Hjelp med HijackThis log

[Felander]

Hei!

Kan noen hjelpe meg med en HijackThis log fil? Prosessoren kjører ofte for fullt, det som tar mye ressurser er "System - NT Kernel & system".

 

Her er loggen:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:29:54, on 05.01.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Norman\Npm\Bin\Elogsvc.exe

C:\Program Files\Norman\Ngs\Bin\Nprosec.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Norman\Npm\Bin\Zanda.exe

C:\Program Files\Norman\npm\bin\nvoy.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Norman\npf\bin\npfsvc32.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe

C:\Program Files\Norman\Npm\Bin\Nvcsched.exe

C:\Program Files\Norman\Npm\Bin\Njeeves.exe

C:\Program Files\Norman\npc\bin\npcsvc32.exe

C:\Program Files\Norman\nse\bin\NSESVC.EXE

C:\Program Files\Norman\npc\bin\nuaa.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Norman\Nvc\Bin\nvcoas.exe

C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Norman\npf\bin\npfuser.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\HP\QuickPlay\QPService.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Norman\Npm\Bin\Zlh.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Norman\Nvc\Bin\Nip.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Norman\Nvc\Bin\cclaw.exe

C:\Windows\system32\Taskmgr.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\notepad.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\DllHost.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH

O4 - HKLM\..\Run: [NPCTray] C:\Program Files\Norman\npc\bin\npc_tray.exe /LOAD

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETTVERKSTJENESTE')

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O9 - Extra button: Blogg dette - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blogg dette i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O10 - Unknown file in Winsock LSP: c:\program files\norman\npc\bin\nlf.dll

O13 - Gopher Prefix:

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - http://support.f-secure.com/enu/home/onlin.../fshc/fscax.cab

O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: Automatisk LiveUpdate-planlegging - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe

O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Elogsvc.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\Bin\Njeeves.exe

O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe

O23 - Service: Norman Parental Control (NPC) - Norman ASA - C:\Program Files\Norman\npc\bin\npcsvc32.exe

O23 - Service: Norman Personal Firewall Service (NPFSvc32) - Norman ASA - C:\Program Files\Norman\npf\bin\npfsvc32.exe

O23 - Service: Norman Security service (NPROSECSVC) - Norman ASA - C:\Program Files\Norman\Ngs\Bin\Nprosec.exe

O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE

O23 - Service: Norman User Activity Agent (NUAA) - Norman ASA - C:\Program Files\Norman\npc\bin\nuaa.exe

O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\Bin\nvcoas.exe

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Nvcsched.exe

O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

 

--

End of file - 12133 bytes

 

 

Takk på forhånd.

[snippsat]

Ser greit ut,kan kjøre litt til så vi er sikker.

Før vi går videre og ser på prosessforbruk.

 

Last ned MBAM til skrivebordet.

Velg Norsk språkdrakt-->kjør hurtig systemskann.

Når MBAM er ferdig åpner den en logg,den poster du.

 

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

[Tallyho]

Det er ihvertfall mye som KAN fjernes på maskinen din. Mye reklame og programmer som ikke er strengt tatt nødvendige.

[Felander]

Ser greit ut,kan kjøre litt til så vi er sikker.

Før vi går videre og ser på prosessforbruk.

 

Last ned MBAM til skrivebordet.

Velg Norsk språkdrakt-->kjør hurtig systemskann.

Når MBAM er ferdig åpner den en logg,den poster du.

 

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

 

SNIPPSAT: Takk for hurtig svar.

MBAM fant ingenting.

Logg:

Malwarebytes' Anti-Malware 1.32

Databaseversjon: 1624

Windows 6.0.6001 Service Pack 1

 

05.01.2009 17:28:35

mbam-log-2009-01-05 (17-28-35).txt

 

Skanntype: Rask Skann

Objekter skannet: 50024

Tid tilbakelagt: 10 minute(s), 54 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

Combifix log

ComboFix 09-01-05.05 - Linda 2009-01-05 17:36:38.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1044.18.1982.1034 [GMT 1:00]

Kjører fra: c:\users\Linda\Desktop\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

* Resident AV is active

 

.

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-12-05 til 2009-01-05 )))))))))))))))))))))))))))))))))

.

 

2009-01-05 17:09 . 2009-01-05 17:09 <DIR> d-------- c:\users\Linda\AppData\Roaming\Malwarebytes

2009-01-05 17:09 . 2009-01-05 17:09 <DIR> d-------- c:\users\All Users\Malwarebytes

2009-01-05 17:09 . 2009-01-05 17:09 <DIR> d-------- c:\programdata\Malwarebytes

2009-01-05 17:09 . 2009-01-05 17:09 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-05 17:09 . 2009-01-04 18:39 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2009-01-05 17:09 . 2009-01-04 18:39 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2009-01-05 14:21 . 2009-01-05 14:21 <DIR> d-------- c:\program files\Trend Micro

2008-12-31 01:38 . 2008-12-31 01:38 <DIR> d-------- c:\users\Linda\AppData\Roaming\GRETECH

2008-12-31 01:37 . 2008-12-31 01:37 <DIR> d-------- c:\program files\GRETECH

2008-12-31 01:23 . 2008-12-31 01:23 <DIR> d-------- C:\Movies

2008-12-31 01:09 . 2008-05-16 11:28 212,024 --a------ c:\windows\System32\nscrnsav.scr

2008-12-31 01:09 . 2008-02-07 12:12 79,752 --a------ c:\windows\System32\drivers\ndis_rd.sys

2008-12-31 01:09 . 2008-02-07 12:12 74,624 --a------ c:\windows\System32\drivers\tdi_rd.sys

2008-12-31 01:09 . 2008-04-16 12:57 42,552 --a------ c:\windows\System32\drivers\ale_nf.sys

2008-12-31 01:09 . 2008-09-02 12:48 19,512 --a------ c:\windows\System32\drivers\nvcv32mf.sys

2008-12-31 01:08 . 2009-01-05 11:16 <DIR> d-------- c:\program files\Norman

2008-12-31 01:05 . 2008-12-31 01:05 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-12-30 01:33 . 2008-12-30 01:33 <DIR> d-------- c:\program files\Real

2008-12-30 01:33 . 2008-12-30 01:33 <DIR> d-------- c:\program files\Common Files\xing shared

2008-12-30 01:33 . 2008-12-30 01:33 <DIR> d-------- c:\program files\Common Files\Real

2008-12-29 21:29 . 2008-04-26 09:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys

2008-12-29 21:29 . 2008-04-12 04:32 784,896 --a------ c:\windows\System32\rpcrt4.dll

2008-12-29 21:29 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll

2008-12-29 21:29 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll

2008-12-29 21:29 . 2008-04-05 02:21 72,192 --a------ c:\windows\System32\drivers\pacer.sys

2008-12-29 21:29 . 2008-04-05 04:34 15,360 --a------ c:\windows\System32\pacerprf.dll

2008-12-29 20:49 . 2008-12-29 20:49 <DIR> d-------- C:\PerfLogs

2008-12-28 16:04 . 2008-12-28 16:10 <DIR> d-------- c:\users\Linda\AppData\Roaming\BonkEnc

2008-12-28 16:04 . 2008-12-28 16:04 <DIR> d-------- c:\program files\BonkEnc

2008-12-21 15:48 . 2008-12-21 15:47 410,984 --a------ c:\windows\System32\deploytk.dll

2008-12-12 22:12 . 2008-12-31 00:53 <DIR> d-------- c:\program files\Windows Live Toolbar

2008-12-12 22:11 . 2008-12-12 22:11 <DIR> d-------- c:\program files\Microsoft SQL Server Compact Edition

2008-12-12 22:11 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\System32\d3dx9_32.dll

2008-12-12 22:04 . 2008-12-19 03:01 <DIR> d-------- c:\program files\Windows Live

2008-12-12 22:04 . 2008-12-12 22:05 <DIR> d--hsc--- c:\program files\Common Files\WindowsLiveInstaller

2008-12-12 03:03 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll

2008-12-11 15:18 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll

2008-12-11 15:18 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll

2008-12-11 15:18 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-05 14:37 1,108 ----a-w c:\users\Linda\AppData\Roaming\wklnhst.dat

2008-12-31 01:51 --------- d-----w c:\program files\SUPERAntiSpyware

2008-12-30 23:59 --------- d-----w c:\program files\Google

2008-12-30 23:51 --------- d-----w c:\program files\Panda Security

2008-12-30 23:51 --------- d-----w c:\program files\Common Files\Symantec Shared

2008-12-30 23:50 --------- d-----w c:\programdata\Symantec

2008-12-29 20:05 174 --sha-w c:\program files\desktop.ini

2008-12-29 19:52 --------- d-----w c:\program files\Windows Sidebar

2008-12-29 19:52 --------- d-----w c:\program files\Windows Photo Gallery

2008-12-29 19:52 --------- d-----w c:\program files\Windows Mail

2008-12-29 19:52 --------- d-----w c:\program files\Windows Journal

2008-12-29 19:52 --------- d-----w c:\program files\Windows Collaboration

2008-12-29 19:52 --------- d-----w c:\program files\Windows Calendar

2008-12-29 19:51 --------- d-----w c:\program files\Windows Defender

2008-12-29 19:16 82,432 ----a-w c:\windows\System32\axaltocm.dll

2008-12-29 19:16 101,888 ----a-w c:\windows\System32\ifxcardm.dll

2008-12-25 05:07 --------- d-----w c:\programdata\Roxio

2008-12-25 01:01 --------- d-----w c:\users\Linda\AppData\Roaming\LimeWire

2008-12-21 14:47 --------- d-----w c:\program files\Java

2008-12-13 02:02 --------- d-----w c:\program files\Microsoft Works

2008-12-12 21:02 --------- d-----w c:\programdata\WLInstaller

2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll

2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll

2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll

2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll

2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll

2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe

2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll

2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll

2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll

2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll

2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe

2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll

2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll

2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll

2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll

2008-10-16 13:08 162,064 ----a-w c:\windows\System32\wuwebv.dll

2008-10-16 12:56 31,232 ----a-w c:\windows\System32\wuapp.exe

2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]

"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-31 1830128]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]

"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-21 136600]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-16 8429568]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-16 81920]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-30 185872]

"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]

"NPCTray"="c:\program files\Norman\npc\bin\npc_tray.exe" [2007-09-17 126008]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]

Hurtigstart for Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-31 02:51 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.divxa32"= msaud32_divx.acm

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{B697112B-8531-48D1-83DA-3DAC84E5994C}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{DCBAC8EA-59ED-4F31-9A8C-EA3870D5E86B}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play

"{E8DA8B11-27CA-4359-AF59-9C1404AB2572}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program

"{9CE0E886-8DA0-4CF5-9775-E961766875B4}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{10410A5A-875D-44C0-B8CE-D0F31A2EFC71}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{9C8184ED-CA48-4E5F-AD31-106E8CE60CFD}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

 

R1 ALE_NF;Norman Firewall ALE driver;c:\windows\System32\drivers\ale_nf.sys [2008-12-31 42552]

R1 NPROSEC;Norman Security driver;c:\program files\Norman\Ngs\Bin\nprosec.sys [2008-12-31 53816]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-05-28 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-05-28 55024]

R3 NPC;Norman Parental Control;c:\program files\Norman\Npc\Bin\npcsvc32.exe [2008-12-31 416880]

R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-12-31 322616]

R3 NUAA;Norman User Activity Agent;c:\program files\Norman\Npc\Bin\nuaa.exe [2008-12-31 117816]

R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-12-31 19512]

R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\nvc\bin\Nvcoas.exe [2008-12-31 191544]

R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2008-12-31 154680]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-05-28 7408]

R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2008-12-31 20448]

R4 NPFSvc32;Norman Personal Firewall Service;c:\program files\Norman\Npf\Bin\npfsvc32.exe [2008-12-31 597104]

R4 NPROSECSVC;Norman Security service;c:\program files\Norman\Ngs\Bin\nprosec.exe [2008-12-31 121912]

R4 NVOY;Norman's Very Own supplY of resources;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-12-31 121912]

S4 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]

 

--- Other Services/Drivers In Memory ---

 

*Deregistered* - mchInjDrv

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c4379d1-d3b7-11dd-a9af-001b2489bba3}]

\shell\AutoRun\command - G:\start.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8e7471a-b2cc-11dc-989b-001b2489bba3}]

\shell\AutoRun\command - F:\LaunchU3.exe -a

.

- - - - TOMME PEKERE FJERNET - - - -

 

HKLM-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALuNotify.exe

 

 

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.facebook.com/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NB_NO&c=73&bd=Pavilion&pf=laptop

LSP: c:\program files\Norman\npc\bin\nlf.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-05 17:45:27

Windows 6.0.6001 Service Pack 1 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'Explorer.exe'(1060)

c:\program files\Norman\nvc\bin\Niphk.dll

.

Tidspunkt ferdig: 2009-01-05 17:50:06

ComboFix-quarantined-files.txt 2009-01-05 16:49:58

 

Pre-Run: 73 668 349 952 byte ledig

Post-Run: 73,905,635,328 byte ledig

 

195 --- E O F --- 2009-01-05 11:23:54

 

Tallyho:

Hvilke programmer anb. du å fjerne?

[snippsat]

Ser greit ut.

 

Last ned Process explorer

 

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser "svar ja til og reparere" --> backup svar ja når du blir spørt.

Kjør register-renser et par ganger til alle feil er borte.

 

Restart.

Start nå kun process explorer,trykk på cpu-fane så prosess forbruk kommer øverst post et skjermbilde.

[Felander]

Ser greit ut.

 

Last ned Process explorer

 

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser "svar ja til og reparere" --> backup svar ja når du blir spørt.

Kjør register-renser et par ganger til alle feil er borte.

 

Restart.

Start nå kun process explorer,trykk på cpu-fane så prosess forbruk kommer øverst post et skjermbilde.

 

Har gjor anbefalte prosesser. Fortsatt høyt cpu forbruk

[snippsat]

[Felander]

 

Forsto ikke helt hvilke jeg evt skulle fjerne. Men takk for hjelpen.

Trur jeg heller tar en format og reinstall.

[snippsat]

Du skulle fjerne noe man bruker process explorer for og finne hva som lager høyt cpu-foruk.

Når man har funnet grunne da gjør man de tiltak som trengs.