I er bare for seje.
@fromsej, her er loggen. Ser den god nok ud?
ComboFix 10-01-02.05 - Lars Qvistgaard 03-01-2010 18:10:18.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.510.254 [GMT 1:00]
Kører fra: c:\documents and settings\Lars Qvistgaard\Skrivebord\combo\banan.exe
Kommandoer benyttet :: c:\documents and settings\Lars Qvistgaard\Skrivebord\combo\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100103-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((( Filer skabt fra 2009-12-03 til 2010-01-03 )))))))))))))))))))))))))))))))))))
.
2010-01-03 15:45 . 2010-01-03 17:19 -------- d-----w- C:\SMCLpav
2009-12-30 13:27 . 2009-12-30 13:27 -------- d-----w- c:\documents and settings\NetworkService\Lokale indstillinger\Application Data\PCHealth
2009-12-30 08:18 . 2009-12-30 08:18 -------- d-----w- c:\programmer\Microsoft CAPICOM 2.1.0.2
2009-12-29 08:57 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-29 08:56 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-29 08:55 . 2009-12-29 08:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-29 08:53 . 2009-12-30 08:15 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2009-12-29 07:12 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-12-29 07:11 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-28 06:26 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-28 06:26 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-28 06:26 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-28 06:26 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-28 06:25 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-28 06:25 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-28 06:25 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-28 06:25 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-28 06:24 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-28 06:22 . 2009-12-28 06:22 -------- d-----w- c:\programmer\Alwil Software
2009-12-28 06:07 . 2009-12-28 06:08 30784 ----a-w- c:\windows\system32\drivers\qpdjqvxe.sys
2009-12-28 05:44 . 2009-11-02 19:42 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-12-28 05:44 . 2009-12-28 05:46 -------- d-----w- C:\e36082392344510afbde4540
2009-12-28 05:33 . 2009-12-28 15:19 46832 ----a-w- c:\documents and settings\LQV\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-12-28 05:32 . 2009-12-28 05:32 -------- d-----w- c:\documents and settings\LQV\Application Data\AVG8
2009-12-26 23:37 . 2009-12-26 23:37 -------- d-sh--w- c:\documents and settings\LQV\IETldCache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 16:08 . 2006-10-21 07:24 -------- d--h--w- c:\programmer\InstallShield Installation Information
2010-01-03 15:53 . 2007-11-06 22:05 -------- d-----w- c:\programmer\Panda Security
2010-01-03 15:51 . 2007-11-06 21:08 -------- d-----w- c:\programmer\Fælles filer\Panda Software
2010-01-03 15:47 . 2007-12-10 13:46 48 ----a-w- c:\windows\system32\drivers\wnmsav.dat
2010-01-02 22:22 . 2006-10-21 07:22 -------- d-----w- c:\programmer\Musicmatch
2010-01-02 22:10 . 2006-10-21 12:09 -------- d-----w- c:\programmer\Fælles filer\Adobe
2009-12-29 07:17 . 2006-10-29 08:07 46832 -c--a-w- c:\documents and settings\Lars Qvistgaard\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-12-28 15:07 . 2007-12-08 21:58 -------- d-----w- c:\programmer\CCleaner
2009-12-28 14:30 . 2007-02-19 20:17 -------- d-----w- c:\programmer\Fælles filer\Nikon
2009-12-09 21:46 . 1980-01-01 00:00 398348 ----a-w- c:\windows\system32\perfh006.dat
2009-12-09 21:46 . 1980-01-01 00:00 63870 ----a-w- c:\windows\system32\perfc006.dat
2009-10-29 07:43 . 1980-01-01 00:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:39 . 1980-01-01 00:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 1980-01-01 00:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 23:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:34 . 1980-01-01 00:00 270848 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 1980-01-01 00:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 1980-01-01 00:00 150016 ----a-w- c:\windows\system32\rastls.dll
2004-03-17 16:13 . 2004-03-17 16:13 1028368 ----a-w- c:\programmer\vbrun60sp6.exe
2008-09-25 10:00 . 2007-01-31 21:42 122880 ----a-w- c:\programmer\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-10-20 11:51 2846008 ----a-w- c:\programmer\MozyHome\mozyshell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-10-20 11:51 2846008 ----a-w- c:\programmer\MozyHome\mozyshell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-07-19 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-07-19 114688]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\programmer\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
"DWQueuedReporting"="c:\progra~1\FLLESF~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
c:\documents and settings\All Users\Menuen Start\Programmer\Start\
MozyHome Status.lnk - c:\programmer\MozyHome\mozystat.exe [2009-10-20 2890552]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^Adobe Reader Hurtigstart.lnk]
path=c:\documents and settings\All Users\Menuen Start\Programmer\Start\Adobe Reader Hurtigstart.lnk
backup=c:\windows\pss\Adobe Reader Hurtigstart.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 14:40 155648 ----a-w- c:\programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 14:57 282624 ----a-w- c:\programmer\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 01:43 83608 ----a-w- c:\programmer\Java\jre1.6.0_01\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [28-12-2009 07:25 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28-12-2009 07:25 20560]
S2 CISTUB;CapaInstaller Agent Service;c:\windows\system32\CISTUB.EXE [01-01-1980 01:00 316816]
S3 GoogleDesktopManager-061008-081103;Google Desktop-administrator 5.7.806.10245;c:\programmer\Google\Google Desktop Search\GoogleDesktop.exe [31-01-2007 22:41 29744]
.
.
------- Yderligere scanning -------
.
uStart Page =
https://netbank.danskebank.dk/html/index.html?site=DBNBuSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/keyword/%sIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send til &Bluetooth - c:\programmer\WIDCOMM\Bluetooth-software\btsendto_ie_ctx.htm
Trusted Zone: dr.dk
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} -
hxxps://www.lsb.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cabDPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} -
hxxps://netbank.danskebank.dk/html/activex/DB/Menu.cabDPF: {D8575CE3-3432-4540-88A9-85A1325D3375} -
hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cabFF - ProfilePath - c:\documents and settings\Lars Qvistgaard\Application Data\Mozilla\Firefox\Profiles\83ebixhv.default\
FF - prefs.js: browser.startup.homepage -
hxxp://www.google.dk/igFF - component: c:\programmer\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\programmer\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\programmer\Mozilla Firefox\plugins\NPAdbESD.dll
---- FIREFOX POLITIKKER ----
c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".dk");
.
- - - - TOMME GENVEJE FJERNET - - - -
Notify-avldr - avldr.dll
MSConfigStartUp-MimBoot - c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe
MSConfigStartUp-MMTray - c:\programmer\Musicmatch\Musicmatch Jukebox\mm_tray.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-03 18:55
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'explorer.exe'(700)
c:\programmer\MozyHome\mozyshell.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\programmer\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\programmer\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\programmer\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_dan.nlr
c:\programmer\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\programmer\Alwil Software\Avast4\aswUpdSv.exe
c:\programmer\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\programmer\WIDCOMM\Bluetooth-software\bin\btwdins.exe
c:\programmer\MozyHome\mozybackup.exe
c:\programmer\Alwil Software\Avast4\ashMaiSv.exe
c:\programmer\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\igfxsrvc.exe
c:\programmer\Fælles filer\Ahead\Lib\NMIndexStoreSvr.exe
c:\programmer\Fælles filer\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Gennemført tid: 2010-01-03 19:03:47 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-01-03 18:03
ComboFix2.txt 2010-01-02 18:28
Pre-Kørsel: 7.289.883.648 byte ledig
Post-Kørsel: 7.257.090.048 byte ledig
- - End Of File - - 5FC7A1A75EF54BF855F4060C0CDD5011
Ny bruger
Nybegynder
Opret
Preview
