andrpau Skrevet 20. oktober 2008 Rapporter Del Skrevet 20. oktober 2008 (endret) Hei! Har det endeløse problemet med CiD popups. Ble bedt om å poste loggene mine i en ny tråd. ComboFix Logg: ComboFix 08-10-19.04 - Andreas 2008-10-20 12:06:46.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.797 [GMT 2:00] Running from: C:\Users\Andreas\Downloads\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_nsesvc ((((((((((((((((((((((((( Files Created from 2008-09-20 to 2008-10-20 ))))))))))))))))))))))))))))))) . 2008-10-19 20:06 . 2008-10-19 20:06 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com 2008-10-19 20:06 . 2008-10-19 20:06 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com 2008-10-19 20:05 . 2008-10-19 20:05 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\SUPERAntiSpyware.com 2008-10-19 20:03 . 2008-10-19 20:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-15 07:49 . 2008-10-15 07:49 268 --ah----- C:\sqmdata01.sqm 2008-10-15 07:49 . 2008-10-15 07:49 244 --ah----- C:\sqmnoopt01.sqm 2008-10-11 20:07 . 2008-10-11 20:07 <DIR> d-------- C:\Users\All Users\VIZ_MPS 2008-10-11 20:07 . 2008-10-11 20:07 <DIR> d-------- C:\ProgramData\VIZ_MPS 2008-10-11 20:04 . 2008-10-11 20:07 <DIR> d-------- C:\Program Files\Vizky 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Program Files\iTunes 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Program Files\iPod 2008-10-09 13:11 . 2008-10-09 13:11 <DIR> d-------- C:\Program Files\Common Files\INCA Shared 2008-10-09 13:11 . 2003-07-19 17:17 5,174 --a------ C:\Windows\System32\nppt9x.vxd 2008-10-09 13:11 . 2005-01-03 08:43 4,682 --a------ C:\Windows\System32\npptNT2.sys 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Xfire 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\Users\All Users\Xfire 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\ProgramData\Xfire 2008-10-02 17:35 . 2008-10-20 12:16 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\DNA 2008-10-02 17:35 . 2008-10-02 17:35 <DIR> d-------- C:\Program Files\DNA 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Real 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Common Files\Real 2008-09-27 13:37 . 2008-09-27 13:39 <DIR> d-------- C:\Windows\.jagex_cache_32 2008-09-27 13:37 . 2008-09-27 13:45 24 --a------ C:\Users\Andreas\jagex_runescape_preferences.dat 2008-09-26 17:13 . 2008-09-26 17:13 <DIR> d-------- C:\Program Files\SEND PLAY FIRST 2008-09-25 16:51 . 2008-09-25 16:51 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Windows Live Writer 2008-09-25 12:37 . 2008-09-25 18:20 <DIR> d-------- C:\Users\All Users\Messenger Plus! 2008-09-25 12:37 . 2008-09-25 18:20 <DIR> d-------- C:\ProgramData\Messenger Plus! 2008-09-25 11:52 . 2008-09-26 17:14 <DIR> d-------- C:\Users\All Users\Iso Web Bags Else 2008-09-25 11:52 . 2008-09-26 17:14 <DIR> d-------- C:\ProgramData\Iso Web Bags Else 2008-09-25 11:51 . 2008-09-25 11:51 <DIR> d-------- C:\Users\Andreas\Messenger Plus! Live 2008-09-25 11:51 . 2008-09-26 17:14 <DIR> d-------- C:\Users\All Users\SEND PLAY FIRST 2008-09-25 11:51 . 2008-09-26 17:14 <DIR> d-------- C:\ProgramData\SEND PLAY FIRST 2008-09-25 11:51 . 2008-09-27 16:09 <DIR> d-------- C:\Program Files\Circle Developement 2008-09-25 11:46 . 2008-09-25 11:46 200 --a------ C:\sqmnoopt00.sqm 2008-09-25 11:46 . 2008-09-25 11:46 200 --a------ C:\sqmdata00.sqm 2008-09-22 16:21 . 2008-10-19 20:28 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\skypePM 2008-09-22 16:21 . 2008-09-22 16:21 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-09-22 16:19 . 2008-10-19 20:32 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Users\All Users\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\ProgramData\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Program Files\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-09-22 09:29 . 2008-09-22 09:29 <DIR> d----c--- C:\Windows\System32\DRVSTORE 2008-09-22 09:29 . 2008-04-17 13:12 107,368 --a------ C:\Windows\System32\GEARAspi.dll 2008-09-22 09:29 . 2008-04-17 13:12 15,464 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 10:18 --------- d-----w C:\Program Files\Norman 2008-10-20 06:13 87,043 ----a-w C:\Users\Andreas\AppData\Roaming\nvModes.dat 2008-10-16 05:43 --------- d-----w C:\Program Files\Windows Mail 2008-10-16 05:14 --------- d-----w C:\ProgramData\Microsoft Help 2008-10-15 01:57 --------- d-----w C:\ProgramData\FLEXnet 2008-10-12 10:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-07 05:52 --------- d-----w C:\Program Files\Steam 2008-10-02 03:49 827,392 ----a-w C:\Windows\System32\wininet.dll 2008-10-01 06:28 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-27 12:34 --------- d-----w C:\Program Files\Autodesk 2008-09-27 12:27 --------- d-----w C:\ProgramData\Autodesk 2008-09-27 07:19 --------- d-----w C:\Program Files\Common Files\Steam 2008-09-25 10:05 --------- d-----w C:\Program Files\Windows Live 2008-09-25 10:03 --------- d-----w C:\ProgramData\WLInstaller 2008-09-22 07:27 --------- d-----w C:\Program Files\QuickTime 2008-09-22 07:26 --------- d-----w C:\Program Files\Common Files\Apple 2008-09-22 07:18 --------- d-----w C:\Program Files\Bonjour 2008-09-19 13:15 --------- d-----w C:\Program Files\Microsoft 2008-09-19 13:09 --------- d-----w C:\Program Files\Common Files\Windows Live 2008-09-19 09:09 --------- d-----w C:\ProgramData\Hewlett-Packard 2008-09-18 05:09 3,601,464 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w C:\Windows\System32\win32k.sys 2008-09-17 20:58 --------- d-----w C:\Users\Andreas\AppData\Roaming\Sports Interactive 2008-09-17 12:01 --------- d--h--w C:\Program Files\Zero G Registry 2008-09-16 15:07 --------- d-----w C:\Users\Andreas\AppData\Roaming\Winamp 2008-09-16 07:05 --------- d-----w C:\ProgramData\TrackMania 2008-09-15 14:03 --------- d-----w C:\ProgramData\Fellowes 2008-09-15 14:03 --------- d-----w C:\Program Files\Fellowes 2008-09-12 12:11 --------- d-----w C:\Program Files\Microsoft Works 2008-09-09 18:55 --------- d-----w C:\Users\Andreas\AppData\Roaming\dvdcss 2008-09-09 08:13 737,280 ----a-w C:\Windows\iun6002.exe 2008-09-09 08:13 --------- d-----w C:\Program Files\PopCap Games 2008-09-09 08:12 --------- d-----w C:\ProgramData\Trymedia 