Laserbeam Skrevet 6. mai 2009 Rapporter Del Skrevet 6. mai 2009 Combofix logg: Klikk for å se/fjerne innholdet nedenfor ComboFix 09-05-05.04 - andrenilsen 06.05.2009 15:05.1 - NTFSx86 NETWORK Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.47.1044.18.2046.1366 [GMT 2:00] Kjører fra: c:\users\andrenilsen\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\install.exe c:\windows\nohh06760.exe . ((((((((((((((((((((((((((( Filer Opprettet Fra 2009-04-06 til 2009-05-06 ))))))))))))))))))))))))))))))))) . 2009-05-04 10:46 . 2009-05-06 12:57 -------- d-----w c:\programdata\Spybot - Search & Destroy 2009-05-04 10:46 . 2009-05-04 10:52 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-28 07:51 . 2009-04-28 07:51 -------- d-----w c:\programdata\Office Genuine Advantage 2009-04-26 22:46 . 2009-04-29 07:53 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys 2009-04-26 22:46 . 2009-04-26 22:46 -------- d-----w c:\programdata\Avira 2009-04-25 17:53 . 2009-04-25 17:53 -------- d-----w c:\program files\MSXML 4.0 2009-04-25 17:53 . 2009-04-25 17:53 -------- d-----w c:\program files\Common Files\Microsoft Games 2009-04-25 13:18 . 2009-04-25 13:18 -------- d-sh--w c:\users\postgres\Lokale innstillinger 2009-04-25 13:18 . 2009-04-25 13:18 -------- d-sh--w c:\users\postgres\Start-meny 2009-04-25 13:18 . 2009-04-25 13:18 -------- d-sh--w c:\users\postgres\Programdata 2009-04-25 13:18 . 2009-04-25 13:18 -------- d-sh--w c:\users\postgres\Mine dokumenter 2009-04-25 13:18 . 2006-11-02 11:18 -------- d--h--w c:\users\postgres\AppData 2009-04-25 13:18 . 2008-09-09 22:49 -------- d-----w c:\users\postgres\Documents 2009-04-25 13:18 . 2009-05-03 10:54 -------- d-----w c:\users\postgres 2009-04-25 09:41 . 2009-04-25 09:49 -------- d-----w c:\users\andrenilsen\AppData\Local\ArmA 2009-04-21 22:27 . 2009-04-21 22:27 -------- d-----w c:\users\andrenilsen\{b563c46b-2fcb-4c96-8d36-72c02ace9517} 2009-04-20 11:04 . 2009-04-20 11:04 -------- d-----w c:\users\andrenilsen\AppData\Local\{DD4E68DA-DBCD-4C1F-B85E-FF8A7BEBE383} 2009-04-19 18:04 . 2009-04-19 18:04 -------- d-----w c:\program files\QS 2009-04-19 18:03 . 2009-04-19 18:03 -------- d-----w c:\program files\TeamViewer 2009-04-19 15:57 . 2009-04-19 15:57 -------- d-----w c:\users\andrenilsen\AppData\Local\LogMeIn 2009-04-19 15:57 . 2009-04-19 15:57 -------- d-----w c:\programdata\LogMeIn 2009-04-19 15:56 . 2008-10-16 18:35 28984 ----a-w c:\windows\system32\LMIport.dll 2009-04-19 15:56 . 2008-10-16 18:35 83288 ----a-w c:\windows\system32\LMIRfsClientNP.dll 2009-04-19 15:56 . 2008-07-24 16:46 47640 ----a-w c:\windows\system32\drivers\LMIRfsDriver.sys 2009-04-19 15:56 . 2008-10-16 18:35 87352 ----a-w c:\windows\system32\LMIinit.dll 2009-04-17 06:59 . 2009-02-13 08:49 72704 ----a-w c:\windows\system32\secur32.dll 2009-04-16 12:42 . 2009-04-16 12:42 -------- d-----w c:\users\andrenilsen\AppData\Local\WindowsUpdate 2009-04-14 14:42 . 2009-04-14 14:42 -------- d-----w c:\users\andrenilsen\AppData\Roaming\dvdcss 2009-04-13 18:10 . 2009-04-13 18:32 -------- d-----w c:\users\andrenilsen\AppData\Roaming\Xfire 2009-04-13 18:10 . 2009-04-13 18:33 -------- d-----w c:\programdata\Xfire 2009-04-13 16:51 . 2009-04-13 16:51 -------- d-sh--w c:\windows\ftpcache 2009-04-13 02:42 . 2009-04-13 02:42 -------- d-----w C:\ProgrammerSpeedFan 2009-04-13 00:45 . 2009-04-13 02:42 -------- d-----w c:\users\andrenilsen\AppData\Roaming\Clickteam 2009-04-13 00:43 . 2009-04-13 00:43 -------- d-----w c:\windows\system32\Clickteam 2009-04-12 18:07 . 2009-04-12 18:07 56 ---ha-w c:\windows\system32\ezsidmv.dat 2009-04-12 18:07 . 2009-04-17 05:51 -------- d-----w c:\users\andrenilsen\AppData\Roaming\skypePM 2009-04-12 18:05 . 2009-04-17 05:51 -------- d-----w c:\users\andrenilsen\AppData\Roaming\Skype 2009-04-12 18:05 . 2009-04-12 18:05 -------- d-----w c:\program files\Common Files\Skype 2009-04-12 18:05 . 2009-04-12 18:05 -------- d-----r c:\program files\Skype 2009-04-11 16:50 . 2009-04-11 16:50 -------- d-----w c:\program files\BitBank 2009-04-11 10:39 . 2009-04-11 10:39 -------- d-----w C:\CrashReport 2009-04-10 23:25 . 2009-04-10 23:27 -------- d-----w c:\users\andrenilsen\AppData\Roaming\vlc 2009-04-10 12:15 . 2009-04-10 12:15 -------- d-----w C:\sw3dg 2009-04-09 18:03 . 2007-05-10 22:19 350208 ----a-w c:\windows\system32\d3drm.dll 2009-04-08 19:00 . 2009-04-08 19:00 -------- d-----w c:\program files\Borland 2009-04-08 19:00 . 2001-11-05 07:30 165376 ----a-w c:\windows\UNWISE.EXE 2009-04-08 18:00 . 2009-04-08 19:01 -------- d-----w C:\mapdata 2009-04-08 13:47 . 2009-04-08 13:47 -------- d-----w c:\program files\Microsoft XNA 2009-04-07 18:55 . 2009-04-07 18:55 -------- d-----w c:\programdata\Trymedia 2009-04-07 18:14 . 2009-04-07 18:14 -------- d-----w c:\program files\ReflexiveArcade 2009-04-07 18:12 . 2007-05-12 15:12 688416 ----a-w c:\windows\system32\wodHttp.dll 2009-04-07 18:12 . 2003-12-14 09:47 692224 ----a-w c:\windows\system32\ciaResSvr20.dll 2009-04-07 18:12 . 2003-02-23 17:45 40960 ----a-w c:\windows\system32\ciaSubClsSvr.dll 2009-04-07 18:12 . 2003-12-12 10:41 53248 ----a-w c:\windows\system32\ciaXPRegSvr20.dll 2009-04-07 11:29 . 2009-04-07 11:29 -------- d-----w c:\users\andrenilsen\efcnsimulatorfiles 2009-04-07 11:24 . 2009-04-07 11:29 -------- d-----w c:\users\andrenilsen\efcnfiles . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-06 13:00 . 2008-12-03 15:25 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-05-06 09:14 . 2008-09-10 08:12 836 ----a-w c:\windows\bthservsdp.dat 2009-05-06 08:48 . 2008-12-31 12:03 235057 ----a-w c:\programdata\nvModes.dat 2009-05-05 10:55 . 2006-11-21 05:16 589286 ----a-w c:\windows\system32\perfh014.dat 2009-05-05 10:55 . 2006-11-21 05:16 126308 ----a-w c:\windows\system32\perfc014.dat 2009-05-04 13:48 . 2007-06-22 09:22 -------- d-----w c:\program files\Google 2009-05-04 10:50 . 2009-01-16 00:06 -------- d-----w c:\program files\VOIPlay 2009-05-04 10:49 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infpub.dat 2009-05-04 10:49 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstor.dat 2009-05-04 10:49 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstrng.dat 2009-05-03 10:05 . 2009-02-24 17:11 -------- d-----w c:\program files\FileZilla FTP Client 2009-04-28 10:33 . 2008-09-10 11:47 14638 ----a-w c:\users\andrenilsen\AppData\Roaming\wklnhst.dat 2009-04-26 11:43 . 2008-09-12 07:08 7592 ----a-w c:\users\andrenilsen\AppData\Local\d3d9caps.dat 2009-04-25 22:46 . 2008-09-09 23:06 96376 ----a-w c:\users\andrenilsen\AppData\Local\GDIPFONTCACHEV1.DAT 2009-04-25 17:53 . 2007-06-22 08:31 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-25 13:25 . 2006-11-02 12:37 -------- d-----w c:\program files\Microsoft Games 2009-04-25 09:38 . 2008-09-13 10:52 413696 ----a-w c:\windows\system32\wrap_oal.dll 2009-04-25 09:38 . 2008-09-13 10:52 110592 ----a-w c:\windows\system32\OpenAL32.dll 2009-04-18 01:25 . 2008-09-12 07:00 -------- d-----w c:\program files\Microsoft Silverlight 2009-04-18 01:02 . 2007-06-22 09:08 -------- d-----w c:\program files\Microsoft Works 2009-04-17 07:35 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail 2009-04-13 17:25 . 2009-02-01 00:26 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-04-13 17:25 . 2009-02-01 00:26 22328 ----a-w c:\users\andrenilsen\AppData\Roaming\PnkBstrK.sys 2009-04-13 17:25 . 2009-02-01 00:26 103736 ----a-w c:\windows\system32\PnkBstrB.exe 2009-04-13 17:25 . 2009-02-01 00:26 66872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-04-10 01:28 . 2008-09-21 10:44 34 ----a-w c:\users\andrenilsen\jagex_runescape_preferences.dat 2009-04-07 09:31 . 2009-03-26 19:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-06 22:44 . 2008-10-04 13:47 -------- d-----w c:\program files\Common Files\Steam 2009-04-06 13:32 . 2009-03-26 19:05 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 13:32 . 2009-03-26 19:05 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-05 16:27 . 2009-04-05 16:26 -------- d--h--w c:\program files\Zero G Registry 2009-04-04 17:16 . 2009-04-04 17:16 -------- d-----w c:\program files\Logitech 2009-04-04 17:16 . 2008-11-22 20:19 -------- d-----w c:\program files\Common Files\Logitech 2009-03-29 10:50 . 2009-02-05 17:29 -------- d-----w c:\program files\Pando Networks 2009-03-28 18:29 . 2009-03-28 18:29 603904 ----a-w c:\windows\system32\TUProgSt.exe 2009-03-28 18:29 . 2009-03-28 18:29 360192 ----a-w c:\windows\system32\TuneUpDefragService.exe 2009-03-28 13:10 . 2009-03-28 13:10 -------- d-----w c:\programdata\YSFLIGHT.COM 2009-03-27 10:40 . 2009-03-27 10:40 -------- d-----w c:\program files\DIFX 2009-03-26 21:40 . 2009-03-26 21:40 -------- d-----w c:\program files\OpenOffice.org 3 2009-03-26 19:17 . 2009-03-26 19:16 -------- d-----w c:\program files\QuickTime 2009-03-26 19:11 . 2008-10-03 16:21 410984 ----a-w c:\windows\system32\deploytk.dll 2009-03-26 19:11 . 2007-06-22 09:50 -------- d-----w c:\program files\Java 2009-03-24 11:28 . 2008-12-03 09:47 -------- d-----w c:\program files\MSECache 2009-03-20 22:59 . 2008-09-10 17:01 -------- d-----w c:\program files\Common Files\Adobe 2009-03-20 22:26 . 2009-03-20 22:26 41808 ----a-w c:\windows\system32\xfcodec.dll 2009-03-19 22:36 . 2009-03-19 22:36 -------- d-----w c:\program files\Common Files\GtFlashSwitch 2009-03-17 03:38 . 2009-04-17 06:59 13824 ----a-w c:\windows\system32\apilogen.dll 2009-03-17 03:38 . 2009-04-17 06:59 24064 ----a-w c:\windows\system32\amxread.dll 2009-03-15 17:58 . 2009-03-15 17:58 -------- d-----w c:\program files\K-Lite Codec Pack 2009-03-15 17:57 . 2008-10-20 09:47 -------- d-----w c:\program files\DivX 2009-03-15 17:52 . 2009-03-15 17:52 -------- d-----w c:\program files\VideoLAN 2009-03-09 08:04 . 2008-12-13 22:07 43520 ----a-w c:\windows\system32\CmdLineExt03.dll 2009-03-03 04:46 . 2009-04-17 07:00 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-03-03 04:46 . 2009-04-17 07:00 3547632 ----a-w c:\windows\system32\ntoskrnl.exe 2009-03-03 04:40 . 2009-04-17 06:59 827392 ----a-w c:\windows\system32\wininet.dll 2009-03-03 04:39 . 2009-04-17 07:00 183296 ----a-w c:\windows\system32\sdohlp.dll 2009-03-03 04:39 . 2009-04-17 07:00 551424 ----a-w c:\windows\system32\rpcss.dll 2009-03-03 04:39 . 2009-04-17 07:00 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll 2009-03-03 04:37 . 2009-04-17 06:59 78336 ----a-w c:\windows\system32\ieencode.dll 2009-03-03 04:37 . 2009-04-17 07:00 98304 ----a-w c:\windows\system32\iasrecst.dll 2009-03-03 04:37 . 2009-04-17 07:00 54784 ----a-w c:\windows\system32\iasads.dll 2009-03-03 04:37 . 2009-04-17 07:00 44032 ----a-w c:\windows\system32\iasdatastore.dll 2009-03-03 03:04 . 2009-04-17 07:00 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe 2009-03-03 02:38 . 2009-04-17 07:00 17408 ----a-w c:\windows\system32\iashost.exe 2009-03-03 02:28 . 2009-04-17 06:59 26624 ----a-w c:\windows\system32\ieUnatt.exe 2009-02-16 21:20 . 2009-02-01 00:25 2246144 ----a-w c:\windows\system32\pbsvc.exe 2009-02-13 08:49 . 2009-04-17 07:00 1255936 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 18:56 . 2009-03-15 17:58 67584 ----a-w c:\windows\system32\ff_vfw.dll 2009-02-09 03:10 . 2009-03-12 07:18 2033152 ----a-w c:\windows\system32\win32k.sys 2008-12-23 02:32 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini 2006-05-03 09:06 . 2008-10-20 21:54 163328 --sh--r c:\windows\System32\flvDX.dll 2007-02-21 10:47 . 2008-10-20 21:54 31232 --sh--r c:\windows\System32\msfDX.dll 2008-03-16 12:30 . 2008-10-20 21:54 216064 --sh--r c:\windows\System32\nbDX.dll . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-04-06 401040] "avgnt"="c:\programmer\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "GrpConv"="grpconv -o" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Mobilt Kontor.lnk] backup=c:\windows\pss\Mobilt Kontor.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PASPortal.lnk] backup=c:\windows\pss\PASPortal.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^andrenilsen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk] backup=c:\windows\pss\Air Mouse.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^andrenilsen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk] backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^andrenilsen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe] backup=c:\windows\pss\PowerReg Scheduler V3.exe.Startup backupExtension=.Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskSuite HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mapdisk HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "CollaborationHost"=c:\windows\system32\p2phost.exe -s "ehTray.exe"=c:\windows\ehome\ehTray.exe "RegistryMechanic"=c:\programmer\Registry Mechanic\rmtray.exe /H "Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Start WingMan Profiler"=c:\program files\Logitech\Gaming Software\LWEMon.exe /noui [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{8E91A1DF-932D-4E39-8789-A3C767595E68}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{D92D1A50-E7D9-4D85-AEAE-748E5D6553A8}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play "{712AB7A2-EEC2-46C6-AE72-0B0882FCD9AD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{490F5E7A-7E3D-4709-9367-1795E46FC25E}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{D4AE342A-4224-4304-B692-C2922738149C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{3C2AA57B-D3BE-4E35-B871-53581590E02E}"= UDP:c:\programmer\iTunes\iTunes.exe:iTunes "{2419D92F-8C1F-4220-A16C-E8F026101DF1}"= TCP:c:\programmer\iTunes\iTunes.exe:iTunes "TCP Query User{13FD6CAB-B520-4B02-AAD0-3D1FB70667E4}c:\\users\\andrenilsen\\documents\\c#\\computer biz\\build\\server.exe"= UDP:c:\users\andrenilsen\documents\c#\computer biz\build\server.exe:server.exe "UDP Query User{57FFB5E3-CB82-4F4F-9F6B-C7A9A37A300C}c:\\users\\andrenilsen\\documents\\c#\\computer biz\\build\\server.exe"= TCP:c:\users\andrenilsen\documents\c#\computer biz\build\server.exe:server.exe "TCP Query User{772CFD57-8B0D-430D-AE03-66B30A9B42EE}c:\\users\\andrenilsen\\documents\\c#\\computer biz\\server\\bin\\debug\\server.vshost.exe"= UDP:c:\users\andrenilsen\documents\c#\computer biz\server\bin\debug\server.vshost.exe:server.vshost.exe "UDP Query User{8786ADDA-30B2-423C-8AB2-FED006D8EB24}c:\\users\\andrenilsen\\documents\\c#\\computer biz\\server\\bin\\debug\\server.vshost.exe"= TCP:c:\users\andrenilsen\documents\c#\computer biz\server\bin\debug\server.vshost.exe:server.vshost.exe "TCP Query User{FB0E196E-7D4C-4034-B6A3-ACD461F8B144}c:\\python25\\pythonw.exe"= UDP:c:\python25\pythonw.exe:pythonw "UDP Query User{1B45CC80-15E5-469F-813C-1A2D7323A23A}c:\\python25\\pythonw.exe"= TCP:c:\python25\pythonw.exe:pythonw "{CFAE801B-C914-42F0-975F-4BB48167C91B}"= UDP:c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe:VideoAccelerator "{35EFAF3B-3A29-49AD-AF29-2FDACA9B7841}"= TCP:c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe:VideoAccelerator "{EE326FEF-5CCD-4BD3-B114-E96A499ED112}"= UDP:c:\spill\Minions of Mirth\bin\MinionsOfMirth.exe:MinionsOfMirth "{CE29958F-E473-4E50-B632-CC05BF5FA505}"= TCP:c:\spill\Minions of Mirth\bin\MinionsOfMirth.exe:MinionsOfMirth "TCP Query User{4416AE9F-A24A-4210-ADAA-6D864A3C3810}c:\\spill\\steam\\steamapps\\andrenilsen\\counter-strike source\\hl2.exe"= UDP:c:\spill\steam\steamapps\andrenilsen\counter-strike source\hl2.exe:hl2 "UDP Query User{34347368-ADA4-4826-B45B-F267AD7A7E67}c:\\spill\\steam\\steamapps\\andrenilsen\\counter-strike source\\hl2.exe"= TCP:c:\spill\steam\steamapps\andrenilsen\counter-strike source\hl2.exe:hl2 "TCP Query User{1F97B156-C445-4D4B-80DC-A27656CC754D}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper "UDP Query User{6BC10CC5-F63A-4EA2-963C-5F14746ECB41}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper "{3DBAC4AE-3CED-468C-BA46-AE2EB8DC2854}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{A1E998C1-2579-4B41-B12F-5555125D57E2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D45BF025-5A61-409F-8EC9-24EE41122989}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{F8D32512-897E-47CB-A85E-50A0A126D6CB}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{82A2CA31-D950-4F49-973D-2BC86EE5239B}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{2C90975E-7284-480B-A019-2AA7427FDB43}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{5CDF9EDD-BBBC-4FDB-BED4-A2D8245EBB5F}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{36FD2BA0-962D-40DC-AA1B-3F5D1214FBFE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{5012B229-F128-42C4-9C75-80603F5A38A1}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{0D61992C-326A-4F26-9D4E-7D13FB5380A9}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{70C30661-E009-40ED-B223-4ED8B2D4A3FC}"= c:\program files\Microsoft XNA\XNA Game Studio\v3.0\Bin\XnaLiveProxy.exe:XNA Framework Games for Windows - LIVE "{C4445BBF-B59C-430C-A12F-B644E2C4DEEC}"= c:\program files\Skype\Phone\Skype.exe:Skype "{855E8927-8AF4-4CDE-9A44-D7FA8E7E00D0}"= UDP:c:\spill\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare "{34DFC278-2DB6-43EC-8393-2690F8AAD48D}"= TCP:c:\spill\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare "{46F15515-E527-4854-87F0-55CA7A323128}"= UDP:c:\spill\ArmA\arma.exe:ArmA "{A8B4D955-2CBC-4D9A-9794-BD9B4A7C1E6A}"= TCP:c:\spill\ArmA\arma.exe:ArmA [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\System32\drivers\hssdrv.sys [03.02.2009 13:21 31192] R3 wtsmpadap;Sesam Virtual Adapter;c:\windows\System32\drivers\wtsmpadap.sys [29.04.2008 16:24 39720] R3 WtSmpFlt;Sesam Adapter;c:\windows\System32\drivers\wtsmpflt.sys [29.04.2008 16:24 272424] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programmer\Avira\AntiVir Desktop\sched.exe [27.04.2009 00:46 108289] S2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [09.02.2007 15:48 176128] S2 LMIInfo;LogMeIn Kernel Information Provider;c:\programmer\LogMeIn\x86\rainfo.sys [24.07.2008 18:46 12856] S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [19.04.2009 17:56 47640] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [26.03.2009 21:05 179856] S2 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [06.11.2007 22:22 34064] S2 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11.07.2008 02:28 369688] S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [28.03.2009 20:29 603904] S3 chdrvr01;CH Control Manager Driver 1;c:\windows\System32\drivers\chdrvr01.sys [04.04.2009 19:26 216544] S3 chdrvr02;CH Control Manager Driver 2;c:\windows\System32\drivers\chdrvr02.sys [04.04.2009 19:26 9568] S3 chdrvr03;chdrvr03;c:\windows\System32\drivers\chdrvr03.sys [04.04.2009 19:26 13152] S3 GTFFBUS;GT FF BUS;c:\windows\System32\drivers\gtffbus.sys [14.04.2007 05:05 17152] S3 GTMM Device Service;GTMM Device Service;c:\program files\Telenor\Mobile Broadband\GtmmDeviceService.exe [02.07.2008 15:32 106496] S3 GTMNDISIRPXP;___980628625500412031216292125237204114599;c:\windows\System32\drivers\Gtm51Irp.sys [14.04.2007 05:05 122496] S3 GTPTSER;GT PT SER;c:\windows\System32\drivers\gtptser.sys [14.04.2007 05:05 8064] S3 GTUQBUS;GT UQ BUS;c:\windows\System32\drivers\gtuqbus.sys [14.04.2007 05:06 37120] S3 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [26.03.2009 21:05 15504] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\System32\drivers\PPJoyBus.sys [23.01.2004 16:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\System32\drivers\PPortJoy.sys [23.01.2004 16:32 28800] S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\System32\drivers\teamviewervpn.sys [25.01.2008 11:12 25088] S3 WMSvc;Webbehandlingstjeneste;c:\windows\System32\inetsrv\WMSvc.exe [12.09.2008 08:18 11264] S4 gupdate1c99c5bad501462;Google Update Service (gupdate1c99c5bad501462);c:\program files\Google\Update\GoogleUpdate.exe [04.03.2009 01:56 133104] S4 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [27.01.2009 21:15 93656] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.07.2008 02:28 47128] S4 RsFx0102;RsFx0102 Driver;c:\windows\System32\drivers\RsFx0102.sys [10.07.2008 02:49 242712] S4 SesamService;Sesam Control Service;c:\program files\Telenor\Mobile Broadband\Sesam\BIN\SecMIPService.exe [09.05.2008 17:01 1216296] S4 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \shell\AutoRun\command - E:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \shell\AutoRun\command - F:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - g:\.\start.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1373492e-7ebd-11dd-bede-806e6f6e6963}] \shell\AutoRun\command - F:\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0dff9b8-7fe2-11dd-a46b-001b24961397}] \shell\AutoRun\command - e:\.\start.bat . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) 2009-05-06 c:\windows\Tasks\1-Click Maintenance.job - c:\programmer\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36] 2009-05-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 23:56] 2009-04-25 c:\windows\Tasks\Registry Winner Schedule.job - c:\programmer\Registry Winner\RegistryWinner.exe [2009-04-17 09:58] . - - - - TOMME PEKERE FJERNET - - - - HKLM-RunOnce-<NO NAME> - (no file) Notify-WBSrv - (no file) . ------- Tilleggsskanning ------- . mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NB_NO&c=73&bd=Pavilion&pf=laptop uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s FF - ProfilePath - c:\users\andrenilsen\AppData\Roaming\Mozilla\Firefox\Profiles\xhkm46km.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www9.yoog.com/search.php?q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.no/ FF - prefs.js: keyword.URL - hxxp://www9.yoog.com/search.php?q= FF - component: c:\program files\Google\Google Gears\Firefox\components\gears.dll FF - component: c:\programmer\Mozilla Firefox\components\501647c3-d56e-c1ce-458d-bd76d732167b.