17:54 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-19 21:37 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail 2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM 2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios 2008-06-28 11:52 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-28 11:52 --------- d-----w C:\Program Files\Windows Live 2008-06-28 11:50 --------- d-----w C:\ProgramData\WLInstaller 2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss 2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini 2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll 2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll 2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll 2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll 2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll 2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll 2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll 2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll 2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll 2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll 2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll 2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll 2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat 2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat 2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat 2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys 2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys 2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-08-13_12.32.11.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-13 10:32:11 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2008-08-13 12:59:13 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-08-13 15:16:41 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-08-13 15:16:41 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-08-13 10:41:33 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 15:17:37 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 15:17:37 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-08-13 10:41:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-08-13 15:17:32 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-08-13 15:17:32 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-08-13 11:14:27 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat + 2008-08-13 12:59:21 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat - 2008-08-13 07:15:22 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin + 2008-08-13 15:18:46 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin - 2008-08-13 07:15:22 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-08-13 15:18:46 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-08-13 10:41:48 66,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-08-13 15:18:42 66,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-21 10:48 433840] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [2007-09-26 23:23 40960] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-06 22:50 1506544] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 12:50 815104] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-04-27 14:08 138008] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-04-27 14:08 154392] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-04-27 14:08 133912] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 13:37 174872] "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 16:49 33048] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 00:52 849280] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:35 176128] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 08:50 112216] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768] "Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-03 04:47 520192] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-10 11:34 185896] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 12:37 1575680] "GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-18 16:11 4472832 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-25 15:56 1826816 C:\Windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-23 10:39 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\Windows\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{5FC1691A-0343-4D9A-B668-928D8C0D4EAB}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "{D4F6AEE7-BCE7-457B-B903-F013DF5EDA33}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service "TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 00:11] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-27 21:24] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-27 21:24] R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 18:50] R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 15:13] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 18:19:21 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-13 18:20:36 ComboFix-quarantined-files.txt 2008-08-13 17:20:28 ComboFix2.txt 2008-08-13 15:31:48 ComboFix3.txt 2008-08-13 11:32:39 ComboFix4.txt 2008-07-28 14:12:37 Pre-Run: 34,736,283,648 byte ledig Post-Run: 37,240,320,000 byte ledig 196 --- E O F --- 2008-08-13 11:11:25 Skal bytte antivirus nå. legger ut ny log så snart det er gjort Lenke til kommentar