2008-09-03 03:59 468,992 ----a-w C:\Windows\System32\newdev.dll 2008-09-03 03:58 74,752 ----a-w C:\Windows\System32\newdev.exe 2008-09-02 10:48 19,512 ----a-w C:\Windows\system32\drivers\nvcv32mf.sys 2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll 2008-08-27 20:06 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-08-27 14:57 21,672 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-08-27 14:57 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-08-27 14:51 --------- d-----w C:\ProgramData\Sony Ericsson 2008-08-27 01:06 288,768 ----a-w C:\Windows\system32\drivers\srv.sys 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-06-24 01:26 174 --sha-w C:\Program Files\desktop.ini 2008-05-15 21:19 133 ----a-w C:\Users\Andreas\reg.reg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 151552] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952] "WhatPulse"="D:\WhatPulse\WhatPulse.exe" [2006-08-21 665600] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-10-02 289088] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "SUPERAntiSpyware"="D:\SAS\SUPERAntiSpyware.exe" [2008-09-03 1576176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BookGreat"="C:\ProgramData\ping bird bird.j41r7s9" [X] "Bags Else Hole Lite"="C:\ProgramData\List Dvd Eq.otv4jz" [X] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 107112] "IS CfgWiz"="C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2006-11-21 46728] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 22696] "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 151552] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520] "Acrobat Assistant 8.0"="D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992] "LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 304664] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2008-04-06 618496] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2006-12-20 90191] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2006-12-20 7766016] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2006-12-20 81920] "MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 4.2\SetHook.exe" [2005-03-28 53248] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-27 185872] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 C:\Windows\RtHDVCpl.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 C:\Windows\KHALMNPR.Exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-22 528384] SetPointII.lnk - C:\Logitech\SetPoint II\SetpointII.exe [2007-08-30 319488] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "D:\SAS\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 D:\SAS\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcerOrbicamRibbon] --a------ 2006-11-28 18:43 754712 C:\Program Files\Acer\OrbiCam10\OrbiCam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{326A5CB9-6F39-4223-B147-4E096FF4342B}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{18DA683D-730B-4440-909F-13E27188EF91}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine "{E6407F78-50EA-448B-BED9-0614E7A1098D}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\MagicDirector.exe:CyberLink MagicDirector "{6FE9BA0E-60A1-4E41-96CA-68063A3E6DF3}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\PowerDV.exe:CyberLink PowerDV "{6FA0EFE7-E731-49BA-BB94-33BB3D7240D2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C0F7CA48-DA61-489F-844C-8F9CDB5AA33A}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{2F4973BB-4300-4026-BA93-B78548375A18}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{C1C97353-1BD7-4892-A3E7-4A47F80BBF76}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{13E053B7-5A60-4436-BDF9-D38AD85F843D}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus "UDP Query User{5324B0B9-F79B-4891-8A8B-B1AC3F2A8787}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus "TCP Query User{FD38BD3D-DEC1-4B2B-A751-EA97E7499100}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{5BCB68D1-F23D-4506-817B-C0C01A6E3F8F}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{5943D690-28A2-4847-AAEA-B45FC429A35F}"= UDP:14038:BitComet 14038 TCP "{BD5B6D6E-CFE1-4B84-A17E-772BFCC13CDE}"= TCP:14038:BitComet 14038 UDP "{4874E7A2-6BF5-4708-A3B6-9875F7343607}"= UDP:14038:BitComet 14038 TCP "{F98BC9E1-058C-45E7-82F5-487E30891AB6}"= TCP:14038:BitComet 14038 UDP "TCP Query User{3D213227-EF99-448F-8FBD-CB3C61196BE9}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{F44C21E0-91BD-44F6-90BE-FDAD51F2CD28}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{523577CD-0752-4006-81CC-229BFD2CB835}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "UDP Query User{0AEC7F6A-E310-40C1-A2F1-0D701CE264D4}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "TCP Query User{A352371B-AE99-45D2-B915-DAE53CBA87C5}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "UDP Query User{2A20C340-36C4-4B40-9708-7C5F1E83778F}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "TCP Query User{47F79010-8336-4AF0-82DC-1EC8DC687B3D}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{7D6D656E-951A-4FED-90C5-9DC14885EA4D}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{F6396790-CB9B-43E9-B7DF-5BA9827087FC}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "UDP Query User{AA28C1F2-6842-4445-AC0B-82FA23F675F4}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "TCP Query User{46408F8C-FB71-49C4-911A-774B02D8253D}C:\\program files\\steam\\steamapps\\comicjedi\\half-life 2 deathmatch\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\half-life 2 deathmatch\hl2.exe:hl2 "UDP Query User{A349C816-5308-4FBA-8370-E6625CBA4D47}C:\\program files\\steam\\steamapps\\comicjedi\\half-life 2 deathmatch\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\half-life 2 deathmatch\hl2.exe:hl2 "TCP Query User{C2F0F9B2-DA68-4209-8B0F-DBB0D29FAF00}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{13FAEDA1-60A5-4978-9E2F-E500C34FA819}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{61E359B0-1333-4568-85EB-FB904758AA45}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "UDP Query User{7B3CE935-2463-4850-8F87-FE28312EC029}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "{7CBA3ED0-65DF-4833-AF4A-ECB7F4A993D6}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{F9F162ED-B92C-42CC-8F25-318393B21888}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{CEA2E2A5-3199-45B0-BD3A-07D734E5E1AD}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{6A703CAD-3542-4A83-B4C7-5F32D8925F7B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{EF734B3D-4839-477D-BB0D-103A18C90B99}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{BCA3C766-7F2F-43E7-926E-BC13CD2C67C1}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC "UDP Query User{FC54581E-56C0-4FE0-BE1E-03BB096E15A6}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC "TCP Query User{6B67A76D-1582-4B79-B862-55B7AE71943E}D:\\tmnationsforever\\tmforever.exe"= UDP:D:\tmnationsforever\tmforever.exe:TmForever "UDP Query User{A1DD2172-49A4-4802-84D4-9FC03B10DE81}D:\\tmnationsforever\\tmforever.exe"= TCP:D:\tmnationsforever\tmforever.exe:TmForever "TCP Query User{D9EAD0A0-ACE1-4C71-BB32-D34733C86871}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC "UDP Query User{1364A06A-2DDA-47EF-8F9F-6251461EF142}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC "TCP Query User{5EB93E39-220B-4386-AB0F-E0985FC962D1}D:\\tmnationsforever\\tmforever.exe"= UDP:D:\tmnationsforever\tmforever.exe:TmForever "UDP Query User{96AA886A-DCCB-4E3A-86AA-0EEB3A065727}D:\\tmnationsforever\\tmforever.exe"= TCP:D:\tmnationsforever\tmforever.exe:TmForever "TCP Query User{458C76FA-E491-4142-9E76-41185A45DF74}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{AC3F9AF1-77B5-4CB9-9D3E-D88A67921BC5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{2F82B909-1AD5-4FD2-A2E7-54D02007D1FF}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "UDP Query User{A61834BE-099A-4F57-9540-4CFD7E196CF2}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "TCP Query User{730FFB5E-7566-4E5D-BB2C-F067A9B41042}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "UDP Query User{73420FCA-7D07-44B0-B47A-1075AA7BE851}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "TCP Query User{C2747FFC-A1B6-42E5-960E-8A62A984411B}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes "UDP Query User{7E1EF5A3-217F-48A8-97D7-1CB8885DD66F}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes "TCP Query User{3E5A4F37-5D5C-4397-A951-4D2608F627F1}D:\\4d\\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\\cinema 4d r10\\net render client.exe"= UDP:D:\4d\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\cinema 4d r10\net render client.exe:CINEMA 4D ® "UDP Query User{C3E4F64A-9852-4E8D-AAC2-73D07088F0FD}D:\\4d\\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\\cinema 4d r10\\net render client.exe"= TCP:D:\4d\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\cinema 4d r10\net render client.exe:CINEMA 4D ® "{F0844717-D8D9-4102-8D1C-8F06DC75FA92}"= UDP:D:\3D Studio Max\3dsmax.exe:Autodesk 3ds Max 9 32-bit "{B74E0A0D-AA2F-4707-A82E-6601991F6EA6}"= TCP:D:\3D Studio Max\3dsmax.exe:Autodesk 3ds Max 9 32-bit "{F89171F6-8BA9-426E-BC45-AB3AF66DEABB}"= UDP:D:\Backburner\monitor.exe:backburner 2.3 monitor "{A019F471-009E-457E-ACD7-F8E71AAC5444}"= TCP:D:\Backburner\monitor.exe:backburner 2.3 monitor "{4BF9B8EE-F890-4E90-A2B2-69263DF711C5}"= UDP:D:\Backburner\manager.exe:backburner 2.3 manager "{C1769B9F-28A3-4ED7-B25D-811B4794FAA5}"= TCP:D:\Backburner\manager.exe:backburner 2.3 manager "{545CE624-3AD6-45D3-97FB-51A5CE58CE91}"= UDP:D:\Backburner\server.exe:backburner 2.3 server "{DB30E791-897E-49A6-ADA3-7328EFD68939}"= TCP:D:\Backburner\server.exe:backburner 2.3 server "TCP Query User{79618DA2-A6CB-4B7C-8BCE-A205B74EB15B}D:\\update service\\update service.exe"= UDP:D:\update service\update service.exe:Update Service "UDP Query User{929E4D3B-33E9-458C-8408-D16B833BA4CC}D:\\update service\\update service.exe"= TCP:D:\update service\update service.exe:Update Service "{64E8DE37-AB10-4E68-B6D0-82043DBE3B94}"= UDP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{AB65256A-FF6C-424F-8396-B0F32121DDA7}"= TCP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{D5EE5E35-FB9D-4530-A21E-56A24237DDFE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{B3065A72-89C8-4571-AA7B-ECCCE1162A24}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{9548EC8C-F5BC-4905-821F-4204AC288671}"= C:\Program Files\Skype\Phone\Skype.exe:Skype "{E8591673-1F49-4D4B-ADFF-EC6DEDB9F8C4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{1D989B63-AB0E-49B8-BA5C-6739ABA88996}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{F070D3EA-83FE-4A7D-AE67-72155F2AD4B6}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{DD4944D4-FC1A-4C65-B826-F3574B4E0882}"= Disabled:UDP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{20F64A0F-90FA-4243-B04D-64BB5ADACC79}"= Disabled:TCP:D:\FootballManager2008\fm.exe:Football Manager 2008 "TCP Query User{053879EB-8B14-4816-8ECA-804650AE8F8A}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{1D2BDFFB-AFF4-457E-BD69-F5D95A0FDC04}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{D2827C6F-5024-4EF3-B456-48C13004465E}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{8BA4400E-29BC-4B4D-B18C-D51BC6415CD0}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "{1C107704-2A85-4306-B8E6-EA71A0E30C68}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{5360896A-F851-418E-A8D5-8674476CF6D8}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{D7D4B773-1CD7-4025-A416-129D63EC529A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{00A178C0-06AD-465C-92E3-721B98F33F0E}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{DDE3EE1D-8BF6-40D1-A75C-4D2D2F0E082E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{D3392024-94A3-4022-9B8B-C8DC1BD7626C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 20448] R3 NvcMFlt;NvcMFlt;C:\Windows\system32\DRIVERS\nvcv32mf.sys [2008-09-02 19512] R3 nvcoas;Norman Virus Control on-access component;C:\Program Files\Norman\Nvc\bin\nvcoas.exe [2008-04-29 183352] R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2008-03-11 146488] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936] S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-08-27 13352] S3 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872] S3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 31232] S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-09-26 92656] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\Autoplay.exe -auto [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2138065a-573d-11dd-be51-001b38214de5}] \shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21380682-573d-11dd-be51-001b38214de5}] \shell\AutoRun\command - F:\AutoRun.exe *Newly Created Service* - COMHOST . - - - - ORPHANS REMOVED - - - - HKLM-Run-eDSMSNfix - C:\Acer\Empowering Technology\eDSMSNfix.exe HKLM-Run-SetPanel - C:\Acer\APanel\APanel.cmd HKLM-Run-Acer Tour - (no file) HKLM-Run-eRecoveryService - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\skrioer4.