Gå til innhold

paba

Medlemmer
  • Innlegg

    88
  • Ble med

  • Besøkte siden sist

Innlegg skrevet av paba

  1. De sender den nok avgårde til et verksted. Tiden fra du leverer til du får den tilbake kan vare opptil 2 uker. Er ikke sikker på prisen på en slik reperasjon.

     

    Om du er usikker om du fikk med alt innholdet er det to "lette" metoder jeg vanligvis selv bruker når disken ikke booter systemet.

    - Sett disken inn i en annen PC og få tilgang til den via "Min Datamaskin" (Sørg for at PCn ikke starter fra disken du ønsker å hente innhold fra)

     

    - Kjøp en dockingstasjon.

    https://www.komplett.no/icy-box-ib-122cl-u3-docking-station/815972

    Denne er kanskje overkill, men 8 av 11 disker jeg har montert i dette produktet har jeg fått tilgang til.

    Som nevnt av Sogndal94 kan det være en del IKT-elever som kan hjelpe deg med dette.

     

    EDIT: Om du har produktnummeret til maskinen så kan dette spare deg for litt frustrasjon.

    Tok på meg en jobb her forleden hvor BIOS-passordet på nettopp en HP-laptop var på et eget kretskort. Eieren viste ikke, vanlige prosedyrer fungerte ikke. Med andre ord så fikk jeg ikke innstalert windows på nytt. Etter 12 timer på suspekte sider, mye whiskey og mye banning ordnet det seg.

     

     

     

    Produktnummer tror jeg er: XF476EA

    Model: G62-460SO

  2.  

     

     

    Min HP bærbare pc krasjer når jeg prøver å starte denne. Har prøvd oppstartsreparasjon, men dette virker ikke. Prøvde også en Start Up Test, og får da dette resultatet:

    Memory test: PASSED

    SMART Check: PASSED

    Short DST: FAILED

     

    Har også forsøkt å starte i sikker modus, men det samme skjer da.

     

    Hva kan feilen være? Jeg er ikke ekspert på data, så det beste er kanskje å levere den til et PC-verksted?

    Short DST: FAILED = Diskfeil.

    Du må få skifta harddisk / SSD og reinstallert OS.

     

    Ok. Er en slik jobb dyr? Hvor får en gjort slik?

    Kanskje det lønner seg å kjøpe ny pc i stedet?

     

    Eg har ikkje benytta med at private konsulentar før, men med ein timepris på 700-1500 timen, kan det bli dyrt. Eg kan anbefale å tak kontakt med nærmaste IKT-Klasse / Skule, kansje dei har ei elevbedrift eller skifter den gratis / billigare om du kjem med ein ny disk( for erfaring).

     

     

    Hadde egentlig tenkt å gå til Elkjøp her, men vet ikke hvor gode de er til slikt. Bor i Gjøvik-området.

     

    Hvis det er feil på harddisk, hvordan får jeg tak i det jeg har lagret på pc? Tror jeg fikk tatt sikkerhetskopi av innholdet, det var et av valgene en kunne gjøre for å forsøke å reparere pc, reinstallere eller sikkerhetskopiere.

  3.  

    Min HP bærbare pc krasjer når jeg prøver å starte denne. Har prøvd oppstartsreparasjon, men dette virker ikke. Prøvde også en Start Up Test, og får da dette resultatet:

    Memory test: PASSED

    SMART Check: PASSED

    Short DST: FAILED

     

    Har også forsøkt å starte i sikker modus, men det samme skjer da.

     

    Hva kan feilen være? Jeg er ikke ekspert på data, så det beste er kanskje å levere den til et PC-verksted?

    Short DST: FAILED = Diskfeil.

    Du må få skifta harddisk / SSD og reinstallert OS.

     

    Ok. Er en slik jobb dyr? Hvor får en gjort slik?

    Kanskje det lønner seg å kjøpe ny pc i stedet?

  4. Min HP bærbare pc krasjer når jeg prøver å starte denne. Har prøvd oppstartsreparasjon, men dette virker ikke. Prøvde også en Start Up Test, og får da dette resultatet:

    Memory test: PASSED

    SMART Check: PASSED

    Short DST: FAILED

     

    Har også forsøkt å starte i sikker modus, men det samme skjer da.

     

    Hva kan feilen være? Jeg er ikke ekspert på data, så det beste er kanskje å levere den til et PC-verksted?

  5. Internett fungerer via ledning i normalmodus, hverfall en stund. Hvis en prøver å åpne et annet program så låser maskinen seg.

     

    Jeg har tatt backup av all data vi har lagt inn på maskinen, som bilder, filmer, dokumenter mm.

     

    Hvilke programmer som krever/har lisens for å bruke, er jeg mer usikker på. Tror kanskje ikke det er mer enn windows office som krever lisens, som er installert. Jeg har boksen med installasjons-cd og veiledning, så en burde vel der kunne se hvordan en legger det inn etter gjenoppretting. Det finnes kanskje programmer som scanner maskinen og finner de programmene en har installert som har lisensnøkler?

     

    Av alternativene du nevner så er jeg fortsatt litt usikker på hva jeg vil gjøre, men jeg begynner å bli litt lei av å bruke mye mer tid på det.

     

    Hva ville du gjort i mitt tilfelle? Er det noe poeng i å konsultere et annet forum, i såfall hvilket?

     

    Hva gjør drweb-programmet?

  6. HitmanPro log:

     

     

     

    HitmanPro 3.6.1.164
    [url="http://www.hitmanpro.com"]www.hitmanpro.com[/url]
      Computer name . . . . : ANNEGRETE-HP
      Windows . . . . . . . : 6.1.0.7600.X64/4
      Safe Mode Boot  . . . : NETWORK
      User name . . . . . . : AnneGrete-HP\Anne Grete
      UAC . . . . . . . . . : Disabled
      License . . . . . . . : Free
      Scan date . . . . . . : 2012-09-26 00:04:39
      Scan mode . . . . . . : Normal
      Scan duration . . . . : 2m 58s
      Disk access mode  . . : Direct disk access (SRB)
      Cloud . . . . . . . . : Internet
      Reboot  . . . . . . . : No
      Threats . . . . . . . : 0
      Traces  . . . . . . . : 5
      Objects scanned . . . : 1 450 432
      Files scanned . . . . : 23 190
      Remnants scanned  . . : 399 133 files / 1 028 109 keys
    Cookies _____________________________________________________________________
      C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:ads.vg.no
      C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:adtech.de
      C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:track.adform.net
      C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:tradedoubler.com
      C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:xiti.com
    
    

     

     

     

     

     

    Nå blir det kvelden her.

  7. Den sto i ca. 20 min. Har restartet og det ser ut som det er RKreport på skrivebordet.

     

    Her er den:

     

     

    RogueKiller V8.0.5 [09/23/2012] by Tigzy

    mail: tigzyRK&--#60;at&--#62;gmail&--#60;dot&--#62;com

    Feedback: http://www.geekstogo...13-roguekiller/

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7600 ) 64 bits version

    Started in : Normal mode

    User : Anne Grete [Admin rights]

    Mode : Scan -- Date : 09/25/2012 23:23:58

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 4 ¤¤¤

    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -&--#62; FOUND

    [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -&--#62; FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -&--#62; FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -&--#62; FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ Extern Hives: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --&--#62; C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost

     

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: ST9500325AS +++++

    --- User ---

    [MBR] bd3dc5a6fb49a56a5e69dde1c187c713

    [bSP] eb6424d021e273e63ea2eda688d3dcc9 : Windows Vista/7 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 455286 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 932835328 | Size: 21350 Mo

    3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 976560128 | Size: 103 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : &--#60;&--#60; RKreport[1].txt &--#62;&--#62;

    RKreport[1].txt

     

     

     

     

    aswMBR log:

     

     

     

    aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software

    Run date: 2012-09-25 23:54:24

    -----------------------------

    23:54:24.982 OS Version: Windows x64 6.1.7600

    23:54:24.982 Number of processors: 4 586 0x2505

    23:54:24.998 ComputerName: ANNEGRETE-HP UserName: Anne Grete

    23:54:26.043 Initialize success

    23:54:51.440 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

    23:54:51.440 Disk 0 Vendor: ST950032 0005 Size: 476940MB BusType: 3

    23:54:51.455 Disk 0 MBR read successfully

    23:54:51.471 Disk 0 MBR scan

    23:54:51.471 Disk 0 unknown MBR code

    23:54:51.533 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048

    23:54:51.533 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 455286 MB offset 409600

    23:54:51.580 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 21350 MB offset 932835328

    23:54:51.596 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128

    23:54:51.642 Disk 0 scanning C:\Windows\system32\drivers

    23:55:00.956 Service scanning

    23:55:19.582 Modules scanning

    23:55:19.582 Disk 0 trace - called modules:

    23:55:19.645 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

    23:55:19.645 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bc6060]

    23:55:19.660 3 CLASSPNP.SYS[fffff88001b4e43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004939050]

    23:55:19.660 Scan finished successfully

    23:56:17.255 Disk 0 MBR has been saved successfully to "F:\Ny mappe (2)\MBR.dat"

    23:56:17.255 The log file has been saved successfully to "F:\Ny mappe (2)\aswMBR.txt"

     

     

  8. Her er combofix-log. Den gjorde seg ferdig i løpet av natta.

     

     

     

    ComboFix 12-09-24.02 - Anne Grete 24.09.2012 22:21:44.9.4 - x64 NETWORK

    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.47.1044.18.3958.3229 [GMT 2:00]

    Kjører fra: c:\users\Anne Grete\Desktop\ComboFix.exe

    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Opprettet nytt gjenopprettingspunkt

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\windows\system32\Services.exe . . . er infisert!!

    .

    .

    ((((((((((((((((((((((((((( Filer Opprettet Fra 2012-08-24 til 2012-09-24 )))))))))))))))))))))))))))))))))

    .

    .

    2012-09-24 21:36 . 2012-09-24 21:36 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-09-20 14:46 . 2012-09-20 14:46 -------- d-----w- c:\program files\HitmanPro

    2012-09-20 14:45 . 2012-09-20 14:45 -------- d-----w- c:\programdata\HitmanPro

    2012-09-20 02:01 . 2012-09-20 02:02 -------- d-----w- C:\FRST

    2012-09-15 19:54 . 2009-07-14 01:39 328704 ----a-w- c:\windows\SysWow64\services.exe

    2012-09-15 06:29 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-09-10 19:20 . 2012-09-10 19:20 -------- d-----w- c:\users\Anne Grete\AppData\Roaming\Malwarebytes

    2012-09-10 19:20 . 2012-09-10 19:20 -------- d-----w- c:\programdata\Malwarebytes

    2012-09-10 19:20 . 2012-09-16 20:48 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    2012-09-10 18:56 . 2012-09-10 18:56 -------- d-----w- c:\users\Anne Grete\AppData\Roaming\SUPERAntiSpyware.com

    2012-09-10 18:56 . 2012-09-18 18:25 -------- d-----w- c:\program files\SUPERAntiSpyware

    2012-09-10 18:56 . 2012-09-10 18:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

    2012-09-08 18:33 . 2012-09-11 19:13 -------- d-----w- c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}

    2012-09-05 12:30 . 2012-09-05 12:30 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-09-05 12:30 . 2012-08-22 13:10 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-09-05 12:30 . 2010-10-23 11:21 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-08-23 18:52 . 2012-08-23 12:03 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-08-23 18:52 . 2011-07-14 07:55 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-07-30 11:32 . 2012-07-30 11:32 203104 ----a-w- c:\windows\system32\drivers\ssudmdm.sys

    2012-07-18 17:31 . 2012-08-14 17:57 3146752 ----a-w- c:\windows\system32\win32k.sys

    2012-07-06 20:06 . 2012-08-15 20:21 552448 ----a-w- c:\windows\system32\drivers\bthport.sys

    2012-07-06 20:06 . 2012-08-15 20:21 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS

    2012-07-04 22:04 . 2012-08-14 17:57 73216 ----a-w- c:\windows\system32\netapi32.dll

    2012-07-04 22:01 . 2012-08-14 17:57 58880 ----a-w- c:\windows\system32\browcli.dll

    2012-07-04 22:01 . 2012-08-14 17:57 136704 ----a-w- c:\windows\system32\browser.dll

    2012-07-04 21:23 . 2012-08-14 17:57 41472 ----a-w- c:\windows\SysWow64\browcli.dll

    2012-06-29 04:55 . 2012-08-15 20:19 17809920 ----a-w- c:\windows\system32\mshtml.dll

    2012-06-29 04:09 . 2012-08-15 20:19 10925568 ----a-w- c:\windows\system32\ieframe.dll

    2012-06-29 03:56 . 2012-08-15 20:19 2312704 ----a-w- c:\windows\system32\jscript9.dll

    2012-06-29 03:49 . 2012-08-15 20:19 1346048 ----a-w- c:\windows\system32\urlmon.dll

    2012-06-29 03:49 . 2012-08-15 20:19 1392128 ----a-w- c:\windows\system32\wininet.dll

    2012-06-29 03:48 . 2012-08-15 20:19 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

    2012-06-29 03:47 . 2012-08-15 20:19 237056 ----a-w- c:\windows\system32\url.dll

    2012-06-29 03:45 . 2012-08-15 20:19 85504 ----a-w- c:\windows\system32\jsproxy.dll

    2012-06-29 03:44 . 2012-08-15 20:19 816640 ----a-w- c:\windows\system32\jscript.dll

    2012-06-29 03:43 . 2012-08-15 20:19 173056 ----a-w- c:\windows\system32\ieUnatt.exe

    2012-06-29 03:42 . 2012-08-15 20:19 2144768 ----a-w- c:\windows\system32\iertutil.dll

    2012-06-29 03:40 . 2012-08-15 20:19 96768 ----a-w- c:\windows\system32\mshtmled.dll

    2012-06-29 03:39 . 2012-08-15 20:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb

    2012-06-29 03:35 . 2012-08-15 20:19 248320 ----a-w- c:\windows\system32\ieui.dll

    2012-06-29 00:16 . 2012-08-15 20:19 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

    2012-06-29 00:09 . 2012-08-15 20:19 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

    2012-06-29 00:08 . 2012-08-15 20:19 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

    2012-06-29 00:04 . 2012-08-15 20:19 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

    2012-06-29 00:00 . 2012-08-15 20:19 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

    .

    .

    ------- Sigcheck -------

    Note: Unsigned files aren't necessarily malware.

    .

    Cryptography Services Error !!

    .

    (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]

    "NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-01-10 1083264]

    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-09-06 5663616]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]

    "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

    "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

    "Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-08-30 61112]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

    "EnableShellExecuteHooks"= 1 (0x1)

    .

    [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

    @=""

    .

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

    R2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]

    R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-09-09 203264]

    R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

    R2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

    R2 gupdate;Google-oppdatering-tjenesten (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 136176]

    R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

    R2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]

    R2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680]

    R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432]

    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936]

    R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

    R2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392]

    R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

    R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920]

    R3 84520207;84520207; [x]

    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-23 250056]

    R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-09-09 7767552]

    R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-09-09 279040]

    R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]

    R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-09-29 31088]

    R3 cxbu0x64;OMNIKEY 3x21;c:\windows\system32\DRIVERS\cxbu0x64.sys [2011-09-06 177920]

    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-05-11 99384]

    R3 gupdatem;Google-oppdatering-tjenesten (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 136176]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928]

    R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]

    R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2011-11-01 12800]

    R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2011-11-01 171008]

    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-05-07 245792]

    R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

    R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

    R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

    R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

    R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-29 1255736]

    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]

    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]

    S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

    S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2010-09-11 1014624]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-23 347680]

    .

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

    2010-08-16 21:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

    .

    Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

    .

    2012-09-24 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-23 18:52]

    .

    2012-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 06:46]

    .

    2012-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 06:46]

    .

    2012-09-07 c:\windows\Tasks\HPCeeScheduleForAnne Grete.job

    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

    .

    2012-09-04 c:\windows\Tasks\HPCeeScheduleForANNEGRETE-HP$.job

    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

    .

    2012-09-18 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 71fa4109-7868-477d-ad8a-908d347e106a.job

    - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

    .

    2012-09-18 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task d75f531b-4e49-4c12-9cd2-fd3808b8949e.job

    - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

    @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

    [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

    2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

    @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

    [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

    2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

    @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

    [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

    2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

    @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

    [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

    2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

    @="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

    [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

    2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-09-22 6489704]

    "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

    .

    ------- Tilleggsskanning -------

    .

    uStart Page = about:blank

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    TCP: DhcpNameServer = 192.168.0.1

    FF - ProfilePath - c:\users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\

    FF - prefs.js: network.proxy.type - 0

    .

    .

    --------------------- LÅSTE REGISTERNØKLER ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker4"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Tidspunkt ferdig: 2012-09-24 23:39:01

    ComboFix-quarantined-files.txt 2012-09-24 21:39

    ComboFix2.txt 2012-09-18 15:01

    ComboFix3.txt 2012-09-16 08:33

    .

    Pre-Run: 408 324 378 624 byte ledig

    Post-Run: 408 168 415 232 byte ledig

    .

    - - End Of File - - 56E8E2BF41BFAB5C0AFF892510E8BB44

     

     

     

×
×
  • Opprett ny...