r2d290 Skrevet 13. august 2008 Del Skrevet 13. august 2008 (endret) Hmm, jeg trodde da det skulle være riktig nå (men de er der fortsatt). Har du kjørt Norton Removal Tool forresten? edit: Forresten, fikk beskjed om at du ikke trenger å fjerne disse linjene likavel, da de "ikke gjør noen værdens ting". Så du kan trygt gå igang med å installere Avira etter at McAfee er fjernet Endret 13. august 2008 av r2d290 Lenke til kommentar
C 22 Skrevet 13. august 2008 Forfatter Del Skrevet 13. august 2008 Hmm, jeg trodde da det skulle være riktig nå (men de er der fortsatt). Har du kjørt Norton Removal Tool forresten? edit: Forresten, fikk beskjed om at du ikke trenger å fjerne disse linjene likavel, da de "ikke gjør noen værdens ting". Så du kan trygt gå igang med å installere Avira etter at McAfee er fjernet Da har Mcafee blitt fjernet og Avira blitt installert. Er det noen rester av McAfee i logen? ComboFix 08-08-12.01 - Christian 13.08.2008 22:05:09.18 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.980 [GMT 1:00] Running from: C:\Users\Inernettbruker 3\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))) . 2008-08-13 20:25 . 2008-08-13 20:25 <DIR> d-------- C:\Users\All Users\Avira 2008-08-13 20:25 . 2008-08-13 20:25 <DIR> d-------- C:\ProgramData\Avira 2008-08-13 20:25 . 2008-08-13 20:25 <DIR> d-------- C:\Program Files\Avira 2008-07-28 22:28 . 2008-07-28 22:28 <DIR> d-------- C:\Users\Sikker internettbruk\AppData\Roaming\Malwarebytes 2008-07-28 18:32 . 2008-05-27 05:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin 2008-07-28 18:32 . 2008-05-27 06:17 34,816 --a------ C:\Windows\System32\msscb.dll 2008-07-28 18:32 . 2008-05-27 05:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-07-28 18:32 . 2008-05-27 06:17 11,776 --a------ C:\Windows\System32\msshooks.dll 2008-07-19 12:32 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-07-19 12:26 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-07-19 12:26 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-07-19 12:26 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Inernettbruker 3\AppData\Roaming\Malwarebytes 2008-07-18 16:18 . 2008-07-18 16:18 <DIR> d-------- C:\Users\Christian\AppData\Roaming\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-07-18 16:17 . 2008-07-18 16:17 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-07-18 16:17 . 2008-08-12 16:37 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-18 16:17 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys 2008-07-18 09:21 . 2008-08-13 18:16 <DIR> d-------- C:\QUARANTINE 2008-07-15 21:32 . 2008-07-15 21:32 <DIR> d-------- C:\Users\Sikker internettbruk\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 11:17 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\Skype 2008-08-12 17:54 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-19 21:37 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-10 07:15 --------- d-----w C:\Program Files\Windows Mail 2008-07-09 13:20 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\skypePM 2008-07-09 13:10 --------- d-----w C:\Program Files\Larian Studios 2008-06-28 11:52 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-28 11:52 --------- d-----w C:\Program Files\Windows Live 2008-06-28 11:50 --------- d-----w C:\ProgramData\WLInstaller 2008-06-28 10:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-06-28 10:03 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-06-26 20:21 --------- d-----w C:\Users\Inernettbruker 3\AppData\Roaming\dvdcss 2008-06-03 19:30 174 --sha-w C:\Program Files\desktop.ini 2008-06-03 18:40 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-06-03 18:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-05-27 20:24 143,104 ----a-w C:\Windows\System32\guard32.dll 2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll 2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll 2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll 2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll 2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll 2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll 2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll 2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll 2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll 2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll 2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll 2008-03-02 19:29 2,684 ----a-w C:\Users\Inernettbruker 3\AppData\Roaming\wklnhst.dat 2007-11-17 17:06 32 ----a-w C:\Users\All Users\ezsid.dat 2007-11-17 17:06 32 ----a-w C:\ProgramData\ezsid.dat 2007-09-05 13:50 25,600 ----a-w C:\Users\Christian\usbsermptxp.sys 2007-09-05 13:50 22,768 ----a-w C:\Users\Christian\usbsermpt.sys 2007-08-16 20:39 180 ----a-w C:\Users\Christian\AppData\Roaming\wklnhst.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-10-03 13:16 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-10-03 13:16 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-08-13_12.32.11.