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.sol.no/ FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Program Files\Vizky\npVizky.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-20 12:20:00 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Windows\System32\audiodg.exe C:\Program Files\Norman\Npm\Bin\eLogsvc.exe C:\Program Files\Norman\Npm\Bin\Zanda.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe C:\Acer\Empowering Technology\eNet\eNet Service.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Acer\Mobility Center\MobilityService.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Windows\System32\drivers\XAudio.exe C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe C:\Acer\Empowering Technology\ePower\ePowerSvc.exe C:\Windows\System32\wbem\unsecapp.exe C:\Program Files\Norman\Npm\Bin\Njeeves.exe C:\Windows\System32\conime.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Andreas\AppData\Local\Temp\RtkBtMnt.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Norman\NVC\bin\Nip.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe C:\Acer\Empowering Technology\eNet\eNMTray.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Norman\NVC\bin\CClaw.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe . ************************************************************************** . Completion time: 2008-10-20 12:31:42 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-20 10:31:11 Pre-Run: 12,612,952,064 byte ledig Post-Run: 13,211,623,424 byte ledig 353 --- E O F --- 2008-10-17 00:23:15 SAS Logg: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 10/19/2008 at 08:59 PM Application Version : 4.21.1004 Core Rules Database Version : 3602 Trace Rules Database Version: 1588 Scan type : Complete Scan Total Scan Time : 00:48:43 Memory items scanned : 730 Memory threats detected : 0 Registry items scanned : 7979 Registry threats detected : 0 File items scanned : 31960 File threats detected : 26 Adware.Tracking Cookie C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@apmebf[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@doubleclick[1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@partypoker[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@advertising[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@serving-sys[1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@fastclick[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@atdmt[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@tradedoubler[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@mediaplex[1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@partyaccount[2].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\andreas@pacificpoker[1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt HiJackThis Logg: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:38:23, on 20/10/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Program Files\Norman\Npm\Bin\eLogsvc.exe C:\Program Files\Norman\Npm\Bin\Zanda.exe C:\Windows\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe C:\Acer\Empowering Technology\eNet\eNet Service.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Acer\Mobility Center\MobilityService.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe C:\Acer\Empowering Technology\ePower\ePowerSvc.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\taskeng.exe C:\Program Files\Norman\Npm\bin\NJEEVES.EXE C:\Windows\system32\conime.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Norman\Npm\Bin\Zlh.exe D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Norman\Nvc\bin\nvcoas.exe C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\ehome\ehtray.exe D:\WhatPulse\WhatPulse.exe C:\Program Files\DNA\btdna.exe D:\SAS\SUPERAntiSpyware.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Andreas\AppData\Local\Temp\RtkBtMnt.exe C:\Logitech\SetPoint II\SetpointII.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Norman\Nvc\BIN\NIP.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Norman\Nvc\bin\cclaw.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Windows\Explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\HJTI\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [iS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.2\SetHook.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [bookGreat] "C:\ProgramData\ping bird bird.j41r7s9" O4 - HKLM\..\Run: [bags Else Hole Lite] "C:\ProgramData\List Dvd Eq.otv4jz" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WhatPulse] D:\WhatPulse\WhatPulse.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] D:\SAS\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE') O4 - Global Startup: Empowering Technology Launcher.lnk = ? O4 - Global Startup: SetPointII.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blogg dette - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blogg dette i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: eNetHook.dll O20 - Winlogon Notify: !SASWinLogon - D:\SAS\SASWINLO.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - D:\3D Studio Max\mentalray\satellite\raysat_3dsmax9_32server.exe (file missing) O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 14911 bytes Håper på en løsning på det irriterende problemet. Endret 22. oktober 2008 av Danglebaer Lenke til kommentar
norbat Skrevet 20. oktober 2008 Rapporter Del Skrevet 20. oktober 2008 Avinstaller Messenger Plus! fra legg til/fjern programmer. Kjør deretter Combofix på nytt og post loggen. Lenke til kommentar
andrpau Skrevet 20. oktober 2008 Forfatter Rapporter Del Skrevet 20. oktober 2008 Avinstaller Messenger Plus! fra legg til/fjern programmer.Kjør deretter Combofix på nytt og post loggen. Selvfølgelig! Har ikke lagt merke til det før nå, det står (CiD) etter messenger plus! Herregud jeg er dum! Lenke til kommentar
andrpau Skrevet 21. oktober 2008 Forfatter Rapporter Del Skrevet 21. oktober 2008 Avinstaller Messenger Plus! fra legg til/fjern programmer.Kjør deretter Combofix på nytt og post loggen. ComboFix 08-10-19.04 - Andreas 2008-10-21 8:22:32.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.1257 [GMT 2:00] Running from: C:\Users\Andreas\Downloads\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-09-21 to 2008-10-21 ))))))))))))))))))))))))))))))) . 2008-10-19 20:06 . 2008-10-19 20:06 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com 2008-10-19 20:06 . 2008-10-19 20:06 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com 2008-10-19 20:05 . 2008-10-19 20:05 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\SUPERAntiSpyware.com 2008-10-19 20:03 . 2008-10-19 20:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-15 07:49 . 2008-10-15 07:49 268 --ah----- C:\sqmdata01.sqm 2008-10-15 07:49 . 2008-10-15 07:49 244 --ah----- C:\sqmnoopt01.sqm 2008-10-11 20:07 . 2008-10-11 20:07 <DIR> d-------- C:\Users\All Users\VIZ_MPS 2008-10-11 20:07 . 2008-10-11 20:07 <DIR> d-------- C:\ProgramData\VIZ_MPS 2008-10-11 20:04 . 2008-10-11 20:07 <DIR> d-------- C:\Program Files\Vizky 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Program Files\iTunes 2008-10-10 00:07 . 2008-10-10 00:07 <DIR> d-------- C:\Program Files\iPod 2008-10-09 13:11 . 2008-10-09 13:11 <DIR> d-------- C:\Program Files\Common Files\INCA Shared 2008-10-09 13:11 . 2003-07-19 17:17 5,174 --a------ C:\Windows\System32\nppt9x.vxd 2008-10-09 13:11 . 2005-01-03 08:43 4,682 --a------ C:\Windows\System32\npptNT2.sys 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Xfire 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\Users\All Users\Xfire 2008-10-03 06:52 . 2008-10-03 06:52 <DIR> d-------- C:\ProgramData\Xfire 2008-10-02 17:35 . 2008-10-21 08:26 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\DNA 2008-10-02 17:35 . 2008-10-02 17:35 <DIR> d-------- C:\Program Files\DNA 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Real 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-09-27 19:01 . 2008-09-27 19:01 <DIR> d-------- C:\Program Files\Common Files\Real 2008-09-27 13:37 . 2008-09-27 13:39 <DIR> d-------- C:\Windows\.jagex_cache_32 2008-09-27 13:37 . 2008-09-27 13:45 24 --a------ C:\Users\Andreas\jagex_runescape_preferences.dat 2008-09-26 17:13 . 2008-09-26 17:13 <DIR> d-------- C:\Program Files\SEND PLAY FIRST 2008-09-25 16:51 . 2008-09-25 16:51 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Windows Live Writer 2008-09-25 11:52 . 2008-09-26 17:14 <DIR> d-------- C:\Users\All Users\Iso Web Bags Else 2008-09-25 11:52 . 2008-09-26 17:14 <DIR> d-------- C:\ProgramData\Iso Web Bags Else 2008-09-25 11:51 . 2008-09-26 17:14 <DIR> d-------- C:\Users\All Users\SEND PLAY FIRST 2008-09-25 11:51 . 2008-09-26 17:14 <DIR> d-------- C:\ProgramData\SEND PLAY FIRST 2008-09-25 11:46 . 2008-09-25 11:46 200 --a------ C:\sqmnoopt00.sqm 2008-09-25 11:46 . 2008-09-25 11:46 200 --a------ C:\sqmdata00.sqm 2008-09-22 16:21 . 2008-10-19 20:28 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\skypePM 2008-09-22 16:21 . 2008-09-22 16:21 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-09-22 16:19 . 2008-10-19 20:32 <DIR> d-------- C:\Users\Andreas\AppData\Roaming\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Users\All Users\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\ProgramData\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Program Files\Skype 2008-09-22 16:18 . 2008-09-22 16:18 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-09-22 09:29 . 2008-09-22 09:29 <DIR> d----c--- C:\Windows\System32\DRVSTORE 2008-09-22 09:29 . 2008-04-17 13:12 107,368 --a------ C:\Windows\System32\GEARAspi.dll 2008-09-22 09:29 . 2008-04-17 13:12 15,464 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-21 05:55 --------- d-----w C:\Program Files\Norman 2008-10-20 06:13 87,043 ----a-w C:\Users\Andreas\AppData\Roaming\nvModes.dat 2008-10-16 05:43 --------- d-----w C:\Program Files\Windows Mail 2008-10-16 05:14 --------- d-----w C:\ProgramData\Microsoft Help 2008-10-15 01:57 --------- d-----w C:\ProgramData\FLEXnet 2008-10-12 10:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-07 05:52 --------- d-----w C:\Program Files\Steam 2008-10-02 03:49 827,392 ----a-w C:\Windows\System32\wininet.dll 2008-10-01 06:28 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-27 12:34 --------- d-----w C:\Program Files\Autodesk 2008-09-27 12:27 --------- d-----w C:\ProgramData\Autodesk 2008-09-27 07:19 --------- d-----w C:\Program Files\Common Files\Steam 2008-09-25 10:05 --------- d-----w C:\Program Files\Windows Live 2008-09-25 10:03 --------- d-----w C:\ProgramData\WLInstaller 2008-09-22 07:27 --------- d-----w C:\Program Files\QuickTime 2008-09-22 07:26 --------- d-----w C:\Program Files\Common Files\Apple 2008-09-22 07:18 --------- d-----w C:\Program Files\Bonjour 2008-09-19 13:15 --------- d-----w C:\Program Files\Microsoft 2008-09-19 13:09 --------- d-----w C:\Program Files\Common Files\Windows Live 2008-09-19 09:09 --------- d-----w C:\ProgramData\Hewlett-Packard 2008-09-18 05:09 3,601,464 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w C:\Windows\System32\win32k.sys 2008-09-17 20:58 --------- d-----w C:\Users\Andreas\AppData\Roaming\Sports Interactive 2008-09-17 12:01 --------- d--h--w C:\Program Files\Zero G Registry 2008-09-16 15:07 --------- d-----w C:\Users\Andreas\AppData\Roaming\Winamp 2008-09-16 07:05 --------- d-----w C:\ProgramData\TrackMania 2008-09-15 14:03 --------- d-----w C:\ProgramData\Fellowes 2008-09-15 14:03 --------- d-----w C:\Program Files\Fellowes 2008-09-12 12:11 --------- d-----w C:\Program Files\Microsoft Works 2008-09-09 18:55 --------- d-----w C:\Users\Andreas\AppData\Roaming\dvdcss 2008-09-09 08:13 737,280 ----a-w C:\Windows\iun6002.exe 2008-09-09 08:13 --------- d-----w C:\Program Files\PopCap Games 2008-09-09 08:12 --------- d-----w C:\ProgramData\Trymedia 2008-09-03 03:59 468,992 ----a-w C:\Windows\System32\newdev.dll 2008-09-03 03:58 74,752 ----a-w C:\Windows\System32\newdev.exe 2008-09-02 10:48 19,512 ----a-w C:\Windows\system32\drivers\nvcv32mf.sys 2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll 2008-08-27 20:06 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-08-27 14:57 21,672 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-08-27 14:57 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-08-27 14:51 --------- d-----w C:\ProgramData\Sony Ericsson 2008-08-27 01:06 288,768 ----a-w C:\Windows\system32\drivers\srv.sys 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-06-24 01:26 174 --sha-w C:\Program Files\desktop.ini 2008-05-15 21:19 133 ----a-w C:\Users\Andreas\reg.reg . ((((((((((((((((((((((((((((( snapshot@2008-10-20_12.29.25.69 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-21 05:55:52 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-10-21 05:55:52 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-10-20 10:18:32 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-10-21 06:18:21 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-10-21 06:18:21 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-10-19 21:28:08 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-10-20 19:58:43 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-10-19 21:28:08 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-10-20 19:58:43 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-10-19 21:28:08 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-10-20 19:58:43 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-10-20 10:19:12 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-10-21 06:29:19 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-10-21 06:29:19 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-10-20 09:52:09 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-10-20 18:02:00 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-10-20 09:52:09 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-10-20 18:02:00 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-10-20 09:52:09 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-10-20 18:02:00 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-10-20 07:57:34 105,840 ----a-w C:\Windows\System32\perfc009.dat + 2008-10-20 15:55:49 105,840 ----a-w C:\Windows\System32\perfc009.dat - 2008-10-20 07:57:34 80,980 ----a-w C:\Windows\System32\perfc014.dat + 2008-10-20 15:55:49 80,980 ----a-w C:\Windows\System32\perfc014.dat - 2008-10-20 07:57:34 600,366 ----a-w C:\Windows\System32\perfh009.dat + 2008-10-20 15:55:49 600,366 ----a-w C:\Windows\System32\perfh009.dat - 2008-10-20 07:57:34 457,028 ----a-w C:\Windows\System32\perfh014.dat + 2008-10-20 15:55:50 457,028 ----a-w C:\Windows\System32\perfh014.dat - 2008-10-20 10:20:10 9,680 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3979607418-2196391649-2687138810-1000_UserData.bin + 2008-10-21 05:57:48 9,788 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3979607418-2196391649-2687138810-1000_UserData.bin - 2008-10-20 10:20:07 74,372 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-10-21 05:57:48 74,548 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-10-20 06:02:53 58,122 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-10-21 05:57:45 58,162 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 151552] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952] "WhatPulse"="D:\WhatPulse\WhatPulse.exe" [2006-08-21 665600] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-10-02 289088] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "SUPERAntiSpyware"="D:\SAS\SUPERAntiSpyware.exe" [2008-09-03 1576176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BookGreat"="C:\ProgramData\ping bird bird.yp4x8" [X] "Bags Else Hole Lite"="C:\ProgramData\List Dvd Eq.otv4jz" [X] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 107112] "IS CfgWiz"="C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2006-11-21 46728] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 22696] "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 151552] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520] "Acrobat Assistant 8.0"="D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992] "LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 304664] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2008-04-06 618496] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2006-12-20 90191] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2006-12-20 7766016] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2006-12-20 81920] "MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 4.2\SetHook.exe" [2005-03-28 53248] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-27 185872] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 C:\Windows\RtHDVCpl.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 C:\Windows\KHALMNPR.Exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-22 528384] SetPointII.lnk - C:\Logitech\SetPoint II\SetpointII.exe [2007-08-30 319488] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "D:\SAS\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 D:\SAS\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcerOrbicamRibbon] --a------ 2006-11-28 18:43 754712 C:\Program Files\Acer\OrbiCam10\OrbiCam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{326A5CB9-6F39-4223-B147-4E096FF4342B}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{18DA683D-730B-4440-909F-13E27188EF91}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine "{E6407F78-50EA-448B-BED9-0614E7A1098D}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\MagicDirector.exe:CyberLink MagicDirector "{6FE9BA0E-60A1-4E41-96CA-68063A3E6DF3}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\PowerDV.exe:CyberLink PowerDV "{6FA0EFE7-E731-49BA-BB94-33BB3D7240D2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C0F7CA48-DA61-489F-844C-8F9CDB5AA33A}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{2F4973BB-4300-4026-BA93-B78548375A18}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{C1C97353-1BD7-4892-A3E7-4A47F80BBF76}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{13E053B7-5A60-4436-BDF9-D38AD85F843D}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus "UDP Query User{5324B0B9-F79B-4891-8A8B-B1AC3F2A8787}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus "TCP Query User{FD38BD3D-DEC1-4B2B-A751-EA97E7499100}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{5BCB68D1-F23D-4506-817B-C0C01A6E3F8F}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{5943D690-28A2-4847-AAEA-B45FC429A35F}"= UDP:14038:BitComet 14038 TCP "{BD5B6D6E-CFE1-4B84-A17E-772BFCC13CDE}"= TCP:14038:BitComet 14038 UDP "{4874E7A2-6BF5-4708-A3B6-9875F7343607}"= UDP:14038:BitComet 14038 TCP "{F98BC9E1-058C-45E7-82F5-487E30891AB6}"= TCP:14038:BitComet 14038 UDP "TCP Query User{3D213227-EF99-448F-8FBD-CB3C61196BE9}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{F44C21E0-91BD-44F6-90BE-FDAD51F2CD28}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{523577CD-0752-4006-81CC-229BFD2CB835}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "UDP Query User{0AEC7F6A-E310-40C1-A2F1-0D701CE264D4}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "TCP Query User{A352371B-AE99-45D2-B915-DAE53CBA87C5}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "UDP Query User{2A20C340-36C4-4B40-9708-7C5F1E83778F}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "TCP Query User{47F79010-8336-4AF0-82DC-1EC8DC687B3D}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{7D6D656E-951A-4FED-90C5-9DC14885EA4D}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{F6396790-CB9B-43E9-B7DF-5BA9827087FC}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "UDP Query User{AA28C1F2-6842-4445-AC0B-82FA23F675F4}C:\\program files\\steam\\steamapps\\comicjedi\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\day of defeat source\hl2.exe:hl2 "TCP Query User{46408F8C-FB71-49C4-911A-774B02D8253D}C:\\program files\\steam\\steamapps\\comicjedi\\half-life 2 deathmatch\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\half-life 2 deathmatch\hl2.exe:hl2 "UDP Query User{A349C816-5308-4FBA-8370-E6625CBA4D47}C:\\program files\\steam\\steamapps\\comicjedi\\half-life 2 deathmatch\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\half-life 2 deathmatch\hl2.exe:hl2 "TCP Query User{C2F0F9B2-DA68-4209-8B0F-DBB0D29FAF00}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{13FAEDA1-60A5-4978-9E2F-E500C34FA819}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{61E359B0-1333-4568-85EB-FB904758AA45}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "UDP Query User{7B3CE935-2463-4850-8F87-FE28312EC029}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike source\hl2.exe:hl2 "{7CBA3ED0-65DF-4833-AF4A-ECB7F4A993D6}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{F9F162ED-B92C-42CC-8F25-318393B21888}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{CEA2E2A5-3199-45B0-BD3A-07D734E5E1AD}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{6A703CAD-3542-4A83-B4C7-5F32D8925F7B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{EF734B3D-4839-477D-BB0D-103A18C90B99}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{BCA3C766-7F2F-43E7-926E-BC13CD2C67C1}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC "UDP Query User{FC54581E-56C0-4FE0-BE1E-03BB096E15A6}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC "TCP Query User{6B67A76D-1582-4B79-B862-55B7AE71943E}D:\\tmnationsforever\\tmforever.exe"= UDP:D:\tmnationsforever\tmforever.exe:TmForever "UDP Query User{A1DD2172-49A4-4802-84D4-9FC03B10DE81}D:\\tmnationsforever\\tmforever.exe"= TCP:D:\tmnationsforever\tmforever.exe:TmForever "TCP Query User{D9EAD0A0-ACE1-4C71-BB32-D34733C86871}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC "UDP Query User{1364A06A-2DDA-47EF-8F9F-6251461EF142}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC "TCP Query User{5EB93E39-220B-4386-AB0F-E0985FC962D1}D:\\tmnationsforever\\tmforever.exe"= UDP:D:\tmnationsforever\tmforever.exe:TmForever "UDP Query User{96AA886A-DCCB-4E3A-86AA-0EEB3A065727}D:\\tmnationsforever\\tmforever.exe"= TCP:D:\tmnationsforever\tmforever.exe:TmForever "TCP Query User{458C76FA-E491-4142-9E76-41185A45DF74}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{AC3F9AF1-77B5-4CB9-9D3E-D88A67921BC5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{2F82B909-1AD5-4FD2-A2E7-54D02007D1FF}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "UDP Query User{A61834BE-099A-4F57-9540-4CFD7E196CF2}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "TCP Query User{730FFB5E-7566-4E5D-BB2C-F067A9B41042}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "UDP Query User{73420FCA-7D07-44B0-B47A-1075AA7BE851}C:\\program files\\steam\\steamapps\\comicjedi\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\comicjedi\team fortress 2\hl2.exe:hl2 "TCP Query User{C2747FFC-A1B6-42E5-960E-8A62A984411B}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes "UDP Query User{7E1EF5A3-217F-48A8-97D7-1CB8885DD66F}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes "TCP Query User{3E5A4F37-5D5C-4397-A951-4D2608F627F1}D:\\4d\\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\\cinema 4d r10\\net render client.exe"= UDP:D:\4d\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\cinema 4d r10\net render client.exe:CINEMA 4D ® "UDP Query User{C3E4F64A-9852-4E8D-AAC2-73D07088F0FD}D:\\4d\\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\\cinema 4d r10\\net render client.exe"= TCP:D:\4d\maxon.cinema.4d.studio.bundle.v10.111.multilanguage\cinema 4d r10\net render client.exe:CINEMA 4D ® "{F0844717-D8D9-4102-8D1C-8F06DC75FA92}"= UDP:D:\3D Studio Max\3dsmax.exe:Autodesk 3ds Max 9 32-bit "{B74E0A0D-AA2F-4707-A82E-6601991F6EA6}"= TCP:D:\3D Studio Max\3dsmax.exe:Autodesk 3ds Max 9 32-bit "{F89171F6-8BA9-426E-BC45-AB3AF66DEABB}"= UDP:D:\Backburner\monitor.exe:backburner 2.3 monitor "{A019F471-009E-457E-ACD7-F8E71AAC5444}"= TCP:D:\Backburner\monitor.exe:backburner 2.3 monitor "{4BF9B8EE-F890-4E90-A2B2-69263DF711C5}"= UDP:D:\Backburner\manager.exe:backburner 2.3 manager "{C1769B9F-28A3-4ED7-B25D-811B4794FAA5}"= TCP:D:\Backburner\manager.exe:backburner 2.3 manager "{545CE624-3AD6-45D3-97FB-51A5CE58CE91}"= UDP:D:\Backburner\server.exe:backburner 2.3 server "{DB30E791-897E-49A6-ADA3-7328EFD68939}"= TCP:D:\Backburner\server.exe:backburner 2.3 server "TCP Query User{79618DA2-A6CB-4B7C-8BCE-A205B74EB15B}D:\\update service\\update service.exe"= UDP:D:\update service\update service.exe:Update Service "UDP Query User{929E4D3B-33E9-458C-8408-D16B833BA4CC}D:\\update service\\update service.exe"= TCP:D:\update service\update service.exe:Update Service "{64E8DE37-AB10-4E68-B6D0-82043DBE3B94}"= UDP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{AB65256A-FF6C-424F-8396-B0F32121DDA7}"= TCP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{D5EE5E35-FB9D-4530-A21E-56A24237DDFE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{B3065A72-89C8-4571-AA7B-ECCCE1162A24}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{9548EC8C-F5BC-4905-821F-4204AC288671}"= C:\Program Files\Skype\Phone\Skype.exe:Skype "{E8591673-1F49-4D4B-ADFF-EC6DEDB9F8C4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{1D989B63-AB0E-49B8-BA5C-6739ABA88996}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{F070D3EA-83FE-4A7D-AE67-72155F2AD4B6}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{DD4944D4-FC1A-4C65-B826-F3574B4E0882}"= Disabled:UDP:D:\FootballManager2008\fm.exe:Football Manager 2008 "{20F64A0F-90FA-4243-B04D-64BB5ADACC79}"= Disabled:TCP:D:\FootballManager2008\fm.exe:Football Manager 2008 "TCP Query User{053879EB-8B14-4816-8ECA-804650AE8F8A}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{1D2BDFFB-AFF4-457E-BD69-F5D95A0FDC04}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{D2827C6F-5024-4EF3-B456-48C13004465E}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{8BA4400E-29BC-4B4D-B18C-D51BC6415CD0}C:\\program files\\steam\\steamapps\\comicjedi\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\comicjedi\counter-strike\hl.exe:Half-Life Launcher "{1C107704-2A85-4306-B8E6-EA71A0E30C68}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{5360896A-F851-418E-A8D5-8674476CF6D8}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{D7D4B773-1CD7-4025-A416-129D63EC529A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{00A178C0-06AD-465C-92E3-721B98F33F0E}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{DDE3EE1D-8BF6-40D1-A75C-4D2D2F0E082E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{D3392024-94A3-4022-9B8B-C8DC1BD7626C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 20448] R3 NvcMFlt;NvcMFlt;C:\Windows\system32\DRIVERS\nvcv32mf.sys [2008-09-02 19512] R3 nvcoas;Norman Virus Control on-access component;C:\Program Files\Norman\Nvc\bin\nvcoas.exe [2008-04-29 183352] R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2008-03-11 146488] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936] S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-08-27 13352] S3 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872] S3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 31232] S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-09-26 92656] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\Autoplay.exe -auto [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2138065a-573d-11dd-be51-001b38214de5}] \shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21380682-573d-11dd-be51-001b38214de5}] \shell\AutoRun\command - F:\AutoRun.exe *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\skrioer4.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.sol.no/ FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Program Files\Vizky\npVizky.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 08:29:41 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-21 8:33:36 ComboFix-quarantined-files.txt 2008-10-21 06:33:09 ComboFix2.txt 2008-10-20 10:31:45 Pre-Run: 12,871,098,368 byte ledig Post-Run: 12,827,934,720 byte ledig 339 --- E O F --- 2008-10-17 00:23:15 Lenke til kommentar
andrpau Skrevet 21. oktober 2008 Forfatter Rapporter Del Skrevet 21. oktober 2008 (endret) Ups! Dobbelpostet loggen :/ Endret 21. oktober 2008 av Danglebaer Lenke til kommentar
norbat Skrevet 21. oktober 2008 Rapporter Del Skrevet 21. oktober 2008 Bruk utforsker til å finne og slett følgende mapper: C:\Program Files\SEND PLAY FIRST C:\Users\All Users\Iso Web Bags Else C:\ProgramData\Iso Web Bags Else C:\Users\All Users\SEND PLAY FIRST C:\ProgramData\SEND PLAY FIRST Start HJT, velg "Do a system scan only", sett merke framfor følgende linjer: O4 - HKLM\..\Run: [bookGreat] "C:\ProgramData\ping bird bird.j41r7s9" O4 - HKLM\..\Run: [bags Else Hole Lite] "C:\ProgramData\List Dvd Eq.otv4jz" Ut over dette ser det greit ut. Fortsatt problemer med CiD? Lenke til kommentar
andrpau Skrevet 22. oktober 2008 Forfatter Rapporter Del Skrevet 22. oktober 2008 Bruk utforsker til å finne og slett følgende mapper: C:\Program Files\SEND PLAY FIRST C:\Users\All Users\Iso Web Bags Else C:\ProgramData\Iso Web Bags Else C:\Users\All Users\SEND PLAY FIRST C:\ProgramData\SEND PLAY FIRST Start HJT, velg "Do a system scan only", sett merke framfor følgende linjer: O4 - HKLM\..\Run: [bookGreat] "C:\ProgramData\ping bird bird.j41r7s9" O4 - HKLM\..\Run: [bags Else Hole Lite] "C:\ProgramData\List Dvd Eq.otv4jz" Ut over dette ser det greit ut. Fortsatt problemer med CiD? Hadde litt problemer med å bli kvitt "Iso Web Bags" mappene, men det ordnet jeg i sikkerhetsmodus... Ellers ser det ut som om problemet er [LØST] Tusen Takk! Lenke til kommentar
r2d290 Skrevet 22. oktober 2008 Rapporter Del Skrevet 22. oktober 2008 (endret) Du bør oppdatere Java Det er viktig å bruke den seneste versjonen av Java, siden tidligere versjoner kan inneholde sikkerhetshull som vil øke sansynligheten for at du blir infisert igjen. Det ser ut til at din verjson av Java er utdatert Oppdatere Java: Trykk på følgende link, og last ned nyeste versjon av Java:http://java.com/en/download/index.jsp [*]Gå til Start > Kontrollpanel > Legg til/fjern programmer. [*]Søk i listen over alle tidligere versjoner av Java (JRE, J2SE Runtime, J2RE osv.... ) Alle disse versjonene bør ha dette bildet foran: Velg alle du finner, og trykk på Fjern [*]Deretter installerer du den Java-versjonen som du lastet ned i starten. Fortell hvordan det gikk med oppdateringen, da problemer med oppdatering kan indikere flere malware på systemet ditt. AVINSTALLERE COMBOFIX: Start->kjør Skriv: combofix /u Dette vil avinstallere combofix, nullstille systemgjenoprettingsmappa m.m. -Surf trygt- Endret 22. oktober 2008 av r2d290 Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå