ComboFix 10-01-12.05 - lykkk lindhardtsen 13-01-2010 22:15:46.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.45.1030.18.1918.1214 [GMT 1:00]
Kører fra: c:\users\lykkk lindhardtsen\Desktop\ComboFix.exe
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-706447487-3534836695-3561498142-500
C:\ARK2906.tmp
C:\ARK4CDA.tmp
C:\ARK6F46.tmp
C:\ARK9379.tmp
C:\ARKEAF1.tmp
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\system32\SIntf16.dll
.
((((((((((((((((((((((((((((( Filer skabt fra 2009-12-13 til 2010-01-13 )))))))))))))))))))))))))))))))))))
.
2010-01-13 21:31 . 2010-01-13 21:31 -------- d-----w- c:\users\lykkk lindhardtsen\AppData\Local\temp
2010-01-13 16:36 . 2010-01-13 16:43 -------- d-----w- C:\2319858cd07816f6664fe004
2010-01-13 13:20 . 2009-10-19 14:42 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 13:20 . 2009-10-19 14:37 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-01-13 13:20 . 2009-10-19 14:39 24064 ----a-w- c:\windows\system32\lpk.dll
2010-01-13 13:20 . 2009-10-19 14:37 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-01-13 13:20 . 2009-10-19 14:36 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-01-13 13:20 . 2009-10-19 11:45 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-01-07 15:07 . 2009-08-27 08:00 84912 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\NAVENG.SYS
2010-01-07 15:07 . 2009-08-27 08:00 177520 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\NAVENG32.DLL
2010-01-07 15:07 . 2009-08-27 08:00 1647984 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\NAVEX32A.DLL
2010-01-07 15:07 . 2009-08-27 08:00 1323568 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\NAVEX15.SYS
2010-01-07 15:07 . 2009-10-19 08:00 259440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\ECMSVR32.DLL
2010-01-07 15:07 . 2009-08-27 08:00 371248 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\EECTRL.SYS
2010-01-07 15:07 . 2009-08-27 08:00 102448 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\ERASER.SYS
2010-01-07 15:07 . 2009-12-14 09:00 2747440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100106.002\CCERASER.DLL
2010-01-06 21:44 . 2010-01-06 21:44 -------- d-----w- c:\users\lykkk lindhardtsen\AppData\Roaming\Malwarebytes
2010-01-06 21:44 . 2009-12-30 13:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-06 21:43 . 2010-01-06 21:43 -------- d-----w- c:\programdata\Malwarebytes
2010-01-06 21:43 . 2009-12-30 13:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 21:43 . 2010-01-06 21:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-06 18:42 . 2010-01-06 18:42 -------- d-----w- C:\ATI
2010-01-06 18:12 . 2010-01-06 18:12 -------- d-----w- c:\program files\CCleaner
2010-01-03 21:40 . 2010-01-03 21:40 -------- d-----w- C:\$AVG
2010-01-03 21:38 . 2010-01-03 21:38 -------- d-----w- c:\program files\AVG
2010-01-03 21:37 . 2010-01-13 20:52 -------- d-----w- c:\programdata\avg9
2009-12-19 23:50 . 2009-12-19 23:50 -------- d-----w- c:\programdata\PokerHost
2009-12-19 23:31 . 2009-12-19 23:50 -------- d-----w- c:\users\lykkk lindhardtsen\AppData\Local\PokerHost
2009-12-19 23:31 . 2010-01-04 16:58 -------- d---a-w- c:\program files\PokerHost
2009-12-19 17:00 . 2009-12-19 17:00 -------- d-----w- c:\windows\system32\drivers\NSS
2009-12-19 14:54 . 2009-12-19 14:54 -------- d-----w- c:\users\lykkk lindhardtsen\AppData\Local\SupportSoft
2009-12-19 14:53 . 2009-12-19 14:53 -------- d-----w- c:\program files\Common Files\SupportSoft
2009-12-19 12:49 . 2009-12-19 12:49 396552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-13 16:44 . 2008-03-26 14:53 -------- d-----w- c:\programdata\Microsoft Help
2010-01-13 16:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-07 15:12 . 2009-08-02 16:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-07 13:10 . 2009-02-13 14:38 -------- d-----w- c:\program files\Common Files\Nero
2010-01-07 00:17 . 2009-02-13 14:38 -------- d-----w- c:\programdata\Nero
2010-01-06 21:49 . 2008-03-26 14:51 -------- d-----w- c:\program files\Nero
2010-01-06 19:59 . 2008-05-25 12:27 -------- d-----w- c:\program files\BitComet
2010-01-03 19:01 . 2009-11-25 16:41 439816 ----a-w- c:\users\lykkk lindhardtsen\AppData\Roaming\Real\Update\setup3.09\setup.exe
2009-12-31 16:15 . 2008-03-27 11:29 -------- d-----w- c:\users\lykkk lindhardtsen\AppData\Roaming\LimeWire
2009-12-31 16:09 . 1999-09-10 18:25 80598 ----a-w- c:\windows\system32\perfc006.dat
2009-12-31 16:09 . 1999-09-10 18:25 485894 ----a-w- c:\windows\system32\perfh006.dat
2009-12-25 21:44 . 2008-03-26 14:47 106072 ----a-w- c:\users\lykkk lindhardtsen\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-20 22:31 . 2009-03-18 14:28 -------- d-----w- c:\program files\Full Tilt Poker
2009-12-20 21:25 . 2009-01-03 16:08 -------- d-----w- c:\program files\PokerStars
2009-12-19 17:00 . 2009-07-15 16:01 -------- d-----w- c:\programdata\Norton
2009-12-19 17:00 . 2008-06-23 19:36 -------- d-----w- c:\program files\Norton Security Scan
2009-12-19 17:00 . 2009-07-15 16:00 -------- d-----w- c:\programdata\NortonInstaller
2009-12-19 12:43 . 2008-03-27 17:09 -------- d-----w- c:\programdata\Lx_cats
2009-12-14 09:00 . 2009-12-14 09:00 2747440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\CCERASER.DLL
2009-11-26 02:31 . 2009-11-26 02:31 118784 ----a-w- c:\users\lykkk lindhardtsen\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\compat.dll
2009-11-21 06:40 . 2009-12-09 11:43 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 11:42 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 06:34 . 2009-12-09 11:42 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 04:59 . 2009-12-09 11:42 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-09 13:34 . 2009-12-10 02:24 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 13:30 . 2009-12-10 02:24 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 11:17 . 2009-12-10 02:24 396800 ----a-w- c:\windows\system32\drivers\http.sys
2009-11-02 19:42 . 2009-10-05 11:27 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:59 . 2009-11-25 15:13 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-19 08:00 . 2009-10-19 08:00 259440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ECMSVR32.DLL
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-30 1232896]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [1999-09-10 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 4317184]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]
"lxdemon.exe"="c:\program files\Lexmark 4800 Series\lxdemon.exe" [2007-06-11 455600]
"lxdeamon"="c:\program files\Lexmark 4800 Series\lxdeamon.exe" [2007-06-01 20480]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-06-11 316336]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"fssui"="c:\program files\Windows Live\Familiesikkerhed\fssui.exe" [2007-12-17 243240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-03-14 233472]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-08 198160]
c:\users\lykkk lindhardtsen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Screen Clipper and Launcher til OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [31-03-2008 13:03 43816]
R2 fsssvc;Windows Live OneCare Familiesikkerhed;c:\program files\Windows Live\Familiesikkerhed\fsssvc.exe [17-12-2007 10:13 523816]
R2 lxde_device;lxde_device;c:\windows\system32\lxdecoms.exe -service --> c:\windows\system32\lxdecoms.exe -service [?]
R2 lxdeCATSCustConnectService;lxdeCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdeserv.exe [29-05-2007 10:06 99248]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [12-10-2008 21:08 682232]
S2 gupdate1c9b87c9f350f80;Tjenesten Google Update (gupdate1c9b87c9f350f80);c:\program files\Google\Update\GoogleUpdate.exe [08-04-2009 20:02 133104]
S3 USBAAPL;Apple Mobile USB Driver;c:\windows\System32\drivers\usbaapl.sys [10-07-2008 08:35 32000]
.
Indhold af mappen 'Planlagte Opgaver'
2010-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 19:02]
2010-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 19:02]
2010-01-07 c:\windows\Tasks\Norton Security Scan for lykkk lindhardtsen.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.0.52\Nss.exe [2009-12-19 17:00]
2008-04-12 c:\windows\Tasks\Søg efter opdateringer til Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]
2010-01-13 c:\windows\Tasks\User_Feed_Synchronization-{AF1DCF58-F507-4269-9F99-06767B62FAE4}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
.
.
------- Yderligere scanning -------
.
uStart Page =
hxxp://www.google.dk/ig?hl=dauInternet Settings,ProxyOverride = *.local
IE: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxIE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: nordea.dk\www.netbank
.
- - - - TOMME GENVEJE FJERNET - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ActiveSetup-ccc-core-static - msiexec
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-13 22:31
Windows 6.0.6000 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_USERS\S-1-5-21-459768594-2558343858-3368177966-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3c,2e,a4,9e,22,37,6e,fc,4c,0c,07,ff,7d,0d,8d,f0,8e,a2,ad,9f,b8,30,25,
85,3d,1f,81,34,7e,78,93,d8,d8,1d,10,d1,a8,c5,c0,d1,cb,a1,08,4b,ba,ef,87,c9,\
"??"=hex:b9,b5,d8,18,93,e3,5d,9f,fa,f2,a3,b3,4b,9d,0b,82
[HKEY_USERS\S-1-5-21-459768594-2558343858-3368177966-1000\Software\SecuROM\License information*]
"datasecu"=hex:24,ef,f2,1e,4b,96,9b,44,0c,cd,6e,fa,23,ef,3a,d4,a4,5c,38,77,50,
d6,24,49,2c,ab,a9,4e,08,c1,49,c3,f4,07,5e,2e,c8,64,4f,b7,fe,f4,c2,a4,39,23,\
"rkeysecu"=hex:8e,a3,4a,90,3a,38,00,52,89,cc,fc,72,2c,20,8f,51
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Gennemført tid: 2010-01-13 22:37:48
ComboFix-quarantined-files.txt 2010-01-13 21:37
Pre-Kørsel: 54.437.859.328 byte ledig
Post-Kørsel: 54.191.390.720 byte ledig
- - End Of File - - 3DDC2036AACB3DB3DA8BA9E956BFCC15