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-13 10:32:11 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2008-08-13 20:03:25 1,016,392 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-08-13 20:04:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-08-13 10:32:59 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-08-13 20:04:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-08-13 10:41:33 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 20:06:02 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-08-13 20:06:02 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-08-13 10:41:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-08-13 20:05:22 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat - 2008-08-13 09:05:05 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-08-13 19:31:06 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-08-13 09:05:05 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-08-13 19:31:06 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-08-13 09:05:05 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-08-13 19:31:06 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-06-27 14:03:55 75,072 ----a-w C:\Windows\System32\drivers\avipbb.sys + 2007-03-01 09:34:22 28,352 ----a-w C:\Windows\System32\drivers\ssmdrv.sys - 2008-08-13 11:14:27 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat + 2008-08-13 12:59:21 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat - 2008-08-13 07:15:22 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin + 2008-08-13 19:23:57 12,652 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1042471630-2520023515-1693159874-1003_UserData.bin - 2008-08-13 07:15:22 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-08-13 19:23:57 87,502 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-08-13 10:41:48 66,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-08-13 20:06:23 68,194 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2008-08-12 23:11:02 278,432 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2008-08-13 18:14:01 278,448 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 08:33 1233920] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-05-21 10:48 433840] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "SODCPreLoad"="C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.0.0.20070913-1045\preload.exe" [2007-09-26 23:23 40960] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-12 16:48 21760296] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-06 22:50 1506544] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 08:36 2153472 C:\Windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 12:50 815104] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-04-27 14:08 138008] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-04-27 14:08 154392] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-04-27 14:08 133912] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 12:05 571024] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 13:37 174872] "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 16:49 33048] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 00:52 849280] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:35 176128] "Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-03 04:47 520192] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-10 11:34 185896] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 12:37 1575680] "GrooveMonitor"="E:\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-18 16:11 4472832 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-25 15:56 1826816 C:\Windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-23 10:39 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\Windows\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{C579CA1A-5B0C-42AD-AF1F-681E5AF0706C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{31991F26-DCB1-4E2C-B9BC-DA4AF150F8CA}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "TCP Query User{EB85E03C-103B-4AC4-AF5D-FD09ACB7DCF0}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= UDP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "UDP Query User{720ED945-D7D5-4DCE-82EC-AB12B844CFC2}C:\\program files\\lucasarts\\swkotor2\\swupdate.exe"= TCP:C:\program files\lucasarts\swkotor2\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program "{A781D603-87F2-467C-8A9A-249D409C7D23}"= TCP:6004|E:\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4309CC36-6F58-4CA8-BAE0-EE6DEA06D2A7}"= UDP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E947DB27-0F86-446A-8556-0C763A464FA0}"= TCP:E:\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7D81279A-AFFC-41D4-BD88-DF5C26342A51}"= UDP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C23DB3B2-2942-4DE8-A9D3-B910C5D2077C}"= TCP:E:\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{350A01EB-ADA0-4A38-95C4-B6C43025B37D}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{DA5AA1E7-B3E4-4AD3-BE69-4CDBE6F1672E}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{7DFF83B6-400C-4F6A-A993-B3AEA09207E4}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{83A5BEC0-884F-4856-841E-AAF310B5A361}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{2C1AB992-9EEE-4588-A642-CFA32AA54C1B}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{D21DF0DA-7B79-4BF6-ADFA-44458ED80B53}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{0E981171-8DD5-4A8F-B268-8603714731EC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 00:11] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-27 21:24] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-27 21:24] R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 18:50] R3 QIOMem;Generic IO & Memory Access;C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 15:13] *Newly Created Service* - CATCHME *Newly Created Service* - SSMDRV . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\h11uardi.default\ ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 22:08:06 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-13 22:09:08 ComboFix-quarantined-files.txt 2008-08-13 21:09:01 ComboFix2.txt 2008-08-13 17:20:37 ComboFix3.txt 2008-08-13 15:31:48 ComboFix4.txt 2008-08-13 11:32:39 ComboFix5.txt 2008-08-13 21:04:52 Pre-Run: 34,802,372,608 byte ledig Post-Run: 34,764,410,880 byte ledig 209 --- E O F --- 2008-08-13 11:11:25 Avira fant forresten en infisert fil E:\SDFix.exe [DETECTION] Is the TR/Agent.1312516 Trojan [NOTE] The file was deleted! og fikk en advarsel om følgende: C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! Er det noe jeg kan gjøre for å få sjekket de 2 siste filene? takk for all hjelp så langt forresten Lenke til kommentar
r2d290 Skrevet 13. august 2008 Del Skrevet 13. august 2008 Ja Gå til http://virusscan.jotti.org , trykk på Browse, og last opp følgende fil til analyse: E:\SDFix.exe C:\hiberfil.sys C:\pagefile.sys Deretter trykker du på Submit. Godta at filen blir scannet. Til slutt kopierer du resultatet, og limer det inn i din neste post, så jeg kan se på den, og vurdere hva som må gjøres videre. Lenke til kommentar
C 22 Skrevet 14. august 2008 Forfatter Del Skrevet 14. august 2008 (endret) Ja Gå til http://virusscan.jotti.org , trykk på Browse, og last opp følgende fil til analyse: E:\SDFix.exe C:\hiberfil.sys C:\pagefile.sys Deretter trykker du på Submit. Godta at filen blir scannet. Til slutt kopierer du resultatet, og limer det inn i din neste post, så jeg kan se på den, og vurdere hva som må gjøres videre. Avira slettet E:\SDFix.exe. De andre to filene finner jeg ikke på c: når jeg trykker på Browse.... Edit: får fremdeles advarsel fra avira om at de to filene ikke kan leses. Endret 14. august 2008 av C 22 Lenke til kommentar
r2d290 Skrevet 14. august 2008 Del Skrevet 14. august 2008 Mulig du må skru på skjulte filer og mapper for å se dem: Konfigurere Windows Vista til å vise skjulte filer og mapper: 1. Åpne mappealternativer ved å klikke Start-knappe, klikke Kontrollpanel, klikke Utseende og personalisering og deretter klikke Mappealternativer. 2. Klikk kategorien Vis. 3. Klikk Vis skjulte filer og mapper under Avanserte innstillinger, og klikk deretter OK. Se om du får dem opp da. Lenke til kommentar
C 22 Skrevet 14. august 2008 Forfatter Del Skrevet 14. august 2008 (endret) Mulig du må skru på skjulte filer og mapper for å se dem: Konfigurere Windows Vista til å vise skjulte filer og mapper: 1. Åpne mappealternativer ved å klikke Start-knappe, klikke Kontrollpanel, klikke Utseende og personalisering og deretter klikke Mappealternativer. 2. Klikk kategorien Vis. 3. Klikk Vis skjulte filer og mapper under Avanserte innstillinger, og klikk deretter OK. Se om du får dem opp da. Har sjekket at jeg hadde skrudd på visning av skjulte filer og mapper. Finner dem fremdeles ikke, hverken med å åpne mappen eller ved å søke etter dem. Endret 14. august 2008 av C 22 Lenke til kommentar
r2d290 Skrevet 14. august 2008 Del Skrevet 14. august 2008 Hmm, da vet jeg ikke. Men dette er uansett to filer som skal være på maskinen, og med mindre du merker noen problemer, tror jeg du trygt kan la dem være. Ellers er alt i orden? Dersom du mener at problemet med maskinen din er løst, kan du endre emnetittelen din, ved å trykke på i førsteposten din, og velge full endring. Øverst der emnetittelen din er, skriver du: [LØST] foran emnetittelen din. Eks: [LØST] Har fått virus på maskinen Dette vil være med på å holde forumet mer oversiktlig for supporterne, samt at nye folk som får samme problemet lettere vil finne en passende tråd å se i. -Surf trygt- Lenke til kommentar
C 22 Skrevet 14. august 2008 Forfatter Del Skrevet 14. august 2008 Hmm, da vet jeg ikke. Men dette er uansett to filer som skal være på maskinen, og med mindre du merker noen problemer, tror jeg du trygt kan la dem være. Ellers er alt i orden? Dersom du mener at problemet med maskinen din er løst, kan du endre emnetittelen din, ved å trykke på i førsteposten din, og velge full endring. Øverst der emnetittelen din er, skriver du: [LØST] foran emnetittelen din. Eks: [LØST] Har fått virus på maskinen Dette vil være med på å holde forumet mer oversiktlig for supporterne, samt at nye folk som får samme problemet lettere vil finne en passende tråd å se i. -Surf trygt- Merker ingen problemer lenger, så hvis dette er filer som skal være på pcen gjør det vel ikke noe. Ellers ser det ut til at alt er i orden Tusen takk for hjelpen! Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå