Hjelp til å rette opp feilmelding 1067 og 1068

[paba]

Da prøver jeg combofix en gang til. Det tar vel fort litt tid denne gangen også...

[paba]

Får igjen samme feilmelding etter Fullført Niva_50.

 

Mens jeg venter på at combofix kjører ferdig har jeg et spørsmål om reinstallering.

 

Er det mulig å bruke opp igjen Office-lisensen jeg har?

[mobile999]

Det kan fort ta litt tid ja. Det er fint om du kan ta tiden (hvis mulig). I mellomtiden kan du evt. laste ned fra drweb, hvis du ikke ønsker å forsøke gjenoppretting av windows (bare husk backup først).

 

ops.

 

Ja det skal være mulig å bruke Office lisensen en gang til. Det skal også finnes en måte å ta backup av lisensen slik at du slipper "reaktivering".

[paba]

Her er combofix-log. Den gjorde seg ferdig i løpet av natta.

 

 

 

ComboFix 12-09-24.02 - Anne Grete 24.09.2012 22:21:44.9.4 - x64 NETWORK

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.47.1044.18.3958.3229 [GMT 2:00]

Kjører fra: c:\users\Anne Grete\Desktop\ComboFix.exe

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Opprettet nytt gjenopprettingspunkt

.

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\Services.exe . . . er infisert!!

.

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2012-08-24 til 2012-09-24 )))))))))))))))))))))))))))))))))

.

.

2012-09-24 21:36 . 2012-09-24 21:36 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-09-20 14:46 . 2012-09-20 14:46 -------- d-----w- c:\program files\HitmanPro

2012-09-20 14:45 . 2012-09-20 14:45 -------- d-----w- c:\programdata\HitmanPro

2012-09-20 02:01 . 2012-09-20 02:02 -------- d-----w- C:\FRST

2012-09-15 19:54 . 2009-07-14 01:39 328704 ----a-w- c:\windows\SysWow64\services.exe

2012-09-15 06:29 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-10 19:20 . 2012-09-10 19:20 -------- d-----w- c:\users\Anne Grete\AppData\Roaming\Malwarebytes

2012-09-10 19:20 . 2012-09-10 19:20 -------- d-----w- c:\programdata\Malwarebytes

2012-09-10 19:20 . 2012-09-16 20:48 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-09-10 18:56 . 2012-09-10 18:56 -------- d-----w- c:\users\Anne Grete\AppData\Roaming\SUPERAntiSpyware.com

2012-09-10 18:56 . 2012-09-18 18:25 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-09-10 18:56 . 2012-09-10 18:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2012-09-08 18:33 . 2012-09-11 19:13 -------- d-----w- c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}

2012-09-05 12:30 . 2012-09-05 12:30 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-05 12:30 . 2012-08-22 13:10 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-09-05 12:30 . 2010-10-23 11:21 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-08-23 18:52 . 2012-08-23 12:03 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-23 18:52 . 2011-07-14 07:55 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-30 11:32 . 2012-07-30 11:32 203104 ----a-w- c:\windows\system32\drivers\ssudmdm.sys

2012-07-18 17:31 . 2012-08-14 17:57 3146752 ----a-w- c:\windows\system32\win32k.sys

2012-07-06 20:06 . 2012-08-15 20:21 552448 ----a-w- c:\windows\system32\drivers\bthport.sys

2012-07-06 20:06 . 2012-08-15 20:21 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS

2012-07-04 22:04 . 2012-08-14 17:57 73216 ----a-w- c:\windows\system32\netapi32.dll

2012-07-04 22:01 . 2012-08-14 17:57 58880 ----a-w- c:\windows\system32\browcli.dll

2012-07-04 22:01 . 2012-08-14 17:57 136704 ----a-w- c:\windows\system32\browser.dll

2012-07-04 21:23 . 2012-08-14 17:57 41472 ----a-w- c:\windows\SysWow64\browcli.dll

2012-06-29 04:55 . 2012-08-15 20:19 17809920 ----a-w- c:\windows\system32\mshtml.dll

2012-06-29 04:09 . 2012-08-15 20:19 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-06-29 03:56 . 2012-08-15 20:19 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-06-29 03:49 . 2012-08-15 20:19 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-06-29 03:49 . 2012-08-15 20:19 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-06-29 03:48 . 2012-08-15 20:19 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-06-29 03:47 . 2012-08-15 20:19 237056 ----a-w- c:\windows\system32\url.dll

2012-06-29 03:45 . 2012-08-15 20:19 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-06-29 03:44 . 2012-08-15 20:19 816640 ----a-w- c:\windows\system32\jscript.dll

2012-06-29 03:43 . 2012-08-15 20:19 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-06-29 03:42 . 2012-08-15 20:19 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-06-29 03:40 . 2012-08-15 20:19 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-06-29 03:39 . 2012-08-15 20:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-06-29 03:35 . 2012-08-15 20:19 248320 ----a-w- c:\windows\system32\ieui.dll

2012-06-29 00:16 . 2012-08-15 20:19 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-06-29 00:09 . 2012-08-15 20:19 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-06-29 00:08 . 2012-08-15 20:19 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-06-29 00:04 . 2012-08-15 20:19 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-06-29 00:00 . 2012-08-15 20:19 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

Cryptography Services Error !!

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]

"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-01-10 1083264]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-09-06 5663616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-08-30 61112]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

R2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-09-09 203264]

R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

R2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

R2 gupdate;Google-oppdatering-tjenesten (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 136176]

R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

R2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]

R2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680]

R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936]

R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

R2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392]

R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920]

R3 84520207;84520207; [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-23 250056]

R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-09-09 7767552]

R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-09-09 279040]

R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]

R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-09-29 31088]

R3 cxbu0x64;OMNIKEY 3x21;c:\windows\system32\DRIVERS\cxbu0x64.sys [2011-09-06 177920]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-05-11 99384]

R3 gupdatem;Google-oppdatering-tjenesten (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 136176]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]

R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2011-11-01 12800]

R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2011-11-01 171008]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-05-07 245792]

R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-29 1255736]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2010-09-11 1014624]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-23 347680]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-08-16 21:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

.

2012-09-24 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-23 18:52]

.

2012-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 06:46]

.

2012-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-17 06:46]

.

2012-09-07 c:\windows\Tasks\HPCeeScheduleForAnne Grete.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

.

2012-09-04 c:\windows\Tasks\HPCeeScheduleForANNEGRETE-HP$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

.

2012-09-18 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 71fa4109-7868-477d-ad8a-908d347e106a.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

2012-09-18 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task d75f531b-4e49-4c12-9cd2-fd3808b8949e.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-09-22 6489704]

"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

.

------- Tilleggsskanning -------

.

uStart Page = about:blank

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\

FF - prefs.js: network.proxy.type - 0

.

.

--------------------- LÅSTE REGISTERNØKLER ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Tidspunkt ferdig: 2012-09-24 23:39:01

ComboFix-quarantined-files.txt 2012-09-24 21:39

ComboFix2.txt 2012-09-18 15:01

ComboFix3.txt 2012-09-16 08:33

.

Pre-Run: 408 324 378 624 byte ledig

Post-Run: 408 168 415 232 byte ledig

.

- - End Of File - - 56E8E2BF41BFAB5C0AFF892510E8BB44

 

 

 

[mobile999]

Ok, da har vi fått bekreftet at det ikke tilfeldigvis var en feil i Combofix som gjorde at den rapportete services.exe som infisert.

 

Har du gjort noe med drweb som tidligere foreslått?

[mobile999]

Du kan evt. forsøke følgende scan som ikke skal ta fryktelig lang tid:

 

Last ned og lagre RogueKiller til skrivebordet.

 

Lukk alle åpne vinduer/programmer.

Koble fra alle USB/eksterne disker før du kjører denne scanningen.

Høyreklikk Roguekiller og velg "Kjør som Administrator"

Vent til Prescan er ferdig, klikk deretter "Scan" knappen.

Vent til status boksen viser "Scan Finished"

Klikk "delete"

Vent til statusboksen viser "Deleting Finished"

Klikk "Report" og post innholdet.

Loggen finnes også som RKreport[1].txt på skrivebordet.

Lukk RogueKiller.

[paba]

Er det noe poeng å kjøre Farbar en gang til?

 

Jeg har forresten tilgang til internett med den skadede pc`n, med nettverkskabel. Da kan jeg kanskje gjøre scanningen som behøvde tilgang til internett?

 

Gjør ingen scanning før du sier hvilken rekkefølge jeg skal kjøre programmene.

[mobile999]

Det er ingen hensikt å kjøre frst på nytt.

 

Regner med at det er aswmbr du sikter til videre. Du kan kjøre denne på nytt og velge å laste ned definisjonene. Post loggen.

 

Forsøk også Malwarebytes Anti Malware. Oppdater den fullstendig før quick-scanning. Post loggen hvis den finner noe.

[mobile999]

Roguekiller som foreslått bør kjøres aller først.

[paba]

Har kjørt Malwarebytes Anti Malware, det fant ikke noe.

 

Programmet jeg tenkte på var HitmanPro, det fikk jeg ikke kjørt pga. mangel på nettilkobling. Er det noe poeng å prøve det?

[mobile999]

ah...

 

Hva med Roguekiller og aswmbr? Kjør disse først og post loggene. Kjør deretter Hitmanpro, jeg vet det er litt vanskelig å finne loggen i denne. Post evt. funn (filer og infeksjonsnavn), men ikke cookies.

[mobile999]

Hvis du allerede har kjørt roguekiller og aswmbr så poster du bare loggene uten å kjøre dem på nytt.

[paba]

Roguekiller ser ut til å ha hengt seg opp etter at jeg scannet og trykket delete.

Under status står det: reading MBR.

Lar maskinen stå på, ser om den blir ferdig.

[mobile999]

Mulig mbr er infisert. Hvor lenge har den stått?

[paba]

Den sto i ca. 20 min. Har restartet og det ser ut som det er RKreport på skrivebordet.

 

Her er den:

 

 

RogueKiller V8.0.5 [09/23/2012] by Tigzy

mail: tigzyRK&--#60;at&--#62;gmail&--#60;dot&--#62;com

Feedback: http://www.geekstogo...13-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 64 bits version

Started in : Normal mode

User : Anne Grete [Admin rights]

Mode : Scan -- Date : 09/25/2012 23:23:58

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -&--#62; FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -&--#62; FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -&--#62; FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -&--#62; FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--&--#62; C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

 

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9500325AS +++++

--- User ---

[MBR] bd3dc5a6fb49a56a5e69dde1c187c713

[bSP] eb6424d021e273e63ea2eda688d3dcc9 : Windows Vista/7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 455286 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 932835328 | Size: 21350 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 976560128 | Size: 103 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : &--#60;&--#60; RKreport[1].txt &--#62;&--#62;

RKreport[1].txt

 

 

 

 

aswMBR log:

 

 

 

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software

Run date: 2012-09-25 23:54:24

-----------------------------

23:54:24.982 OS Version: Windows x64 6.1.7600

23:54:24.982 Number of processors: 4 586 0x2505

23:54:24.998 ComputerName: ANNEGRETE-HP UserName: Anne Grete

23:54:26.043 Initialize success

23:54:51.440 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

23:54:51.440 Disk 0 Vendor: ST950032 0005 Size: 476940MB BusType: 3

23:54:51.455 Disk 0 MBR read successfully

23:54:51.471 Disk 0 MBR scan

23:54:51.471 Disk 0 unknown MBR code

23:54:51.533 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048

23:54:51.533 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 455286 MB offset 409600

23:54:51.580 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 21350 MB offset 932835328

23:54:51.596 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128

23:54:51.642 Disk 0 scanning C:\Windows\system32\drivers

23:55:00.956 Service scanning

23:55:19.582 Modules scanning

23:55:19.582 Disk 0 trace - called modules:

23:55:19.645 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

23:55:19.645 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bc6060]

23:55:19.660 3 CLASSPNP.SYS[fffff88001b4e43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004939050]

23:55:19.660 Scan finished successfully

23:56:17.255 Disk 0 MBR has been saved successfully to "F:\Ny mappe (2)\MBR.dat"

23:56:17.255 The log file has been saved successfully to "F:\Ny mappe (2)\aswMBR.txt"

 

 

Endret 25. september 2012 av paba

[mobile999]

Ok, regner med du fortsetter med aswmbr og deretter hitmanpro.

[paba]

HitmanPro log:

 

 

 

HitmanPro 3.6.1.164
[url="http://www.hitmanpro.com"]www.hitmanpro.com[/url]
  Computer name . . . . : ANNEGRETE-HP
  Windows . . . . . . . : 6.1.0.7600.X64/4
  Safe Mode Boot  . . . : NETWORK
  User name . . . . . . : AnneGrete-HP\Anne Grete
  UAC . . . . . . . . . : Disabled
  License . . . . . . . : Free
  Scan date . . . . . . : 2012-09-26 00:04:39
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 2m 58s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : No
  Threats . . . . . . . : 0
  Traces  . . . . . . . : 5
  Objects scanned . . . : 1 450 432
  Files scanned . . . . : 23 190
  Remnants scanned  . . : 399 133 files / 1 028 109 keys
Cookies _____________________________________________________________________
  C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:ads.vg.no
  C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:adtech.de
  C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:track.adform.net
  C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:tradedoubler.com
  C:\Users\Anne Grete\AppData\Roaming\Mozilla\Firefox\Profiles\4vl8xzu2.default\cookies.sqlite:xiti.com

 

 

 

 

 

Nå blir det kvelden her.

[mobile999]

Ja... det er nesten man skulle tro combofix rapporterer feil.

 

Fungerer internett via ledning i normalmodus?

 

Ønsker du å:

• kjøre scan med drweb fra oppstarts usb/cd? Evt. bruke Kaspersky sin oppstarts usb/cd siden du nå har internett via ledning.
  
• ta nødvendig backup og gjenopprette datamaskinen? Noen infeksjoner kan overleve dette (avhengig av hvor god gjenopprettingssystemet er).
  
• konsultere et annet forum som har høyere ekspertise enn det som kan tilbys her?
  

Endret 26. september 2012 av mobile999

[paba]

Internett fungerer via ledning i normalmodus, hverfall en stund. Hvis en prøver å åpne et annet program så låser maskinen seg.

 

Jeg har tatt backup av all data vi har lagt inn på maskinen, som bilder, filmer, dokumenter mm.

 

Hvilke programmer som krever/har lisens for å bruke, er jeg mer usikker på. Tror kanskje ikke det er mer enn windows office som krever lisens, som er installert. Jeg har boksen med installasjons-cd og veiledning, så en burde vel der kunne se hvordan en legger det inn etter gjenoppretting. Det finnes kanskje programmer som scanner maskinen og finner de programmene en har installert som har lisensnøkler?

 

Av alternativene du nevner så er jeg fortsatt litt usikker på hva jeg vil gjøre, men jeg begynner å bli litt lei av å bruke mye mer tid på det.

 

Hva ville du gjort i mitt tilfelle? Er det noe poeng i å konsultere et annet forum, i såfall hvilket?

 

Hva gjør drweb-programmet?

[mobile999]

Ja det finnes programmer som scanner pc'en for de vanligste installerte lisensnøklene. Jeg må evt. komme tilbake til deg om dette.

 

Jeg skjønner veldig godt at du begynner å bli lei av å bruke så mye tid på dette.

 

Jeg kan ikke svare på om de virkelige ekspertene på andre forum kan bidra med noe mer.. Jeg klarer ikke identifisere oppstartspunktet til det rootkitet combofix rapporterer ved at services.exe er infisert. Det kan hende at de har sett dette nylig på spesialforumene. Mulig du likevel der får beskjed om å gjøre gjenoppretting eller scanne med oppstarts usb/cd eller at de vil foreslå å skrive ny mbr (master boot record), noe jeg selvfølgelig kan forklare hvordan man gjør.

 

Oppstarts usb/cd fra drweb eller kaspersky (finnes også en fra microsoft) starter opp pc'en uavhengig av datamaskinens operativsytem (Windows) og kjører anti-virus scan av innholdet på pc'en. Teorien er at da vil ikke rootkitet være aktivt, noe som kan hindre at anti-virus scan oppdager den dersom man kjører den som vanlig i Windows.

 

Grunnen til at jeg foreslo drweb er at det ser ut til at man laster den ned med oppdaterte databaser. Kaspersky må oppdateres via kablet nettverk og er litt knotete å sette opp. Siden du nå har mulighet til å bruke nettverksledning så er Microsoft sin løsning mulig å bruke.

 

 

Jeg blir borte noen timer nå. Jeg har tidligere gitt deg link til nedlastingen av drweb og skrevet at du må kopiere alt innholdet på minnestikken over på en annen pc som backup. Det er mulig programmet til drweb sletter alt på minnestikken.

 

Det er en video her:

Spol evt. fra til 3:05 for å se hva som skjer når man starter opp pc'en med drweb usb/cd rescue.