Har jeg malware?

[Enya]

Symptom: Sender ut pakker når den er koblet til internett.

 

MBAM

Klikk for å se/fjerne innholdet nedenfor

Malwarebytes' Anti-Malware 1.36

Databaseversjon: 1988

Windows 5.1.2600 Service Pack 3

 

16.04.2009 08:08:13

mbam-log-2009-04-16 (08-08-13).txt

 

Skanntype: Rask Skann

Objekter skannet: 69129

Tid tilbakelagt: 3 minute(s), 39 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

HJT

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:18:08, on 16.04.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\Programfiler\NetLimiter 2 Pro\nlsvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Programfiler\Google\Update\GoogleUpdate.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Programfiler\Microsoft Office\Office12\GrooveMonitor.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\DAEMON Tools Lite\daemon.exe

C:\Programfiler\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Programfiler\Realtek\8187SE Wireless LAN Utility\RtWLan.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Programfiler\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Programfiler\Malwarebytes' Anti-Malware\mbam.exe

C:\Programfiler\Java\jre6\bin\jusched.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Programfiler\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.msi.com.tw/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programfiler\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programfiler\FlashFXP\IEFlash.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programfiler\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MGSysCtrl] C:\Programfiler\System Control Manager\MGSysCtrl.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programfiler\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Bluetooth Manager.lnk = ?

O4 - Global Startup: REALTEK RTL8187SE Wireless LAN Utility.lnk = C:\Programfiler\Realtek\8187SE Wireless LAN Utility\RtWLan.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.msi.com.tw

O15 - Trusted Zone: http://asia.msi.com.tw

O15 - Trusted Zone: http://global.msi.com.tw

O15 - Trusted Zone: http://www.msi.com.tw

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programfiler\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: Googles oppdateringstjeneste (gupdate1c9aa1df861930c) (gupdate1c9aa1df861930c) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe

O23 - Service: Micro Star SCM - Unknown owner - C:\Programfiler\System Control Manager\MSIService.exe (file missing)

O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Pro\nlsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Programfiler\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

 

--

End of file - 7941 bytes

Combofix

Klikk for å se/fjerne innholdet nedenfor

ComboFix 09-04-16.02 - Jørgen 16.04.2009 8:13.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.47.1044.18.2037.1537 [GMT 2:00]

Kjører fra: c:\documents and settings\Jørgen\Skrivebord\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

 

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

.

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2009-03-16 til 2009-04-16 )))))))))))))))))))))))))))))))))

.

 

2009-04-16 06:03 . 2009-04-16 06:03 -------- d-----w c:\windows\LastGood

2009-04-11 13:03 . 2009-04-11 13:03 -------- d-----w c:\documents and settings\Jørgen\Programdata\Locktime

2009-04-11 13:03 . 2009-04-11 13:03 -------- d-----w c:\documents and settings\Jørgen\Programdata\Locktime

2009-04-11 13:03 . 2009-04-11 13:03 -------- d-----w c:\documents and settings\Jørgen\Programdata\Locktime

2009-04-11 12:45 . 2009-04-11 12:45 -------- d-----w c:\documents and settings\All Users\Programdata\Locktime

2009-04-11 12:45 . 2009-04-11 12:45 -------- d-----w c:\programfiler\NetLimiter 2 Pro

2009-04-09 14:00 . 2009-04-09 14:00 -------- d-----w c:\programfiler\Advanced IP Scanner

2009-04-05 15:23 . 2009-04-05 15:23 -------- d-----w c:\programfiler\WinISD

2009-03-23 10:13 . 2009-03-23 10:13 -------- d-----w c:\documents and settings\NetworkService\Lokale innstillinger\Programdata\Google

2009-03-21 12:10 . 2009-03-21 12:10 -------- d-----w c:\documents and settings\LocalService\Lokale innstillinger\Programdata\Google

2009-03-21 12:09 . 2009-03-23 20:20 -------- d-----w c:\documents and settings\Jørgen\Lokale innstillinger\Programdata\Google

2009-03-21 12:09 . 2009-04-16 05:57 -------- d-----w c:\documents and settings\All Users\Programdata\Google Updater

