her er combofix log
superanti er i gang
ComboFix 08-07-29.1 - Bidda 2008-07-30 22:18:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1030.18.211 [GMT 2:00]
Running from: C:\Documents and Settings\Bidda\Skrivebord\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.
2008-07-30 21:38 . 2008-07-30 21:38 <DIR> d-------- C:\Programmer\Trend Micro
2008-06-20 19:42 . 2008-06-20 19:42 246,784 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:44 . 2008-06-20 12:44 138,368 -----c--- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-12 20:51 . 2008-06-14 20:00 272,256 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 20:13 --------- d-----w C:\Programmer\Java
2008-07-30 19:14 --------- d-----w C:\Programmer\SUPERAntiSpyware
2008-07-30 19:14 --------- d-----w C:\Documents and Settings\Bidda\Application Data\SUPERAntiSpyware.com
2008-07-30 19:13 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2008-07-05 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-06-29 16:19 20,328 ----a-w C:\Documents and Settings\Bidda\Application Data\GDIPFONTCACHEV1.DAT
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 18:00 272,256 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-07 05:16 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:03 660,992 ----a-w C:\WINDOWS\system32\wininet.dll
2007-09-08 12:35 87,608 ----a-w C:\Documents and Settings\Bidda\Application Data\ezpinst.exe
2007-09-08 12:35 47,360 ----a-w C:\Documents and Settings\Bidda\Application Data\pcouffin.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-07_21.41.57,45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-08-16 12:14:20 100,352 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:37:08 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:37:08 246,784 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:48:23 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:48:23 246,784 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:44:30 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:44:31 246,784 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:13 17,784 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:13 232,824 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:13 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:07 760,696 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:07 394,616 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2008-06-14 18:00:37 272,256 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
- 2008-01-21 09:46:13 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-07-30 19:14:50 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
- 2008-01-21 09:46:13 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2008-07-30 19:14:50 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
- 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
- 2008-02-16 09:02:57 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2008-04-21 07:02:58 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-02-16 09:02:57 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2008-04-21 07:02:58 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2008-02-16 09:02:58 1,056,256 ----a-w C:\WINDOWS\system32\danim.dll
+ 2008-04-21 07:02:59 1,056,256 ----a-w C:\WINDOWS\system32\danim.dll
- 2008-02-16 09:02:57 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-04-21 07:02:58 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll
- 2008-02-16 09:02:57 151,552 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2008-04-21 07:02:58 151,552 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2008-02-16 09:02:58 1,056,256 -c----w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-04-21 07:02:59 1,056,256 -c----w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-02-20 05:37:59 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:42:16 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2008-02-16 09:02:58 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-21 07:02:59 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-02-16 09:02:58 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-21 07:02:59 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-02-16 09:02:58 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-21 07:02:59 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-02-15 09:23:37 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-04-17 10:52:54 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe
- 2008-02-16 09:02:58 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2008-04-21 07:02:59 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2008-02-16 09:02:58 96,768 -c----w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2008-04-21 07:02:59 96,768 -c----w C:\WINDOWS\system32\dllcache\inseng.dll
- 2008-02-16 09:02:58 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-21 07:02:59 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-02-16 22:33:02 3,080,704 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-21 07:03:00 3,080,704 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-02-16 09:03:00 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-21 07:03:01 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-02-16 09:03:00 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-21 07:03:01 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-02-16 09:03:01 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-21 07:03:01 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-02-16 09:03:01 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-21 07:03:01 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:44:18 1,291,776 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:16:04 1,291,776 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2008-02-16 09:03:02 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-04-21 07:03:02 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2008-02-16 09:03:02 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2008-04-21 07:03:02 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-02-16 09:03:03 617,984 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-21 07:03:02 617,984 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-02-16 09:03:03 660,992 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-21 07:03:03 660,992 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-20 05:37:59 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:42:16 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2006-07-13 08:48:58 202,240 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2008-05-08 12:28:49 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2008-02-16 09:02:58 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-21 07:02:59 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-02-16 09:02:58 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-21 07:02:59 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-02-16 09:02:58 55,808 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-21 07:02:59 55,808 ------w C:\WINDOWS\system32\extmgr.dll
- 2008-02-16 09:02:58 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2008-04-21 07:02:59 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2008-02-16 09:02:58 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
+ 2008-04-21 07:02:59 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
- 2008-02-21 23:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-06-09 23:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2008-02-21 23:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-09 23:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-22 00:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 00:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2008-02-16 09:02:58 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-21 07:02:59 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-02-16 22:33:02 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-21 07:03:00 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-02-16 09:03:00 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-21 07:03:01 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-02-16 09:03:00 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-04-21 07:03:01 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-02-16 09:03:01 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-04-21 07:03:01 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-02-16 09:03:01 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-21 07:03:01 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2008-02-16 09:03:02 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-04-21 07:03:02 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-02-16 09:03:02 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2008-04-21 07:03:02 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2006-10-16 15:10:58 14,640 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:13 17,784 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-02-16 09:03:03 617,984 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-21 07:03:02 617,984 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-02-15 23:03:08 360,960 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-04-17 11:03:39 360,960 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-07-30 10:24:17 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ac.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-26 18:53 15360]
"MsnMsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="C:\Programmer\D-Tools\daemon.exe" [2004-08-22 18:05 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"KONICA MINOLTA magicolor 2400W STD"="C:\WINDOWS\system32\MSTMON_S.EXE" [2004-09-28 02:00 184320]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-09 09:49 15691264 C:\WINDOWS\RTHDCPL.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-26 18:53 15360]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Logitech SetPoint.lnk - C:\Programmer\Logitech\SetPoint\SetPoint.exe [2008-01-21 10:42:12 784912]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programmer\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 11:10 72208 c:\Programmer\Fælles filer\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmer\\Messenger\\msmsgs.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=
R0 m5288;m5288;C:\WINDOWS\system32\drivers\m5288.sys [2005-12-24 00:54]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS [2005-03-22 21:36]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page =
hxxp://www.google.dk/R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: E&ksporter til Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-07-30 22:20:52
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-30 22:22:42
ComboFix-quarantined-files.txt 2008-07-30 20:22:37
ComboFix2.txt 2008-06-07 19:42:29
Pre-Run: 135,285,133,312 byte ledig
Post-Run: 135,280,836,608 byte ledig
224 --- E O F --- 2008-07-30 20:15:20
