Combofix log:
ComboFix 10-02-27.04 - Peter 27-02-2010 19:45:02.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.45.1030.18.3581.2113 [GMT 1:00]
Kører fra: c:\users\Peter\Desktop\ComboFix.exe
Kommandoer benyttet :: c:\users\Peter\Desktop\CFScript.txt.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1262429951-3862704640-1477892027-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3760575259-3998885095-2510980084-500
c:\programdata\hpeF23.dll
c:\users\Peter\AppData\Roaming\WinDefence
c:\windows\system32\NlsData0024.dll
c:\windows\system32\OLE2SYS2.DLL
c:\windows\system32\SOCKETX.DLL
c:\windows\system32\stacsv.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_STacSV
((((((((((((((((((((((((((((( Filer skabt fra 2010-01-27 til 2010-02-27 )))))))))))))))))))))))))))))))))))
.
2010-02-27 19:00 . 2010-02-27 19:06 -------- d-----w- c:\users\Peter\AppData\Local\temp
2010-02-27 19:00 . 2010-02-27 19:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-27 19:00 . 2010-02-27 19:00 -------- d-----w- c:\users\Yasmin\AppData\Local\temp
2010-02-27 18:59 . 2010-02-27 18:59 -------- d-----w- c:\users\Raghad\AppData\Local\temp
2010-02-27 18:59 . 2010-02-27 18:59 -------- d-----w- c:\users\Oscar\AppData\Local\temp
2010-02-27 14:05 . 2010-02-27 14:05 -------- d-----w- c:\users\Peter\AppData\Roaming\Malwarebytes
2010-02-27 14:04 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-27 14:04 . 2010-02-27 14:04 -------- d-----w- c:\programdata\Malwarebytes
2010-02-27 14:04 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-27 14:04 . 2010-02-27 14:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-26 10:33 . 2010-02-26 14:25 -------- d-----w- c:\programdata\NOS
2010-02-24 19:18 . 2010-02-24 19:18 -------- d-----w- c:\programdata\GlobalSCAPE
2010-02-23 18:18 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-23 18:17 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-23 18:17 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-23 18:17 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-23 18:17 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-23 18:17 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-23 18:17 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-23 18:17 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-23 18:17 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-23 18:17 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-23 18:17 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-23 18:17 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-23 18:17 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-02-14 18:38 . 2010-02-14 18:38 -------- d-----w- c:\users\Oscar\AppData\Local\Sony Ericsson
2010-02-13 12:47 . 2010-02-13 12:47 -------- d-----w- c:\users\Peter\AppData\Local\Sony Ericsson
2010-02-13 12:47 . 2010-02-13 12:47 -------- d-----w- c:\programdata\BVRP Software
2010-02-13 12:38 . 2008-10-21 08:22 26024 ----a-w- c:\windows\system32\drivers\s0017nd5.sys
2010-02-13 12:38 . 2008-10-21 08:22 15016 ----a-w- c:\windows\system32\drivers\s0017mdfl.sys
2010-02-13 12:38 . 2008-10-21 08:22 12200 ----a-w- c:\windows\system32\drivers\s0017whnt.sys
2010-02-13 12:38 . 2008-10-21 08:22 12200 ----a-w- c:\windows\system32\drivers\s0017wh.sys
2010-02-13 12:38 . 2008-10-21 08:22 114600 ----a-w- c:\windows\system32\drivers\s0017mdm.sys
2010-02-13 12:38 . 2008-10-21 08:22 109736 ----a-w- c:\windows\system32\drivers\s0017unic.sys
2010-02-13 12:38 . 2008-10-21 08:22 108328 ----a-w- c:\windows\system32\drivers\s0017mgmt.sys
2010-02-13 12:38 . 2008-10-21 08:22 104616 ----a-w- c:\windows\system32\drivers\s0017obex.sys
2010-02-13 12:38 . 2008-10-21 08:22 86824 ----a-w- c:\windows\system32\drivers\s0017bus.sys
2010-02-13 12:38 . 2008-10-21 08:22 12200 ----a-w- c:\windows\system32\drivers\s0017cmnt.sys
2010-02-13 12:38 . 2008-10-21 08:22 12200 ----a-w- c:\windows\system32\drivers\s0017cm.sys
2010-02-13 12:38 . 2008-10-21 08:22 10792 ----a-w- c:\windows\system32\drivers\s0017cr.sys
2010-02-13 12:37 . 2010-02-13 12:37 -------- d-----w- c:\programdata\Sony Ericsson
2010-02-13 12:37 . 2010-02-13 12:37 -------- d-----w- c:\program files\Sony Ericsson
2010-02-11 08:15 . 2010-02-25 11:42 -------- d-----w- c:\users\Raghad\AppData\Local\CrashDumps
2010-02-10 17:22 . 2010-02-18 18:54 -------- d-----w- c:\users\Oscar\AppData\Local\CrashDumps
2010-02-08 19:09 . 2010-02-08 19:09 -------- d-----w- c:\program files\3D-FTP
2010-02-08 19:09 . 2010-02-08 21:04 -------- d-----w- c:\programdata\3D-FTP
2010-02-08 19:00 . 2010-02-08 19:01 -------- d-----w- c:\users\Peter\AppData\Local\Deployment
2010-02-08 19:00 . 2010-02-08 19:00 -------- d-----w- c:\users\Peter\AppData\Local\Apps
2010-02-08 17:52 . 2010-02-08 17:52 -------- d-----w- c:\program files\Common Files\Skype
2010-02-08 17:44 . 2009-04-07 12:50 23720 ----a-w- c:\windows\system32\novamnv6.dll
2010-02-08 17:44 . 2009-04-07 12:50 18600 ----a-w- c:\windows\system32\novamiv6.dll
2010-02-08 17:43 . 2010-02-08 17:44 -------- d-----w- c:\program files\PamFax
2010-02-08 17:33 . 2010-02-27 17:46 -------- d-----w- c:\users\Peter\AppData\Local\CrashDumps
2010-02-08 14:48 . 2010-02-08 14:47 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-02-08 14:47 . 2010-02-08 14:48 -------- d-----w- c:\program files\Symantec
2010-02-08 14:45 . 2010-02-09 16:11 -------- d-----w- c:\windows\system32\drivers\NIS
2010-02-08 14:45 . 2010-02-08 14:45 -------- d-----w- c:\program files\Norton Internet Security
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 19:03 . 2009-10-29 14:54 150783 ----a-w- c:\programdata\nvModes.dat
2010-02-27 19:01 . 2008-06-09 19:32 5332 ----a-w- c:\windows\bthservsdp.dat
2010-02-27 16:14 . 2008-07-15 09:57 -------- d-----w- c:\programdata\Roxio
2010-02-27 15:52 . 2008-07-15 09:44 182954 ----a-w- c:\windows\hpoins21.dat
2010-02-27 15:14 . 2009-02-15 12:59 -------- d-----w- c:\programdata\NVIDIA
2010-02-27 12:10 . 2009-08-01 21:07 -------- d-----w- c:\users\Peter\AppData\Roaming\GoodSync
2010-02-27 00:50 . 2008-06-09 19:45 -------- d-----w- c:\program files\Common Files\Java
2010-02-27 00:49 . 2008-06-09 19:45 -------- d-----w- c:\program files\Java
2010-02-26 22:20 . 2009-02-21 21:24 -------- d-----w- c:\programdata\Google Updater
2010-02-26 14:38 . 2006-11-21 04:49 78210 ----a-w- c:\windows\system32\perfc006.dat
2010-02-26 14:38 . 2006-11-21 04:49 466378 ----a-w- c:\windows\system32\perfh006.dat
2010-02-26 10:36 . 2010-02-26 10:36 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbF76F.tmp.exe
2010-02-26 10:34 . 2008-06-09 19:54 -------- d-----w- c:\program files\Google
2010-02-26 10:34 . 2010-02-26 10:34 1955472 ----a-w- c:\programdata\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-02-26 07:44 . 2008-06-23 17:37 147056 ----a-w- c:\users\Oscar\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-25 19:07 . 2008-07-17 13:47 7592 ----a-w- c:\users\Peter\AppData\Local\d3d9caps.dat
2010-02-24 20:47 . 2008-06-29 17:56 147056 ----a-w- c:\users\Raghad\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-24 18:54 . 2008-06-23 16:38 147056 ----a-w- c:\users\Peter\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-18 14:54 . 2010-01-21 18:12 -------- d-----w- c:\users\Peter\AppData\Roaming\HPAppData
2010-02-13 12:51 . 2010-02-13 12:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-13 12:37 . 2008-06-09 19:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-13 10:07 . 2009-06-27 16:36 -------- d-----w- c:\users\Peter\AppData\Roaming\Skype
2010-02-13 10:00 . 2009-06-27 19:29 -------- d-----w- c:\users\Peter\AppData\Roaming\skypePM
2010-02-11 18:44 . 2010-02-11 18:44 201616 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHRules.dll
2010-02-11 18:44 . 2010-02-11 18:44 1406352 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHEngine.dll
2010-02-11 18:44 . 2010-02-11 18:44 676912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHDrvx64.sys
2010-02-11 18:44 . 2010-02-11 18:44 536112 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHDrvx86.sys
2010-02-11 18:44 . 2010-02-11 18:44 611216 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\bbRGen.dll
2010-02-11 10:22 . 2010-02-27 18:01 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\NAVENG.SYS
2010-02-11 10:22 . 2010-02-27 18:01 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\NAVENG32.DLL
2010-02-11 10:22 . 2010-02-27 18:01 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\NAVEX32A.DLL
2010-02-11 10:22 . 2010-02-27 18:01 1324720 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\NAVEX15.SYS
2010-02-11 10:22 . 2010-02-27 18:01 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\EECTRL.SYS
2010-02-11 10:22 . 2010-02-27 18:01 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\CCERASER.DLL
2010-02-11 10:22 . 2010-02-27 18:01 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\ECMSVR32.DLL
2010-02-11 10:22 . 2010-02-27 18:01 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100227.007\ERASER.SYS
2010-02-10 19:03 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-10 15:45 . 2008-07-15 10:17 -------- d-----w- c:\programdata\Microsoft Help
2010-02-08 17:53 . 2009-06-27 16:36 -------- d-----r- c:\program files\Skype
2010-02-08 17:52 . 2009-06-27 16:36 -------- d-----w- c:\programdata\Skype
2010-02-08 17:41 . 2010-02-08 17:41 51577 ----a-w- c:\programdata\Skype\Plugins\Plugins\76DD75F4114D4980AA886269FB262203\uninstall.exe
2010-02-08 17:41 . 2010-02-08 17:41 69632 ----a-w- c:\programdata\Skype\Plugins\Plugins\76DD75F4114D4980AA886269FB262203\StartFaxExtra.exe
2010-02-08 17:41 . 2010-02-08 17:41 124224 ----a-w- c:\programdata\Skype\Plugins\Plugins\76DD75F4114D4980AA886269FB262203\FaxExtraSetup.exe
2010-02-08 14:54 . 2008-06-09 19:59 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-08 14:50 . 2009-02-28 16:28 -------- d-----w- c:\programdata\Norton
2010-02-08 14:47 . 2010-02-08 14:48 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-02-08 14:47 . 2010-02-08 14:48 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-02-08 14:37 . 2009-02-28 16:28 -------- d-----w- c:\programdata\NortonInstaller
2010-02-07 17:14 . 2010-01-24 20:49 -------- d-----w- c:\users\Peter\AppData\Roaming\FileZilla
2010-02-06 20:02 . 2009-05-06 19:13 -------- d-----w- c:\program files\NewsLeecher
2010-02-03 05:17 . 2010-02-03 05:17 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbBBA2.tmp.exe
2010-01-24 20:49 . 2010-01-24 20:49 -------- d-----w- c:\program files\FileZilla FTP Client
2010-01-23 14:27 . 2009-04-06 18:44 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-14 17:02 . 2010-01-14 16:59 23700 ----a-w- c:\windows\hpqins15.dat
2010-01-02 06:38 . 2010-01-22 14:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 14:49 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-01-22 14:49 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-01-22 14:49 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-23 14:33 . 2008-06-24 12:19 146488 ----a-w- c:\users\Yasmin\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-21 13:48 . 2009-12-21 13:48 10134 ----a-r- c:\users\Peter\AppData\Roaming\Microsoft\Installer\{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}\ARPPRODUCTICON.exe
2009-12-17 16:14 . 2009-06-21 10:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-11 11:43 . 2010-02-10 13:50 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-11 11:43 . 2010-02-10 13:50 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-12-10 03:16 . 2010-02-08 14:50 784752 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
2009-12-08 20:01 . 2010-02-10 13:50 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-10 13:50 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-10 13:50 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-10 13:50 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-05 11:30 . 2009-12-05 11:22 78106 ----a-w- c:\windows\hpqins05.dat
2009-12-04 18:30 . 2010-02-10 13:50 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-10 13:50 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-10 13:50 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-10 13:50 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-10 13:50 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-10 13:50 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-10 13:50 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-10 13:50 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-10 13:50 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-12-04 15:56 . 2010-02-10 13:50 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-12-04 15:56 . 2010-02-10 13:50 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-04 15:29 . 2009-12-04 15:29 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbAEA.tmp.exe
2008-06-09 19:51 . 2008-06-09 19:51 76 --sh--r- c:\windows\CT4CET.bin
2008-06-10 03:18 . 2008-06-10 03:03 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-27 247144]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-11-20 434176]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-09 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-03 36864]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-10 30192]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"MBBalloon"="c:\program files\HOTALBUMMyBOX\MBBalloon.exe" [2007-11-30 789144]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-11-20 178688]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-01-02 405504]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatchTray12.exe" [2009-07-24 240112]
"CPMonitor"="c:\program files\Roxio 2010\5.0\CPMonitor.exe" [2009-07-21 84464]
"Desktop Disc Tool"="c:\program files\Roxio 2010\Roxio Burn\RoxioBurnLauncher.exe" [2009-06-23 494064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-16 13793824]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-06-16 92704]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]
c:\users\Yasmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Screen Clipper and Launcher til OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Screen Clipper and Launcher til OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-6-9 50688]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
PHOTOfunSTUDIO -viewer-.lnk - c:\program files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe [2008-12-25 40960]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2008-6-9 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(b):35,fd,fb,80,34,3e,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1262429951-3862704640-1477892027-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
R0 PzWDM;PzWDM;c:\windows\System32\drivers\PzWDM.sys [20-12-2008 14:17 15172]
R0 SymDS;Symantec Data Store;c:\windows\System32\drivers\NIS\1105000.07F\symds.sys [08-02-2010 16:02 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1105000.07F\symefa.sys [08-02-2010 16:02 172592]
R1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHDrvx86.sys [11-02-2010 19:44 536112]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1105000.07F\cchpx86.sys [08-02-2010 16:02 501888]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100224.002\IDSvix86.sys [26-02-2010 08:55 343088]
R1 SymIRON;Symantec Iron Driver;c:\windows\System32\drivers\NIS\1105000.07F\ironx86.sys [08-02-2010 16:02 116272]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\drivers\NIS\1105000.07F\symtdiv.sys [08-02-2010 16:02 340016]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [09-06-2008 20:31 73728]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe [08-02-2010 16:02 126392]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [13-02-2010 13:37 90112]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [27-08-2009 16:05 92008]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [08-02-2010 19:39 102448]
S2 gupdate1c9946ae2471f01;Tjenesten Google Update (gupdate1c9946ae2471f01);c:\program files\Google\Update\GoogleUpdate.exe [21-02-2009 22:25 133104]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe [24-07-2009 08:33 219632]
S3 GoogleDesktopManager-110309-193829;Google Desktop-administrator 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [09-06-2008 20:54 30192]
S3 RoxMediaDB12;RoxMediaDB12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe [24-07-2009 08:33 1116656]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\System32\drivers\s0017bus.sys [13-02-2010 13:38 86824]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\System32\drivers\s0017mdfl.sys [13-02-2010 13:38 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\System32\drivers\s0017mdm.sys [13-02-2010 13:38 114600]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0017mgmt.sys [13-02-2010 13:38 108328]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\System32\drivers\s0017nd5.sys [13-02-2010 13:38 26024]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\System32\drivers\s0017obex.sys [13-02-2010 13:38 104616]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\System32\drivers\s0017unic.sys [13-02-2010 13:38 109736]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Indhold af mappen 'Planlagte Opgaver'
2010-02-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-09 20:50]
2010-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 21:25]
2010-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 21:25]
2010-02-22 c:\windows\Tasks\Norton Internet Security - Kør Fuld systemskanning - Peter.job
- c:\program files\Norton Internet Security\Engine\17.5.0.127\navw32.exe [2010-02-08 06:08]
2010-02-27 c:\windows\Tasks\WebReg Photosmart C7200 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-10-14 18:40]
.
.
------- Yderligere scanning -------
.
uStart Page =
hxxp://www.google.dk/ig/dell?hl=da&client=dell-row&channel=dk&ibd=5080610IE: Google Sidewiki ... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: danid.dk
Trusted Zone: danskebank.dk
Trusted Zone: himmerland.dk\www
Trusted Zone: portalbank.dk\www
Trusted Zone: sparhim.dk\www
Trusted Zone: testby.dk\www
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} -
hxxps://www.himmerland.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cabDPF: {D8575CE3-3432-4540-88A9-85A1325D3375} -
hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-02-27 20:06
Windows 6.0.6002 Service Pack 2 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.netdevice: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85CB0170]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8bda1d24
\Driver\ACPI -> acpi.sys @ 0x80693d68
\Driver\atapi -> ataport.SYS @ 0x82d72a2c
\Driver\iaStor -> iastor.sys @ 0x82cb1c1a
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.5.0.127\diMaster.dll\" /prefetch:1"
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'Explorer.exe'(3208)
c:\windows\system32\btncopy.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\conime.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Gennemført tid: 2010-02-27 20:18:28 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-02-27 19:18
Pre-Kørsel: 54.255.255.552 byte ledig
Post-Kørsel: 56.304.033.792 byte ledig
- - End Of File - - 52FE416C89091657FA0472725FBB14CF