2009-03-21 12:09 . 2009-03-21 12:11 -------- d-----w c:\programfiler\Google

2009-03-19 21:18 . 2009-03-19 21:18 -------- d-----w C:\_Diverse

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-16 06:05 . 2008-10-16 20:08 -------- d-----w c:\programfiler\Java

2009-04-16 06:03 . 2009-01-22 15:05 -------- d-----w c:\programfiler\Malwarebytes' Anti-Malware

2009-04-16 05:55 . 2008-06-12 15:55 72104 ----a-w c:\windows\system32\perfc014.dat

2009-04-16 05:55 . 2008-06-12 15:55 407662 ----a-w c:\windows\system32\perfh014.dat

2009-04-13 20:57 . 2008-10-16 20:11 -------- d-----w c:\documents and settings\Jørgen\Programdata\LimeWire

2009-04-13 20:57 . 2008-10-16 20:11 -------- d-----w c:\documents and settings\Jørgen\Programdata\LimeWire

2009-04-13 20:57 . 2008-10-16 20:11 -------- d-----w c:\documents and settings\Jørgen\Programdata\LimeWire

2009-04-11 16:27 . 2009-03-08 14:13 -------- d-----w c:\documents and settings\Jørgen\Programdata\Spotify

2009-04-11 16:27 . 2009-03-08 14:13 -------- d-----w c:\documents and settings\Jørgen\Programdata\Spotify

2009-04-11 16:27 . 2009-03-08 14:13 -------- d-----w c:\documents and settings\Jørgen\Programdata\Spotify

2009-04-09 14:25 . 2008-08-08 16:21 -------- d-----w c:\documents and settings\Jørgen\Programdata\uTorrent

2009-04-09 14:25 . 2008-08-08 16:21 -------- d-----w c:\documents and settings\Jørgen\Programdata\uTorrent

2009-04-09 14:25 . 2008-08-08 16:21 -------- d-----w c:\documents and settings\Jørgen\Programdata\uTorrent

2009-04-06 13:32 . 2009-01-22 15:05 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-06 13:32 . 2009-01-22 15:05 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-03-13 09:35 . 2009-03-13 09:35 -------- d-----w c:\programfiler\Microsoft

2009-03-13 09:34 . 2009-03-13 09:34 -------- d-----w c:\programfiler\Windows Live SkyDrive

2009-03-13 09:34 . 2008-08-08 11:30 -------- d-----w c:\programfiler\Windows Live

2009-03-13 09:32 . 2009-03-13 09:32 -------- d-----w c:\programfiler\Fellesfiler\Windows Live

2009-03-11 23:21 . 2008-06-12 08:52 -------- d-----w c:\documents and settings\All Users\Programdata\Microsoft Help

2009-03-09 03:19 . 2008-12-06 12:18 410984 ----a-w c:\windows\system32\deploytk.dll

2009-03-08 14:13 . 2009-03-08 14:13 -------- d-----w c:\programfiler\Spotify

2009-02-25 17:39 . 2009-02-25 17:39 -------- d-----w c:\documents and settings\All Users\Programdata\Office Genuine Advantage

2009-02-20 20:41 . 2008-08-30 22:14 -------- d-----w c:\documents and settings\All Users\Programdata\TrackMania

2009-02-15 19:43 . 2009-02-15 19:43 -------- d-----w c:\programfiler\Lavalys

2009-02-15 18:28 . 2008-06-12 08:01 -------- d-----w c:\programfiler\System Control Manager

2009-02-15 18:19 . 2008-06-12 07:43 -------- d--h--w c:\programfiler\InstallShield Installation Information

2009-02-15 16:34 . 2008-09-30 16:04 -------- d-----w c:\programfiler\DB

2009-02-09 14:08 . 2008-06-12 15:55 1846784 ----a-w c:\windows\system32\win32k.sys

2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows\system32\sirenacm.dll

2009-01-07 20:13 . 2009-01-07 20:13 130 ----a-w c:\documents and settings\Jørgen\Lokale innstillinger\Programdata\fusioncache.dat

2008-10-23 13:40 . 2008-08-30 22:26 68456 ----a-w c:\documents and settings\Jørgen\Lokale innstillinger\Programdata\GDIPFONTCACHEV1.DAT

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]

"DAEMON Tools Lite"="c:\programfiler\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

"swg"="c:\programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-21 39408]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-20 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-20 159744]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-20 131072]

"SynTPEnh"="c:\programfiler\Synaptics\SynTP\SynTPEnh.exe" [2008-01-12 1028096]

"ITSecMng"="c:\programfiler\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]

"GrooveMonitor"="c:\programfiler\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"QuickTime Task"="c:\programfiler\QuickTime\QTTask.exe" [2008-09-06 413696]

"iTunesHelper"="c:\programfiler\iTunes\iTunesHelper.exe" [2008-10-01 289576]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"MGSysCtrl"="c:\programfiler\System Control Manager\MGSysCtrl.exe" [2008-10-09 688128]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-08 16862208]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

Bluetooth Manager.lnk - c:\programfiler\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-2-22 2938184]

REALTEK RTL8187SE Wireless LAN Utility.lnk - c:\programfiler\Realtek\8187SE Wireless LAN Utility\RtWLan.exe [2008-9-5 880640]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= c:\progra~1\FELLES~1\ULEADS~1\vio\dvacm.acm

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programfiler\\uTorrent\\uTorrent.exe"=

"c:\\Programfiler\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=

"c:\\Programfiler\\Realtek\\8187SE Wireless LAN Utility\\RtWLan.exe"=

"c:\\Programfiler\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Documents and Settings\\Jørgen\\Skrivebord\\Diverse\\WD Discovery Software\\WD Discovery.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"c:\\Programfiler\\FlashFXP\\FlashFXP.exe"=

"c:\\Programfiler\\LimeWire\\LimeWire.exe"=

"c:\\Documents and Settings\\Jørgen\\Skrivebord\\Diverse\\TmNationsForever\\TmForever.exe"=

"c:\\Programfiler\\Spotify\\spotify.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot

"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot

 

R2 gupdate1c9aa1df861930c;Googles oppdateringstjeneste (gupdate1c9aa1df861930c);c:\programfiler\Google\Update\GoogleUpdate.exe [2009-03-21 133104]

R2 Micro Star SCM;Micro Star SCM; [x]

R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\programfiler\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-02-04 26224]

R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2008-11-18 7808]

R3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl.sys [2008-10-01 32000]

S1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [2007-04-23 82200]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-04-06 38496]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys [2008-06-11 156160]

S3 rtl8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\DRIVERS\rtl8187Se.sys [2008-08-22 308608]

 

 

--- Andre tjenester/drivere lastet i minnet ---

 

*NewlyCreated* - JAVAQUICKSTARTERSERVICE

*NewlyCreated* - MBAMSWISSARMY

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8cd5d22e-7b50-11dd-914a-001d92c7a17a}]

\Shell\AutoRun\command - E:\SETUP.EXE

\Shell\configure\command - E:\SETUP.EXE

\Shell\install\command - E:\SETUP.EXE

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

 

2009-04-16 c:\windows\Tasks\Google Software Updater.job

- c:\programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-21 12:09]

 

2009-04-16 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\programfiler\Google\Update\GoogleUpdate.exe [2009-03-21 12:09]

.

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.msi.com.tw

uInternet Connection Wizard,ShellNext = hxxp://www.msi.com.tw/

uInternet Settings,ProxyOverride = *.local

IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: com.tw\asia.msi

Trusted Zone: com.tw\global.msi

Trusted Zone: com.tw\www.msi

DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab

FF - ProfilePath - c:\documents and settings\Jørgen\Programdata\Mozilla\Firefox\Profiles\r9v34ft9.default\

FF - plugin: c:\programfiler\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\programfiler\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\programfiler\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\programfiler\Vizky\npVizky.dll

.

 

**************************************************************************

 

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-16 08:16

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\programfiler\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'explorer.exe'(3936)

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Tidspunkt ferdig: 2009-04-16 8:17

ComboFix-quarantined-files.txt 2009-04-16 06:17

ComboFix2.txt 2009-04-09 14:31

 

Pre-Run: 34 081 214 464 byte ledig

Post-Run: 34 081 308 672 byte ledig

 

171 --- E O F --- 2009-03-15 22:52

[Bruker-158599]

Hva mener du med "sender ut pakker"?