Check venligst Malware og Combo Logs
Er der nogen, som kan se om der er noget snavs tilbage???ComboFix 09-08-10.01 - Mangold Gyula 009.08.10. 22:34.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.36.1038.18.511.112 [GMT 2:00]
Running from: E:\ComboFix.exe
AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-07-10 to 2009-08-10 )))))))))))))))))))))))))))))))
.
2009-08-10 18:35 . 2009-08-10 18:35 -------- dc----w- c:\documents and settings\Mangold Gyula\Application Data\Malwarebytes
2009-08-10 18:35 . 2009-08-03 11:36 38160 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-10 18:35 . 2009-08-10 18:35 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-10 18:35 . 2009-08-03 11:36 19096 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-08-10 18:35 . 2009-08-10 18:35 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-10 18:27 . 2009-08-10 18:27 -------- dc----w- c:\windows\LastGood
2009-08-10 18:23 . 2009-08-10 18:23 -------- dc----w- c:\program files\CCleaner
2009-08-10 18:08 . 2008-04-14 16:01 21504 -c--a-w- c:\windows\system32\hidserv.dll
2009-08-10 18:08 . 2008-04-14 16:01 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-08-10 18:08 . 2008-04-14 15:40 14720 -c--a-w- c:\windows\system32\drivers\kbdhid.sys
2009-08-10 18:08 . 2008-04-14 15:40 14720 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-10 18:34 . 2006-04-06 11:46 -------- dc----w- c:\documents and settings\Mangold Gyula\Application Data\Skype
2009-07-31 22:01 . 2004-08-18 12:00 92314 ----a-w- c:\windows\system32\perfc00E.dat
2009-07-31 22:01 . 2004-08-18 12:00 412472 ----a-w- c:\windows\system32\perfh00E.dat
2008-07-08 11:17 . 2006-11-27 16:43 67696 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-07-08 11:17 . 2006-11-27 16:43 54376 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-07-08 11:17 . 2006-11-27 16:43 34952 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-07-08 11:17 . 2006-11-27 16:43 46720 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-07-08 11:17 . 2006-11-27 16:43 172144 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2007-07-12 11:51 . 2007-07-12 11:51 56 -csh--r- c:\windows\system32\3B5006DF3E.sys
2007-07-12 11:51 . 2007-07-12 11:51 1682 -csha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-08-03 36864]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-06-12 20002856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-22 5898240]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-04-22 86016]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-11-27 921600]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 222208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-05 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-11 342312]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 171008]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-04-22 1519616]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]
c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-7-29 499773]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-3-15 241664]
HP Image Zone gyorsindˇt sa.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-3-15 53248]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-8-3 196608]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"WudfSvc"=2 (0x2)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WmiApSrv"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"W32Time"=2 (0x2)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"TrkWks"=2 (0x2)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"SSDPSRV"=3 (0x3)
"srservice"=2 (0x2)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SharedAccess"=2 (0x2)
"ServiceLayer"=3 (0x3)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"SeaPort"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=2 (0x2)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"PolicyAgent"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"PlugPlay"=2 (0x2)
"ose"=3 (0x3)
"NVSvc"=2 (0x2)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"napagent"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LmHosts"=2 (0x2)
"LexBceS"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"Irmon"=2 (0x2)
"iPod Service"=3 (0x3)
"ImapiService"=3 (0x3)
"HTTPFilter"=3 (0x3)
"hkmsvc"=3 (0x3)
"HidServ"=2 (0x2)
"helpsvc"=2 (0x2)
"gusvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"EapHost"=3 (0x3)
"Dot3svc"=3 (0x3)
"Dnscache"=2 (0x2)
"dmserver"=3 (0x3)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=2 (0x2)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"btwdins"=2 (0x2)
"BthServ"=2 (0x2)
"Browser"=2 (0x2)
"Bonjour Service"=2 (0x2)
"BITS"=3 (0x3)
"Autodesk Network Licensing Service"=3 (0x3)
"Autodesk Licensing Service"=3 (0x3)
"AudioSrv"=2 (0x2)
"ATKKeyboardService"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"ALG"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\LimeWire\\Új mappa\\LimeWire.exe"=
"c:\\Documents and Settings\\Mangold Gyula\\Asztal\\játék\\Empire Earth.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
S3 cxbu0wdm;CardMan 3x21;c:\windows\system32\drivers\cxbu0wdm.sys [2005.12.05. 8:20 80384]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - HIDSERV
.
Contents of the 'Scheduled Tasks' folder
2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:34]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLR
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\windows\system32\imon.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
FF - ProfilePath - c:\documents and settings\Mangold Gyula\Application Data\Mozilla\Firefox\Profiles\j2tt15ma.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-10 22:40
Windows 5.1.2600 Szervizcsomag 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(628)
c:\windows\system32\imon.dll
.
Completion time: 2009-08-10 22:44
ComboFix-quarantined-files.txt 2009-08-10 20:44
Pre-Run: 109 990 678 528 bájt szabad
Post-Run: 109 974 020 096 bájt szabad
232 --- E O F --- 2009-06-06 20:50
Malware
Malwarebytes' Anti-Malware 1.40
Database version: 2593
Windows 5.1.2600 Szervizcsomag 3
2009.08.10. 22:31:32
mbam-log-2009-08-10 (22-31-32).txt
Skan type: Fuldstćndig skanning (C:\|)
Objekter skannet: 156945
Tid tilbagelagt: 27 minute(s), 3 second(s)
Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nřgler: 2
Inficerede Registeringsdatabase Vćrdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0
Inficerede Hukommelses Processer:
(Ingen mistćnkelige filer fundet)
Inficerede Hukommelses Moduler:
(Ingen mistćnkelige filer fundet)
Inficerede Registeringsdatabase Nřgler:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Inficerede Registeringsdatabase Vćrdier:
(Ingen mistćnkelige filer fundet)
Inficerede Registeringsdatabase Filer:
(Ingen mistćnkelige filer fundet)
Inficerede Mapper:
(Ingen mistćnkelige filer fundet)
Inficerede Filer:
(Ingen mistćnkelige filer fundet)
