ComboFix 10-09-11.03 - KB 12-09-2010 15:12:41.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.1023.452 [GMT 2:00]
Kører fra: g:\ny mappe\banan.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\hpeF1C.dll
c:\documents and settings\KB\Lokale indstillinger\Application Data\Windows Server
c:\documents and settings\KB\Lokale indstillinger\Application Data\Windows Server\admin.txt
c:\documents and settings\KB\Lokale indstillinger\Application Data\Windows Server\server.dat
C:\googlemaps.exe
c:\googlemaps.exe\config.bin
c:\programmer\ErrorSmart
c:\programmer\screensavers.com
c:\programmer\screensavers.com\Installer\bin\siuninst.exe
c:\windows\cfdrive32.exe
c:\windows\daemon.dll
c:\windows\system32\dlo2F.dll
c:\windows\system32\dlo2F.tmp
c:\windows\system32\drivers\didpveon.sys
c:\windows\system32\drivers\gpjrdlen.sys
c:\windows\system32\rgzbb.dll
c:\windows\system32\winrtsnr.txt
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll.cla
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
.
((((((((((((((((((((((((((((((((((((((( Drivers/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GLKKGCLY
-------\Legacy_GPJRDLEN
-------\Legacy_SSHNAS
-------\Service_glkkgcly
-------\Service_gpjrdlen
-------\Service_SSHNAS
((((((((((((((((((((((((((((( Filer skabt fra 2010-08-12 til 2010-09-12 )))))))))))))))))))))))))))))))))))
.
2010-09-12 11:48 . 2010-09-12 11:48 -------- d-----w- c:\programmer\VS Revo Group
2010-09-11 21:06 . 2010-09-11 21:06 -------- d-----w- c:\documents and settings\KB\Application Data\Malwarebytes
2010-09-11 21:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-11 21:06 . 2010-09-11 21:06 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2010-09-11 21:06 . 2010-09-11 21:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-11 21:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-11 19:11 . 2010-09-11 19:11 -------- d-----w- c:\programmer\CCleaner
2010-09-11 14:36 . 2010-09-11 14:36 -------- dc----w- c:\documents and settings\All Users\Application Data\{437292BE-95BD-4B12-B699-6D217A03ACAF}
2010-09-11 14:23 . 2010-09-11 14:23 -------- d-----w- c:\documents and settings\KB\Lokale indstillinger\Application Data\Threat Expert
2010-09-11 13:48 . 2010-09-11 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-09-11 13:30 . 2008-04-14 15:05 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-09-11 13:30 . 2001-10-04 15:07 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-09-11 13:30 . 2008-04-14 15:05 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-09-11 13:30 . 2001-10-04 15:07 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-09-11 13:30 . 2001-10-04 15:07 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-09-11 13:30 . 2001-08-18 04:37 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2010-09-11 13:30 . 2001-08-17 18:11 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-09-11 13:30 . 2004-08-04 04:29 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-09-11 13:28 . 2001-08-17 19:28 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2010-09-11 13:27 . 2001-10-04 15:07 24660 -c--a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-09-11 13:26 . 2001-10-04 15:06 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2010-09-11 13:25 . 2001-08-17 20:07 19840 -c--a-w- c:\windows\system32\dllcache\philtune.sys
2010-09-11 13:24 . 2001-08-17 18:50 103296 -c--a-w- c:\windows\system32\dllcache\mtxvideo.sys
2010-09-11 13:23 . 2001-08-17 19:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
2010-09-11 13:22 . 2001-10-04 15:07 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2010-09-11 13:21 . 2001-10-04 15:07 68608 -c--a-w- c:\windows\system32\dllcache\hpgt53tk.dll
2010-09-11 13:20 . 2001-08-17 18:10 19996 -c--a-w- c:\windows\system32\dllcache\em556n4.sys
2010-09-11 13:19 . 2001-10-04 15:07 27648 -c--a-w- c:\windows\system32\dllcache\cyzcoins.dll
2010-09-11 13:18 . 2001-08-17 19:52 7680 -c--a-w- c:\windows\system32\dllcache\cd20xrnt.sys
2010-09-11 13:17 . 2001-10-04 14:32 39680 -c--a-w- c:\windows\system32\dllcache\brparwdm.sys
2010-09-11 13:16 . 2001-08-17 20:07 101888 -c--a-w- c:\windows\system32\dllcache\adpu160m.sys
2010-09-11 13:04 . 2004-08-04 04:31 20992 -c--a-w- c:\windows\system32\dllcache\rtl8139.sys
2010-09-11 13:04 . 2004-08-04 04:31 20992 ----a-w- c:\windows\system32\drivers\RTL8139.sys
2010-09-11 11:52 . 2010-09-11 11:52 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-07 11:14 . 2010-09-11 06:08 -------- d-----w- c:\documents and settings\KB\Lokale indstillinger\Application Data\vryyyfmct
2010-09-07 11:14 . 2010-09-07 11:14 -------- d-----w- c:\documents and settings\KB\Application Data\9420B89BA105A7EFEE6ECAA9C4871986
2010-09-06 17:32 . 2010-09-11 06:04 -------- d-sh--r- c:\documents and settings\KB\Application Data\S-2535-6853-2745
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-11 21:48 . 2003-04-25 12:00 515878 ----a-w- c:\windows\system32\perfh006.dat
2010-09-11 21:48 . 2003-04-25 12:00 103454 ----a-w- c:\windows\system32\perfc006.dat
2010-09-11 21:03 . 2005-01-06 15:51 -------- d--h--w- c:\programmer\InstallShield Installation Information
2010-09-11 21:03 . 2005-01-06 15:51 -------- d-----w- c:\programmer\Logitech
2010-09-11 21:00 . 2005-01-05 23:50 -------- d-----w- c:\programmer\Fælles filer\Symantec Shared
2010-09-11 14:31 . 2010-02-20 09:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-11 14:27 . 2009-08-30 16:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-09-11 14:27 . 2008-09-15 15:47 -------- d-----w- c:\programmer\Norton Security Scan
2010-09-11 14:25 . 2006-11-30 19:21 -------- d-----w- c:\programmer\Google
2010-09-11 13:55 . 2010-09-11 13:54 716236 ----a-w- c:\windows\system32\drivers\Cat.DB
2010-09-11 13:49 . 2010-09-11 13:48 76704960 ----a-w- c:\documents and settings\All Users\Application Data\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_dl.exe
2010-09-11 10:37 . 2006-02-16 16:31 -------- d-----w- c:\documents and settings\KB\Application Data\MSN6
2010-09-11 09:29 . 2008-11-14 21:36 -------- d-----w- c:\programmer\Steam
2010-09-11 06:18 . 2009-11-16 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-09-02 16:52 . 2008-11-09 12:10 0 ----a-w- c:\documents and settings\KB\temp.dat
2010-07-17 09:26 . 2009-03-22 07:25 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 09:26 . 2010-07-17 09:26 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-17 09:25 . 2008-06-20 14:26 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-30 12:32 . 2001-10-09 13:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:25 . 2004-08-23 17:14 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2001-10-09 13:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-23 05:28 . 2010-06-23 05:28 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb7C.tmp.exe
2010-06-21 15:27 . 2001-10-09 13:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-20 16:36 . 2009-07-30 15:05 63488 ----a-w- c:\windows\xobglu16.dll
2010-06-20 16:36 . 2009-07-30 15:05 23552 ----a-w- c:\windows\xobglu32.dll
2010-06-17 14:03 . 2001-10-09 13:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2005-01-05 23:34 744448 ----a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\programmer\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4FCAD9A7-F34E-4192-BA99-2F0EB1EE22E6}]
2001-10-09 13:00 739328 ----a-w- c:\windows\system32\dlo2f.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 11:12 1119488 ----a-w- c:\programmer\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\programmer\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\programmer\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Enhanced Storage]
@="{4FCAD9A7-F34E-4192-BA99-2F0EB1EE22E6}"
[HKEY_CLASSES_ROOT\CLSID\{4FCAD9A7-F34E-4192-BA99-2F0EB1EE22E6}]
2001-10-09 13:00 739328 ----a-w- c:\windows\system32\dlo2f.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 09:26 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\Sports Interactive\\Football Manager 2005\\fm2005.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmer\\LimeWire\\LimeWire.exe"=
"c:\\Programmer\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
"c:\\Programmer\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmer\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Programmer\\Messenger\\msmsgs.exe"=
"c:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmer\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programmer\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Programmer\\Steam\\steamapps\\common\\football manager 2009\\fm.exe"=
"c:\\Programmer\\iTunes\\iTunes.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Programmer\\Steam\\steamapps\\common\\football manager 2010\\fm.exe"=
R0 d343bus;d343bus;c:\windows\system32\drivers\d343bus.sys [13-05-2005 17:00 136704]
R0 d343port;d343port;c:\windows\system32\drivers\d343port.sys [13-05-2005 17:00 5632]
R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [01-08-2003 15:47 29239]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [20-06-2008 16:26 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [22-03-2009 09:25 243024]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [06-07-2004 18:06 188416]
R2 avg9wd;AVG Free WatchDog;c:\programmer\AVG\AVG9\avgwdsvc.exe [17-07-2010 11:26 308136]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [04-02-2010 19:52 90112]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [03-08-2004 12:10 62976]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [04-02-2010 19:54 27632]
S2 gupdate1c9a97aed02347e;Google Update Service (gupdate1c9a97aed02347e);c:\programmer\Google\Update\GoogleUpdate.exe [20-03-2009 18:42 133104]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [01-06-2009 09:27 13224]
S3 SCPMPR5;SCPMPR5 NDIS Protocol Driver;\??\d:\scpmpr5.sys --> d:\SCPMPR5.SYS [?]
S3 Slnt7554;USB Soft Modem Driver;c:\windows\system32\drivers\slnt7554.sys [04-08-2004 07:41 129535]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\programmer\Microsoft SQL Server\100\Shared\sqladhlp.exe [11-07-2008 02:28 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10-07-2008 03:49 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\programmer\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11-07-2008 02:28 369688]
--- Andre Services/Drivers i Hukommelsen ---
*NewlyCreated* - GPJRDLEN
*Deregistered* - gpjrdlen
.
Indhold af mappen 'Planlagte Opgaver'
2010-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2009-03-20 16:42]
2010-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2009-03-20 16:42]
2010-09-12 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Yderligere scanning -------
.
uStart Page =
hxxp://www.google.dk/uDefault_Search_URL =
hxxp://www.google.com/ieuSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mStart Page =
hxxp://home.sweetim.comuInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:6092
uInternet Settings,ProxyOverride = <local>
uSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/search?q=%sIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki ... - c:\programmer\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: danid.dk
Trusted Zone: portalbank.dk\www
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cabDPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} -
hxxps://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cabDPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} -
hxxps://danid.dk/csp/authenticode/csp.exeDPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} -
hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe.
- - - - TOMME GENVEJE FJERNET - - - -
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\programmer\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\programmer\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\programmer\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\programmer\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-09-12 15:24
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.netdevice: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86CA70E8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7680f28
\Driver\ACPI -> ACPI.sys @ 0xf75c1cb8
\Driver\atapi -> 0x86ca70e8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615
ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615
ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac
NDIS: VIA-kompatibel Fast Ethernet-netværkskort -> SendCompleteHandler -> NDIS.sys @ 0xf7407bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7414a21
SendHandler -> NDIS.sys @ 0xf73f287b
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\dlo2f.dll
- - - - - - - > 'explorer.exe'(3280)
c:\windows\system32\dlo2f.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\programmer\AVG\AVG9\avgchsvx.exe
c:\programmer\AVG\AVG9\avgrsx.exe
c:\programmer\AVG\AVG9\avgcsrvx.exe
c:\programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmer\Fælles filer\Autodata Limited Shared\Service\ADCDLicSvc.exe
c:\programmer\Bonjour\mDNSResponder.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmer\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\programmer\AVG\AVG9\avgnsx.exe
c:\windows\system32\HPZipm12.exe
c:\programmer\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Gennemført tid: 2010-09-12 15:29:38 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-09-12 13:29
Pre-Kørsel: 48.206.753.792 byte ledig
Post-Kørsel: 49.082.396.672 byte ledig
- - End Of File - - 38442D9B92EFB600586D5E77D752A092
Ny bruger
Nybegynder
Opret
Preview
