hj log
hejsa - hvordan ser disse ud?ComboFix 10-04-29.05 - Mikes PC 30-04-2010 22:52:36.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.45.1030.18.991.555 [GMT 2:00]
Kører fra: c:\documents and settings\Mikes PC\Dokumenter\safe\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Mikes PC\Dokumenter\safe\CFScript.txt
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((( Filer skabt fra 2010-03-28 til 2010-04-30 )))))))))))))))))))))))))))))))))))
.
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\documents and settings\Mikes PC\Application Data\Malwarebytes
2010-04-30 20:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-30 20:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-30 20:04 . 2010-04-30 20:04 -------- d-----w- c:\programmer\CCleaner
2010-04-30 19:48 . 2004-08-26 15:53 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-04-30 19:48 . 2004-08-26 15:53 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-04-30 19:48 . 2004-08-26 15:49 14848 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-04-30 19:48 . 2004-08-26 15:49 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-30 19:49 . 2004-08-27 12:00 47474 ----a-w- c:\windows\system32\perfc006.dat
2010-04-30 19:49 . 2004-08-27 12:00 325198 ----a-w- c:\windows\system32\perfh006.dat
2010-02-11 18:38 . 2010-02-11 18:28 117120 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2010-02-11 18:29 . 2009-04-20 20:00 105216 ----a-w- c:\windows\system32\drivers\EMCR7SK.sys
2010-02-11 18:27 . 2010-02-11 18:28 9728 ----a-w- c:\windows\system32\RtNicProp32.dll
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-27 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCTVOICE"="pctspk.exe" [2003-11-06 180224]
"SynTPLpr"="c:\programmer\Synaptics\SynTP\SynTPLpr.exe" [2003-09-26 98304]
"SynTPEnh"="c:\programmer\Synaptics\SynTP\SynTPEnh.exe" [2003-09-26 503808]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2010-02-11 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2010-02-11 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2010-02-11 118784]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-27 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [20-04-2009 22:00 105216]
.
Indhold af mappen 'Planlagte Opgaver'
2010-04-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-11-15 21:18]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-30 22:56
Windows 5.1.2600 Service Pack 2 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'explorer.exe'(3496)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\pctspk.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\programmer\Internet Explorer\IEXPLORE.EXE
c:\programmer\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Gennemført tid: 2010-04-30 22:59:46 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-04-30 20:59
Pre-Kørsel: 31.843.983.360 byte ledig
Post-Kørsel: 31.809.720.320 byte ledig
- - End Of File - - 6DD795D25CC77F75A0177BC62564B388
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:03:39, on 30-04-2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmer\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exae
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
--
End of file - 2387 bytes