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: c:\program files\VOIPlay\npvoiplay.dll FF - plugin: c:\programdata\id Software\QuakeLive\npquakezero.dll FF - plugin: c:\programmer\iTunes\Mozilla Plugins\npitunes.dll FF - plugin: c:\programmer\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\programmer\Mozilla Firefox\plugins\npcnc32.dll FF - plugin: c:\programmer\Mozilla Firefox\plugins\npDXStudioPlugin.dll FF - plugin: c:\users\andrenilsen\AppData\Roaming\Mozilla\Firefox\Profiles\xhkm46km.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll FF - plugin: c:\users\andrenilsen\AppData\Roaming\Mozilla\Firefox\Profiles\xhkm46km.default\extensions\[email protected]\plugins\npRACtrl.dll FF - plugin: c:\windows\system32\Clickteam\Vitalize\v4\npcnc32.dll ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: browser.search.defaultenginename - Yoog Search FF - user.js: browser.search.defaulturl - hxxp://www9.yoog.com/search.php?q= FF - user.js: browser.search.selectedEngine - Yoog Search FF - user.js: keyword.URL - hxxp://www9.yoog.com/search.php?q= FF - user.js: keyword.enabled - true c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-06 15:10 Windows 6.0.6001 Service Pack 1 NTFS skanner skjulte prosesser ... skanner skjulte autostart-oppføringer ... skanner skjulte filer ... ************************************************************************** . --------------------- LÅSTE REGISTERNØKLER --------------------- [HKEY_USERS\S-1-5-21-680071005-499610910-1366418288-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9661E2E3-DE2A-0CC2-D1C2-FA981E1BED67}*] "hakhenebmicinaij"=hex:69,61,63,70,6f,6b,69,67,68,63,70,61,69,63,6e,6b,61,70, 00,00 "iaiionjpoccbddamlh"=hex:69,61,63,70,6f,6b,69,67,68,63,70,61,69,63,6e,6b,61,70, 00,6b [HKEY_USERS\S-1-5-21-680071005-499610910-1366418288-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:d5,a4,0f,0d,9b,e6,91,ac,af,f0,e6,98,da,4b,ed,bf,14,ef,8c,1a,9a,d7,c0, 9a,a6,bb,c3,5d,89,01,50,f2,b2,06,63,8e,20,14,d5,e2,b8,bd,4e,1b,d9,f6,8b,4a,\ "??"=hex:d2,9e,98,3f,79,6d,1c,1c,e5,58,05,9e,e5,08,2b,cf [HKEY_USERS\S-1-5-21-680071005-499610910-1366418288-1000\Software\SecuROM\License information*] "datasecu"=hex:23,97,52,74,b6,c3,e5,ce,b9,a9,a0,6c,4c,13,2e,d0,81,50,1d,f2,ab, c7,58,dd,54,3f,71,e0,3b,3a,d5,17,1c,74,8f,17,34,33,68,85,61,7e,99,48,87,bb,\ "rkeysecu"=hex:a8,f9,19,6a,94,30,c0,d7,73,6a,d3,9c,62,1a,88,6f [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Tidspunkt ferdig: 2009-05-06 15:13 ComboFix-quarantined-files.txt 2009-05-06 13:11 Pre-Run: Finner ikke meldingstekst for melding nummer 0x2379 i meldingsfilen for Application. Post-Run: 49 259 831 296 byte ledig 378 --- E O F --- 2009-05-06 08:04 Lenke til kommentar
snippsat Skrevet 6. mai 2009 Rapporter Del Skrevet 6. mai 2009 (endret) Loggen ser bra ut,combofix slettet 2 filer. Når det gjelder "yoog Search" ligger den i "user.js" Den kan du slette eller fjerne den linjen med "yoog Search" Edit:samme med "prefs.js" http://kb.mozillazine.org/Resetting_preferences If you find a user.js file, open it in a text editor such as Notepad and remove any unwanted entries, or simply remove the user.js file from the profile folder. This will allow you to reset the associated options or preference settings, either through the Options or Preferences dialogs, or in about:config. Mulig CCleaner gjør dette og. Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc. Sjekk om software er oppdatert Secunia Surf trygt. Endret 6. mai 2009 av SNIPPSAT Lenke til kommentar
Laserbeam Skrevet 6. mai 2009 Forfatter Rapporter Del Skrevet 6. mai 2009 Det funket desverre ikke. Jeg kjørte ccleaner, etter at jeg sletta filene. Kjørte deretter en registry cleaner. Men den bare kommer tilbake. Lenke til kommentar
snippsat Skrevet 6. mai 2009 Rapporter Del Skrevet 6. mai 2009 http://sbritown.altervista.org/yoogkilling.html Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå