Avatar billede jbz Novice
17. oktober 2008 - 08:40 Der er 7 kommentarer og
1 løsning

Adware Virtumonde symptomer/renset

Hej!
Håber en af Jer kloge eksperter kan kigge på mine logs og se om alt er OK nu!
Jeg har haft Virtumonde på min maskine startende med standard symptomerne med pop-ups af forskellig art (vinduer, indlejret reklame mv.).
Ved reelt ikke hvordan den har sneget sig ind, da jeg ikke bruger cracks/torrent, men iøvrigt er aktiv på nettet, så jeg kan være kommet forbi en page med sådan noget snavs undervejs. Klikker ellers aldrig på tilbud om free scanning osv, men har hørt at nogen faktisk har fundet en metode hvor man kan få ting aktiveret blot musen føres henover en reklame?
Nå men til sagen: Det der virkeligt gjorde mig nervøs var andre symptomer, idet maskinen fik mere og mere besvær med at virke: Tilsyneladende var alle min restore-punkter forsvundet, antivirus sat ud af kraft, Windows update stoppet og kunne ikke genstartes pga. manglende referencer? og til sidst virkede intet på skrivebordet, hverken shortcuts el. start/procesliniens icon'er. Eneste mulighed var Ctrl-Alt-Del og herfra starte et program ad gangen (Faneblad programmer - Nyt Job). Internet Explorer startet ved at åbne et program, der havde et internet link og rette i adressefelt for at finde oplysninger. Fik kørt en scan med en online scanner fra nettet og den fandt så at det var Virtumonde, hvorefter jeg fik fat i denne artikel.
Heldigt, for det virker, dvs. jeg fulgte anbefalingerne her og i artikel 1123 og alt ser ud til at være på plads igen incl. windows update og antivirus. Please giv blot mine log en kig, så jeg kan sove roligt. Enhver anbefaling er naturligvis velkommen, da dette alt i alt har taget over et halvt døgn.
Avatar billede jbz Novice
17. oktober 2008 - 08:41 #1
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/16/2008 at 10:45 PM

Application Version : 4.0.1154

Core Rules Database Version : 3599
Trace Rules Database Version: 1585

Scan type      : Complete Scan
Total Scan Time : 00:12:38

Memory items scanned      : 212
Memory threats detected  : 1
Registry items scanned    : 4853
Registry threats detected : 6
File items scanned        : 14806
File threats detected    : 2

Adware.Vundo Variant/Resident
    C:\WINDOWS\SYSTEM32\RQRHXPFE.DLL
    C:\WINDOWS\SYSTEM32\RQRHXPFE.DLL

Trojan.Vundo-Variant/Small-GEN
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDC1E410-C174-4E54-B787-8C2CEC55D030}
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}\InprocServer32
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}\InprocServer32#ThreadingModel

Adware.Vundo Variant/Rel
    HKLM\SOFTWARE\Microsoft\FCOVM
    HKLM\SOFTWARE\Microsoft\RemoveRP

Adware.Tracking Cookie
    C:\Documents and Settings\Administrator\Cookies\administrator@statse.webtrendslive[1].txt
Avatar billede jbz Novice
17. oktober 2008 - 08:42 #2
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:08:14, on 17-10-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\ACER\PSM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmer\Acer\Acer eMode Management\AspireService.exe
C:\Programmer\Acer\Acer eConsole\MediaSync.exe
C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\HookManager.exe
C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\Vundofix\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdconline.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AspireService] C:\Programmer\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Programmer\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [DT HWP] C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [cctray] "C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [VetStart] "C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe" -r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\DOCUME~1\jbz\LOKALE~1\Temp\SSUPDATE.EXE Software\SUPERAntiSpyware.com\SUPERAntiSpyware
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Programmer\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

--
End of file - 7544 bytes
Avatar billede jbz Novice
17. oktober 2008 - 08:43 #3
ComboFix 08-10-16.01 - jbz 2008-10-17  0:16:34.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1030.18.1118 [GMT 2:00]
Running from: C:\Vundofix\ComboFix.exe
* Created a new restore point

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\efPXHRqr.ini
C:\WINDOWS\system32\efPXHRqr.ini2

.
(((((((((((((((((((((((((  Files Created from 2008-09-16 to 2008-10-16  )))))))))))))))))))))))))))))))
.

2008-10-16 23:11 . 2008-10-16 23:13    1,393    --a------    C:\WINDOWS\imsins.BAK
2008-10-16 22:22 . 2008-10-16 23:54    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2008-10-16 22:22 . 2008-10-16 22:22    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\SUPERAntiSpyware.com
2008-10-16 22:22 . 2008-10-16 22:22    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-10-16 22:14 . 2008-10-16 22:14    <DIR>    d--------    C:\Programmer\CCleaner
2008-10-16 21:45 . 2008-10-16 21:45    <DIR>    d--------    C:\VundoFix Backups
2008-10-16 21:44 . 2008-10-17 00:13    <DIR>    d--------    C:\Vundofix
2008-10-16 18:42 . 2008-10-16 20:09    <DIR>    d--------    C:\Documents and Settings\Administrator\.housecall6.6
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--------    C:\Documents and Settings\Administrator\Skrivebord
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Skabeloner
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Printere
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    dr-------    C:\Documents and Settings\Administrator\Menuen Start
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Lokale indstillinger
2008-10-16 13:38 . 2005-03-24 23:42    <DIR>    dr-------    C:\Documents and Settings\Administrator\Foretrukne
2008-10-16 13:38 . 2005-03-24 23:42    <DIR>    dr-------    C:\Documents and Settings\Administrator\Dokumenter
2008-10-16 13:38 . 2005-03-24 23:45    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Symantec
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Andre computere
2008-10-16 13:38 . 2008-10-16 18:42    <DIR>    d--------    C:\Documents and Settings\Administrator
2008-10-16 02:31 . 2008-10-16 02:31    31,232    --a------    C:\WINDOWS\system32\rqRHxuvV.dll.vir
2008-10-15 15:08 . 2008-08-14 15:25    2,191,744    ---------    C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,147,840    ---------    C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,068,608    ---------    C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,026,496    ---------    C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 15:08 . 2008-09-15 17:27    1,846,400    ---------    C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 15:08 . 2008-09-08 12:41    333,824    ---------    C:\WINDOWS\system32\dllcache\srv.sys
2008-10-06 01:36 . 2008-10-06 11:03    <DIR>    d--------    C:\Documents and Settings\jbz\.housecall6.6
2008-10-05 21:58 . 2008-08-14 20:59    1,923,024    --a------    C:\Jørn på spejderlejr.jpg
2008-10-01 09:29 . 2008-08-08 14:47    227,840    --a------    C:\WINDOWS\system32\bzFlRdr.dll
2008-10-01 09:29 . 2008-09-05 06:29    193,024    --a------    C:\WINDOWS\system32\bzpdf.dll
2008-10-01 09:29 . 2008-09-26 20:44    126,976    --a------    C:\WINDOWS\system32\bzpdfc.dll
2008-10-01 09:29 . 2008-07-10 00:19    103,424    --a------    C:\WINDOWS\system32\bzDCT.dll
2008-10-01 09:28 . 2008-10-01 09:28    <DIR>    d--------    C:\Programmer\Bullzip
2008-09-24 13:33 . 2008-10-17 00:13    <DIR>    d--------    C:\WINDOWS\CAVTemp
2008-09-24 13:22 . 2008-09-24 13:22    <DIR>    d--------    C:\Programmer\CA
2008-09-24 13:22 . 2008-09-24 13:22    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\CA
2008-09-24 13:22 . 2008-09-24 13:33    880,560    --a------    C:\WINDOWS\system32\drivers\vetefile.sys
2008-09-24 13:22 . 2008-09-24 13:33    108,368    --a------    C:\WINDOWS\system32\drivers\veteboot.sys
2008-09-24 13:22 . 2008-01-11 21:30    99,592    --a------    C:\WINDOWS\system32\isafeif.dll
2008-09-24 13:22 . 2008-09-24 13:33    91,376    --a------    C:\WINDOWS\system32\isafprod.dll
2008-09-24 13:22 . 2008-01-11 21:30    83,256    --a------    C:\WINDOWS\system32\vetredir.dll
2008-09-24 13:22 . 2008-09-24 13:33    32,240    --a------    C:\WINDOWS\system32\drivers\vetmonnt.sys
2008-09-24 13:22 . 2008-09-24 13:33    26,352    --a------    C:\WINDOWS\system32\drivers\vet-filt.sys
2008-09-24 13:22 . 2008-09-24 13:33    21,488    --a------    C:\WINDOWS\system32\drivers\vetfddnt.sys
2008-09-24 13:22 . 2008-09-24 13:33    21,104    --a------    C:\WINDOWS\system32\drivers\vet-rec.sys
2008-09-23 10:57 . 2008-09-23 10:57    44,504    --a------    C:\Documents and Settings\jbz\Application Data\GDIPFONTCACHEV1.DAT
2008-09-23 10:41 . 2008-09-23 10:41    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\Canon
2008-09-23 10:17 . 2008-04-13 20:47    25,856    --a------    C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-23 10:17 . 2008-04-13 20:47    25,856    --a------    C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-23 10:17 . 2008-04-13 20:45    15,104    --a------    C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-23 10:17 . 2008-04-13 20:45    15,104    --a------    C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-23 10:08 . 2008-09-23 10:09    <DIR>    d--h-----    C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-09-23 10:06 . 2006-04-30 21:00    161,792    --a------    C:\WINDOWS\system32\CNMLM87.DLL
2008-09-23 10:05 . 2008-09-23 10:05    <DIR>    d--h-----    C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-09-23 10:05 . 2008-09-23 10:05    <DIR>    d--h-----    C:\Programmer\CanonBJ
2008-09-23 10:05 . 2006-04-13 09:23    1,134,592    --a------    C:\WINDOWS\system32\CNCC600.DLL
2008-09-23 10:05 . 2006-05-29 01:39    135,168    --a------    C:\WINDOWS\system32\CNCL600.DLL
2008-09-23 10:05 . 2006-02-17 07:44    106,496    --a------    C:\WINDOWS\system32\cnco600.dll
2008-09-23 10:05 . 2006-04-13 09:23    57,344    --a------    C:\WINDOWS\system32\CNCI600.DLL
2008-09-21 21:50 . 2008-10-04 08:18    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\DivX
2008-09-21 21:48 . 2008-09-21 21:48    <DIR>    d--------    C:\Programmer\DivX

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-16 20:21    ---------    d-----w    C:\Programmer\Fælles filer\Wise Installation Wizard
2008-10-09 21:11    ---------    d-----w    C:\Documents and Settings\jbz\Application Data\AdobeUM
2008-10-03 17:12    6,066,176    ----a-w    C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 15:27    1,846,400    ----a-w    C:\WINDOWS\system32\win32k.sys
2008-09-08 10:41    333,824    ----a-w    C:\WINDOWS\system32\drivers\srv.sys
2008-09-03 15:09    ---------    d-----w    C:\Programmer\Cribbage
2008-08-27 09:27    3,593,216    ----a-w    C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38    13,824    ----a-w    C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 08:36    70,656    ----a-w    C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-23 05:56    635,848    ----a-w    C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54    161,792    ----a-w    C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-21 16:04    ---------    d-----w    C:\Programmer\Microsoft CAPICOM 2.1.0.2
2008-08-21 07:35    ---------    d-sh--w    C:\Programmer\Fælles filer\WindowsLiveInstaller
2008-08-21 07:35    ---------    d-----w    C:\Programmer\Windows Live
2008-08-21 07:35    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-14 13:25    2,147,840    ----a-w    C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:25    2,026,496    ----a-w    C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 10:04    138,496    ----a-w    C:\WINDOWS\system32\dllcache\afd.sys
2008-07-25 08:36    524,288    ----a-w    C:\WINDOWS\system32\DivXsm.exe
2008-07-23 16:50    3,596,288    ----a-w    C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 16:50    129,784    ----a-w    C:\WINDOWS\system32\pxafs.dll
2008-07-23 16:50    120,056    ----a-w    C:\WINDOWS\system32\pxcpyi64.exe
2008-07-23 16:50    118,520    ----a-w    C:\WINDOWS\system32\pxinsi64.exe
2008-07-23 16:48    200,704    ----a-w    C:\WINDOWS\system32\ssldivx.dll
2008-07-23 16:48    1,044,480    ----a-w    C:\WINDOWS\system32\libdivx.dll
2008-07-23 16:46    12,288    ----a-w    C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-18 20:10    94,920    ----a-w    C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10    94,920    ----a-w    C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10    53,448    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10    53,448    ----a-w    C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10    45,768    ----a-w    C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10    36,552    ----a-w    C:\WINDOWS\system32\wups.dll
2008-07-18 20:10    36,552    ----a-w    C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09    563,912    ----a-w    C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09    563,912    ----a-w    C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09    325,832    ----a-w    C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09    325,832    ----a-w    C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09    205,000    ----a-w    C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09    205,000    ----a-w    C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09    1,811,656    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09    1,811,656    ----a-w    C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 20:07    270,880    ----a-w    C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07    210,976    ----a-w    C:\WINDOWS\system32\muweb.dll
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"RemoteControl"="C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"MPS"="C:\ACER\PSM.EXE" [2004-03-04 372736]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-27 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-27 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AspireService"="C:\Programmer\Acer\Acer eMode Management\AspireService.exe" [2005-06-21 110592]
"MediaSync"="C:\Programmer\Acer\Acer eConsole\MediaSync.exe" [2005-06-21 425984]
"DT HWP"="C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe" [2007-03-27 278016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"cctray"="C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-10-10 247024]
"CAVRID"="C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-24 234736]
"VetStart"="C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe" [2008-09-24 255216]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-01-14 C:\WINDOWS\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Speed Launch.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=

R0 m5287;m5287;C:\WINDOWS\system32\drivers\m5287.sys [2004-12-15 76544]
S3 int15.sys;int15.sys;C:\Programmer\acer\erecovery\int15.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96598859-9cbc-11d9-9184-806d6172696f}]
\Shell\AutoRun\command - I:\Autorun.exe HowToUse\HowToUse.html
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-eRecoveryService - (no file)
HKLM-Run-eRecoveryService - (no file)
ShellExecuteHooks-{9AD7FC7F-1FE1-4414-9AC5-EC51457528E4} - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://tdconline.dk/
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://global.acer.com/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe

O16 -: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
C:\WINDOWS\Downloaded Program Files\e-Safekey.inf
C:\WINDOWS\Downloaded Program Files\e-Safekey.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-17 00:29:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmer\acer\Acer eConsole\MediaServerService.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\HookManager.exe
C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-10-17  0:32:17 - machine was rebooted
ComboFix-quarantined-files.txt  2008-10-16 22:31:44

Pre-Run: 84.547.883.008 byte ledig
Post-Run: 84,642,189,312 byte ledig

211    --- E O F ---    2008-10-16 21:14:09
Avatar billede ejvindh Ekspert
17. oktober 2008 - 09:49 #4
Der er ikke mere skidt i dine logfiler, så det ser ud til at du har gjort dit arbejde godt :-)
Avatar billede jbz Novice
17. oktober 2008 - 10:09 #5
TAK for det! Man bliver s'gu helt forpustet af sådan en omgang, men selvfø'ligt også lidt klogere på hvad og hvor man kan hente hjælp. Eksperten.dk styrer!
Avatar billede johnstigers Seniormester
17. oktober 2008 - 14:14 #6
Husk at acceptere svar :)
Avatar billede jbz Novice
17. oktober 2008 - 15:38 #7
Selvklart - skulle bare lige finde ud af hvordan. Tak for hjælp!!!
Avatar billede ejvindh Ekspert
17. oktober 2008 - 15:57 #8
Takker for point :-)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester