Kan noen se på denne loggen

[Sewero]

HJT:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 05:30:21, on 20.02.2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Creative\Shared Files\CTAudSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\DAODx.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe

C:\Program Files\InstallShield Installation Information\{3A94E148-9C8B-4FE9-99DD-93072F99BE20}\AMBSPISyncService.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\DOCUME~1\Rancerz\LOCALS~1\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\UltraMon\UltraMon.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\ASUS\EPU\EPU.exe

C:\WINDOWS\V0230Mon.exe

C:\Program Files\UltraMon\UltraMonTaskbar.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\EVEREST Ultimate Edition\everest.exe

C:\WINDOWS\system32\mmc.exe

C:\WINDOWS\system32\dmremote.exe

C:\WINDOWS\System32\dmadmin.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [RunDAOD] C:\WINDOWS\DAODx.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [CTSyncService] "C:\Program Files\InstallShield Installation Information\{3A94E148-9C8B-4FE9-99DD-93072F99BE20}\AMBSPISyncService.exe" /StartRunKey

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [ultraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [six Engine] "C:\Program Files\ASUS\EPU\EPU.exe" -r

O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\V0230Mon.exe

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Fences - {EC654325-1273-C2A9-2B7C-45A29BCE2FBD} - C:\Program Files\Stardock\Fences\DesktopDock.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Sound Blaster X-Fi MB Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe

 

--

End of file - 6811 bytes

 

 

MBAM kommer senere

[Sewero]

MBAM

 

Malwarebytes' Anti-Malware 1.44

Databaseversjon: 3765

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

 

20.02.2010 06:50:18

mbam-log-2010-02-20 (06-50-12).txt

 

Skanntype: Full Skann (C:\|E:\|F:\|I:\|L:\|)

Objekter skannet: 200418

Tid tilbakelagt: 1 hour(s), 11 minute(s), 45 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 15

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

C:\Documents and Settings\Rancerz\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> No action taken.

E:\System Volume Information\_restore{C3F6248C-780A-4DBF-9DD6-3C61FA6D4063}\RP390\A0125492.exe (Trojan.Horst) -> No action taken.

E:\System Volume Information\_restore{C3F6248C-780A-4DBF-9DD6-3C61FA6D4063}\RP390\A0125495.exe (Trojan.Horst) -> No action taken.

E:\System Volume Information\_restore{C3F6248C-780A-4DBF-9DD6-3C61FA6D4063}\RP390\A0125496.exe (Trojan.Agent) -> No action taken.

E:\System Volume Information\_restore{C3F6248C-780A-4DBF-9DD6-3C61FA6D4063}\RP390\A0125497.exe (Trojan.Agent) -> No action taken.

F:\Spill\sumotori.exe (Malware.Packer.Krunchy) -> No action taken.

F:\Installerings programmer\Adobe CS3 Cracks Mentalpen ipt release\Adobe.CS3.Design.Premium.Keygen_Activation\Adobe.CS3.Design.Premium.Keygen.exe (Trojan.Agent) -> No action taken.

F:\Installerings programmer\Adobe CS3 Cracks Mentalpen ipt release\Adobe.CS3.Web.Premium.Keygen_Activation\Adobe.Web.Premium.CS3.Keygen+Activation.exe (Trojan.Agent) -> No action taken.

F:\Installerings programmer\Adobe CS3 Cracks Mentalpen ipt release\DreamWeaver.CS3.Keygen_Activation\DreamWeaver.CS3.Keygen+Activation.exe (Trojan.Horst) -> No action taken.

F:\Installerings programmer\Adobe CS3 Cracks Mentalpen ipt release\PhotoShop.CS3.Extended.Keygen_Activation\PhotoShop.CS3.Extended.Keygen+Activation.exe (Trojan.Horst) -> No action taken.

I:\Adobe CS3 Cracks Mentalpen ipt release\Adobe.CS3.Design.Premium.Keygen_Activation\Adobe.CS3.Design.Premium.Keygen.exe (Trojan.Agent) -> No action taken.

I:\Adobe CS3 Cracks Mentalpen ipt release\Adobe.CS3.Web.Premium.Keygen_Activation\Adobe.Web.Premium.CS3.Keygen+Activation.exe (Trojan.Agent) -> No action taken.

I:\Adobe CS3 Cracks Mentalpen ipt release\DreamWeaver.CS3.Keygen_Activation\DreamWeaver.CS3.Keygen+Activation.exe (Trojan.Horst) -> No action taken.

I:\Adobe CS3 Cracks Mentalpen ipt release\PhotoShop.CS3.Extended.Keygen_Activation\PhotoShop.CS3.Extended.Keygen+Activation.exe (Trojan.Horst) -> No action taken.

C:\WINDOWS\explorer.backup (Heuristics.Reserved.Word.Exploit) -> No action taken.

 

[norbat]

Oppdater til SP3 og sjekk om de øvrige programmene er oppdatert

 

hjt-loggen ser grei ut.

[Sewero]

Det som er er at jeg får feil med kernel32.dll når jeg spiller wow.

Oppdatering til SP3 er rimelig uaktuelt da noen av pluginsene jeg bruker ikke lenger vil fungere.

[norbat]

Problemet oppstår kun ved wow?

 

Kernel-error kan skyldes så mye, så det er litt vanskelig å si noe bestemt hva som er problemet i dette tilfellet. Har du forsøkt å kjøre 'repair utility' i wow?

 

Du kunne også ha prøvd å kjøre kommandown sfc /scannow fra kjør-feltet (i xp). Dette vil sjekke om systemfilene er ok.

 

Har du sjekket for oppdateringer til skjermkort etc...?

[Sewero]

Det gjelder flere programmer, men det kommer bare opp kernel error når jeg kjører wow, de andre står det bare at det hender noe uventet.

 

Alle drivere er fullt oppgradert, skal prøve den metoden du sikter til nå.

[Sewero]

Den metoden du siktet til krever cd.