HiJackThis log
HejKan nogen checke mine logs - HiJackThis og Combofix?
Jeg har på fornemmelsen at der er noget snavs. Har ellers scannet og renset med div. programmer..
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:18, on 05-04-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmer\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Programmer\Microsoft ActiveSync\wcescomm.exe
C:\Programmer\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
D:\PROGRA~2\MI3AA1~1\rapimgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Martin\Skrivebord\Spywarefri\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmer\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Programmer\HP\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "D:\Programmer\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Programmer\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmer\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NT Security Service] NTSecurity.exe
O4 - HKCU\..\Policies\Explorer\Run: [WinUpdating] WinUpdating.exe
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~2\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~2\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på den mobile enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~2\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206283542215
O20 - Winlogon Notify: !SASWinLogon - D:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmer\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 7065 bytes
ComboFix 08-04-04.1 - Martin 2008-04-05 14:04:22.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1030.18.519 [GMT 2:00]
Running from: C:\Documents and Settings\Martin\Skrivebord\Spywarefri\SWF_CF.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\kiasys.dll
C:\WINDOWS\yeTyezzd.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_QALWPMDGT
((((((((((((((((((((((((( Files Created from 2008-03-05 to 2008-04-05 )))))))))))))))))))))))))))))))
.
2008-04-04 20:27 . 2008-04-04 20:27 2 --a------ C:\209041820
2008-04-04 20:26 . 2008-04-04 20:26 12,800 --a------ C:\cgprr.exe
2008-04-04 20:26 . 2008-04-04 20:26 6,144 --a------ C:\nutjnhs.exe
2008-03-31 20:22 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-03-31 20:22 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-03-30 20:33 . 2008-04-05 09:21 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-03-30 19:29 . 2008-03-31 20:42 <DIR> d-------- C:\Documents and Settings\Martin\.housecall6.6
2008-03-30 00:25 . 2008-03-30 00:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-03-30 00:20 . 2008-03-30 00:20 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Grisoft
2008-03-30 00:19 . 2008-03-30 00:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-30 00:19 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-29 22:44 . 2008-03-29 22:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-03-27 18:31 . 2008-03-27 18:31 360,064 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-03-27 18:30 . 2007-10-30 19:20 360,064 --a------ C:\WINDOWS\system32\drivers\Kopi af tcpip.sys
2008-03-25 20:08 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-03-24 16:31 . 2008-03-24 22:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-03-24 12:48 . 2007-07-30 20:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-24 12:48 . 2007-07-30 20:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-24 12:43 . 2008-03-24 12:46 1,634 --a------ C:\logfile
2008-03-24 01:28 . 2008-03-24 01:28 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Ace
2008-03-21 23:51 . 2008-03-21 23:51 <DIR> d-------- C:\Programmer\MSXML 6.0
2008-03-21 23:51 . 2008-03-21 23:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Seagate
2008-03-21 23:50 . 2008-03-21 23:50 <DIR> d-------- C:\Seagate temp
2008-03-21 23:39 . 2008-03-21 23:51 <DIR> d-------- C:\Programmer\Seagate
2008-03-20 17:01 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-19 11:51 . 2008-03-19 11:44 691,545 --a------ C:\WINDOWS\unins000.exe
2008-03-19 11:51 . 2008-03-19 11:51 2,547 --a------ C:\WINDOWS\unins000.dat
2008-03-19 11:42 . 2008-03-19 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-17 21:15 . 2008-03-17 21:15 <DIR> d-------- C:\Programmer\Microsoft.NET
2008-03-16 19:37 . 2008-03-16 19:37 32,256 --a------ C:\WINDOWS\system32\NTSecurity.exe
2008-03-16 19:01 . 2008-03-16 19:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-03-08 23:30 . 2008-03-08 23:30 <DIR> d-------- C:\Documents and Settings\Martin\Application Data\Thinstall
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-30 17:24 --------- d-----w C:\Programmer\Fælles filer\Symantec Shared
2008-03-30 17:23 --------- d-----w C:\Programmer\Windows Media Connect 2
2008-03-30 16:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-30 12:00 --------- d-----w C:\Programmer\Fælles filer\Stardock
2008-03-29 17:35 94,544 -c--a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 -c--a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 -c--a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 -c--a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-27 16:31 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-03-25 20:32 --------- d-----w C:\Programmer\Logitech
2008-03-25 20:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-03-25 19:31 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2008-03-24 10:32 --------- d-----w C:\Programmer\HP
2008-03-21 21:52 --------- d--h--w C:\Programmer\InstallShield Installation Information
2008-03-20 15:01 --------- d-----w C:\Programmer\Java
2008-03-16 17:01 --------- d-----w C:\Documents and Settings\Martin\Application Data\Uniblue
2008-02-26 21:47 --------- d-----w C:\Programmer\Toshiba
2008-02-23 12:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
2008-02-23 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-02-23 12:12 --------- d-----w C:\Documents and Settings\Martin\Application Data\HP
2008-02-23 12:08 --------- d-----w C:\Documents and Settings\Martin\Application Data\Ulead Systems
2008-02-23 12:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-02-08 20:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-02-05 19:06 97,216 ----a-w C:\WINDOWS\system32\drivers\AnyDVD.sys
2008-02-01 17:27 692 -c--a-w C:\Documents and Settings\Martin\Application Data\wklnhst.dat
2008-01-14 15:47 99,712 ----a-w C:\WINDOWS\HPBroker.dll
.
------- Sigcheck -------
2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2004-08-27 10:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2008-03-27 18:31 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-03-27 18:31 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( snapshot@2008-03-29_23.03.36,76 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-21 13:53:44 385,536 ----a-w C:\WINDOWS\Downloaded Program Files\Housecall_ActiveX.dll
- 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
- 2000-08-31 07:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 06:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-31 06:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe
- 2007-12-04 13:04:28 837,496 -c--a-w C:\WINDOWS\system32\aswBoot.exe
+ 2008-03-29 17:45:49 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
- 2007-12-04 12:54:04 95,608 -c--a-w C:\WINDOWS\system32\AvastSS.scr
+ 2008-03-29 17:23:22 95,608 -c--a-w C:\WINDOWS\system32\AvastSS.scr
- 2004-01-08 08:50:00 104,960 ----a-w C:\WINDOWS\system32\COMNCTR.DLL
+ 2004-01-08 07:50:00 104,960 ----a-w C:\WINDOWS\system32\COMNCTR.DLL
- 2004-08-26 16:48:48 53,120 ----a-w C:\WINDOWS\system32\dllcache\i8042prt.sys
+ 2004-08-26 15:48:48 53,120 ----a-w C:\WINDOWS\system32\dllcache\i8042prt.sys
- 2004-08-26 16:47:54 23,296 ----a-w C:\WINDOWS\system32\dllcache\mouclass.sys
+ 2004-08-26 15:47:54 23,296 ----a-w C:\WINDOWS\system32\dllcache\mouclass.sys
- 2001-10-04 15:35:26 12,160 ----a-w C:\WINDOWS\system32\dllcache\mouhid.sys
+ 2001-10-04 14:35:26 12,160 ----a-w C:\WINDOWS\system32\dllcache\mouhid.sys
- 2007-12-04 14:56:02 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-01-17 15:34:01 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
- 2004-08-26 16:48:48 53,120 -c--a-w C:\WINDOWS\system32\drivers\i8042prt.sys
+ 2004-08-26 15:48:48 53,120 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
- 2004-08-26 16:47:54 23,296 -c--a-w C:\WINDOWS\system32\drivers\mouclass.sys
+ 2004-08-26 15:47:54 23,296 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys
- 2001-10-04 15:35:26 12,160 -c--a-w C:\WINDOWS\system32\drivers\mouhid.sys
+ 2001-10-04 14:35:26 12,160 ----a-w C:\WINDOWS\system32\drivers\mouhid.sys
- 2004-01-08 08:50:00 97,792 -c--a-w C:\WINDOWS\system32\LGUICOM.DLL
+ 2004-01-08 07:50:00 97,792 ----a-w C:\WINDOWS\system32\LGUICOM.DLL
- 2004-01-08 08:50:00 3,568 -c--a-w C:\WINDOWS\system32\LMOUSE16.DLL
+ 2004-01-08 07:50:00 3,568 ----a-w C:\WINDOWS\system32\LMOUSE16.DLL
- 2004-01-08 08:50:00 16,896 -c--a-w C:\WINDOWS\system32\LMOUSE32.DLL
+ 2004-01-08 07:50:00 16,896 ----a-w C:\WINDOWS\system32\LMOUSE32.DLL
- 2008-03-24 15:00:05 75,230 ----a-w C:\WINDOWS\system32\perfc006.dat
+ 2008-04-05 12:11:18 75,230 ----a-w C:\WINDOWS\system32\perfc006.dat
- 2008-03-24 15:00:05 63,862 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-05 12:11:18 63,862 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-24 15:00:05 421,544 ----a-w C:\WINDOWS\system32\perfh006.dat
+ 2008-04-05 12:11:18 421,544 ----a-w C:\WINDOWS\system32\perfh006.dat
- 2008-03-24 15:00:05 406,662 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-05 12:11:18 406,662 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2004-08-26 16:47:54 23,296 -c--a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\mouclass.sys
+ 2004-08-26 15:47:54 23,296 ----a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\mouclass.sys
+ 2001-10-04 15:35:26 12,160 ----a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\mouhid.sys
+ 2004-08-26 16:48:48 53,120 ----a-w C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\i8042prt.sys
+ 2004-08-26 16:47:54 23,296 ----a-w C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\mouclass.sys
+ 2008-04-05 12:07:07 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat
+ 2000-08-31 06:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="D:\Programmer\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 19:17 1289000]
"WMPNSCFG"="C:\Programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 11:30 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eabconfg.cpl"="C:\Programmer\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-07 11:56 409600]
"Cpqset"="C:\Programmer\HPQ\Default Settings\cpqset.exe" [2005-08-01 15:26 233534]
"hpWirelessAssistant"="C:\Programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 17:45 507904]
"HPHUPD05"="c:\Programmer\HP\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2004-04-01 21:21 49152]
"HP Component Manager"="C:\Programmer\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 10:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"BootSkin Startup Jobs"="D:\Programmer\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 17:21 270336]
"!AVG Anti-Spyware"="D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-27 10:00 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"System Patcher"= BTCPatcher.exe
"NT Security Service"= NTSecurity.exe
"WinUpdating"= WinUpdating.exe
"Windows Printing Driver"= WinSpooler.exe
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
D:\Programmer\SUPERAntiSpyware\SASWINLO.DLL 2008-03-20 16:53 294912 D:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.LEAD"= LCODCCMP.DLL
"MSVideo"= vfwwdm32.dll
"MSVideo8"= VfWWDM32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pxe07.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^Martin^Menuen Start^Programmer^Start^Stardock ObjectDock.lnk]
path=C:\Documents and Settings\Martin\Menuen Start\Programmer\Start\Stardock ObjectDock.lnk
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
--a------ 2008-01-11 11:57 2684280 D:\Programmer\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2005-11-10 22:05 344064 C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\basicsmssmenu]
--a------ 2007-10-09 17:21 169328 C:\Programmer\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-27 10:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 19:17 1289000 D:\Programmer\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a--c--- 2005-02-17 00:11 49152 C:\Programmer\Hp\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a--c--- 2004-05-04 20:51 176128 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
--a--c--- 2004-05-05 11:45 491520 C:\WINDOWS\system32\hphmon05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
--a--c--- 2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2005-09-25 20:11 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0]
--a--c--- 2007-03-28 21:41 2037352 D:\Programmer\Norton Ghost\Agent\VProTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicoZip]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
--a--c--- 2005-12-12 12:39 94208 C:\Programmer\HP\QuickPlay\QPService.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
--a--c--- 2005-10-11 11:23 1187840 C:\Windows\SMINST\RecGuard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Programmer\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-03-20 16:53 1481968 D:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a--c--- 2007-10-22 11:12 1885464 D:\Programmer\Uniblue\RegistryBooster 2\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2008-01-16 00:54 37376 D:\Programmer\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Automatic LiveUpdate Scheduler"=2 (0x2)
"LightScribeService"=2 (0x2)
"Norton Ghost"=2 (0x2)
"Basics Service"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"D:\\Spil\\blobby\\volley.exe"=
"D:\\Programmer\\Joost\\xulrunner\\tvprunner.exe"=
"D:\\Programmer\\eMule\\emule.exe"=
"D:\Programmer\Microsoft ActiveSync\rapimgr.exe"= D:\Programmer\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"D:\Programmer\Microsoft ActiveSync\wcescomm.exe"= D:\Programmer\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"D:\Programmer\Microsoft ActiveSync\WCESMgr.exe"= D:\Programmer\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"D:\\Programmer\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"C:\\Programmer\\Internet Explorer\\iexplore.exe"=
"C:\\cgprr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4869:UDP"= 4869:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"4868:UDP"= 4868:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-08-22 16:06]
S3 AF05BDA;AF9005 BDA Device;C:\WINDOWS\system32\drivers\AF05BDA.sys []
S4 Basics Service;Basics Service;C:\Programmer\Seagate\Basics\Service\SyncServicesBasics.exe [2008-03-25 20:37]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d6365b2-cb1b-11dc-bbc4-0014a5702287}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
Contents of the 'Scheduled Tasks' folder
"2008-04-01 21:13:03 C:\WINDOWS\Tasks\HP Usg Daily.job"
- c:\Programmer\HP\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-05 14:33:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Programmer\HPQ\Default Settings\cpqset.exe???????????7?3?3?0??@???? ???B????????? ???hLC????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
D:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
D:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmer\Windows Media Player\WMPNetwk.exe
C:\Programmer\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
D:\PROGRA~2\MI3AA1~1\rapimgr.exe
.
**************************************************************************
.
Completion time: 2008-04-05 14:35:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-05 12:35:44
ComboFix2.txt 2008-03-29 22:03:55
ComboFix3.txt 2007-12-29 10:36:17
Pre-Run: 36,488,663,040 byte ledig
Post-Run: 36,427,558,912 byte ledig
.
2008-03-23 14:43:45 --- E O F ---
