Så har jeg kørt Norton Removal Tool og
ComboFix.
Her er den ønskede log. ;-)
ComboFix 10-11-27.01 - Karina 28-11-2010 16:37:44.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.45.1030.18.447.183 [GMT 1:00]
Kører fra: c:\documents and settings\Karina\Skrivebord\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Karina\Skrivebord\CFScript
AV: BullGuard Antivirus *On-access scanning disabled* (Outdated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}
FW: BullGuard Firewall *enabled* {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Karina\Application Data\.#
c:\programmer\AntiMalware
c:\windows\system32\Thumbs.db
.
((((((((((((((((((((((((((((( Filer skabt fra 2010-10-28 til 2010-11-28 )))))))))))))))))))))))))))))))))))
.
2010-11-21 10:53 . 2010-11-21 10:53 -------- d-----w- c:\documents and settings\Karina\Application Data\Malwarebytes
2010-11-21 09:43 . 2010-11-21 09:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-11-21 09:42 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-21 09:42 . 2010-11-21 11:59 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2010-11-21 09:42 . 2010-11-21 09:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-21 09:42 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-21 09:12 . 2010-11-21 09:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Software Inspection Library
2010-11-21 09:07 . 2010-11-21 09:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\BullGuard
2010-11-21 09:02 . 2010-11-21 09:02 -------- d-----w- c:\programmer\CCleaner
2010-11-21 08:46 . 2010-11-21 08:46 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-11-20 11:40 . 2010-11-20 11:40 -------- d-----w- c:\documents and settings\Karina\Application Data\Software Inspection Library
2010-11-20 11:19 . 2010-11-20 11:19 -------- d-----w- c:\programmer\BullGuard Ltd
2010-11-11 05:28 . 2010-11-11 05:28 -------- d-----w- C:\f57076dd7010261bee516c006c0c
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-21 10:56 . 2010-10-12 10:04 19144 ----a-w- c:\windows\system32\drivers\NSNetmon.sys
2010-11-21 10:56 . 2010-10-12 10:04 787912 ----a-w- c:\windows\system32\drivers\NSKernel.sys
2010-10-20 15:46 . 2010-10-20 15:46 98184 ----a-w- c:\windows\system32\BgGamingMonitor.dll
2010-10-20 15:46 . 2010-10-20 15:46 150920 ----a-w- c:\windows\system32\BGLsp.dll
2010-10-19 12:56 . 2010-10-19 12:56 99136 ----a-w- c:\windows\system32\BdInstHk.dll
2010-10-12 10:04 . 2010-10-12 10:04 58832 ----a-w- c:\windows\system32\drivers\BdSpy.sys
2010-10-12 10:04 . 2010-10-12 10:04 34280 ----a-w- c:\windows\system32\drivers\afw.sys
2010-10-12 10:04 . 2010-10-12 10:04 267624 ----a-w- c:\windows\system32\drivers\afwcore.sys
2010-09-18 10:23 . 2004-09-14 13:36 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-09-14 13:36 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-09-14 13:36 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-18 06:53 . 2004-09-14 13:36 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-10 05:51 . 2004-09-14 13:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:51 . 2004-09-14 13:36 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:51 . 2004-09-14 13:36 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2004-09-14 13:35 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2004-09-14 13:37 1852800 ----a-w- c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Speed Launch.lnk - c:\programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Photosmart Premier Hurtig start.lnk - c:\programmer\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Microsoft Office.lnk - c:\programmer\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
SiWake.lnk - c:\programmer\Wireless LAN Utility\SiWake.exe [2008-3-5 135168]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=
"c:\\Programmer\\Messenger\\msmsgs.exe"=
R1 BdSpy;BdSpy;c:\windows\system32\drivers\BdSpy.sys [12-10-2010 11:04 58832]
R1 NovaShieldFilterDriver;NovaShieldFilterDriver;c:\windows\system32\drivers\NSKernel.sys [12-10-2010 11:04 787912]
R1 NovaShieldTDIDriver;NovaShieldTDIDriver;c:\windows\system32\drivers\NSNetmon.sys [12-10-2010 11:04 19144]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\ACEDRV11.sys [23-01-2008 09:19 501560]
R2 BsBhvScan;BullGuard behavioural detection service;c:\programmer\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe [03-11-2010 15:52 311128]
R2 BsBrowser;BullGuard antiphishing service;c:\windows\System32\SvcHost.exe -k BullGuard_LowPriv [14-09-2004 14:37 14336]
R2 BsFileScan;BullGuard on-access service;c:\windows\System32\SvcHost.exe -k BullGuard [14-09-2004 14:37 14336]
R2 BsFire;BullGuard firewall service;c:\windows\System32\SvcHost.exe -k BullGuard [14-09-2004 14:37 14336]
R2 BsMailProxy;BullGuard e-mail monitoring service;c:\windows\System32\SvcHost.exe -k BullGuard [14-09-2004 14:37 14336]
R2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe -k BullGuard_Main [14-09-2004 14:37 14336]
R2 BsUpdate;BullGuard update service;c:\programmer\BullGuard Ltd\BullGuard\BullGuardUpdate.exe [20-11-2010 12:32 308056]
R2 MTC0007_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\STDSB.sys [18-05-2006 16:11 11279]
R2 UI Assistant Service;UI Assistant Service;c:\programmer\Mobile Broadband\AssistantServices.exe [03-09-2010 12:05 251016]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [12-10-2010 11:04 34280]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [12-10-2010 11:04 267624]
S2 STDSB;STDSB;c:\windows\system32\drivers\STDSB.sys [18-05-2006 16:11 11279]
S3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys --> c:\windows\system32\DRIVERS\avfsfilter.sys [?]
S3 BgRaSvc;BgRaSvc;c:\programmer\BullGuard Ltd\BullGuard\Support\BgRaSvc.exe [26-10-2010 10:32 122760]
S3 BsScanner;BullGuard scanning service;c:\programmer\BullGuard Ltd\BullGuard\BullGuardScanner.exe [03-11-2010 15:52 243032]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [03-09-2010 12:06 9216]
S3 SIS163u;BT-WUD2015 Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [05-03-2008 07:38 162304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard_Main REG_MULTI_SZ BsMain
BullGuard REG_MULTI_SZ BsFileScan BsMailProxy BsFire
BullGuard_LowPriv REG_MULTI_SZ BsBrowser
.
.
------- Yderligere scanning -------
.
uStart Page =
hxxp://www.google.com/mStart Page = about:blank
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\BGLsp.dll
.
- - - - TOMME GENVEJE FJERNET - - - -
AddRemove-Blue Byte Game Channel - c:\bluebyte\BBGC\uninst.dll
AddRemove-HijackThis - c:\documents and settings\Karina\Skrivebord\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-11-28 16:48
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_USERS\S-1-5-21-3942416310-3233753045-1949143878-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0f,af,b4,30,28,ef,78,0b,4d,82,34,31,f6,f8,4e,8a,0f,bf,a0,94,06,12,6e,
72,22,d9,23,d0,e2,c8,9d,ac,a2,3b,4b,d3,4b,62,9a,67,14,90,0b,8f,5d,75,8d,65,\
"??"=hex:36,52,b9,84,8f,da,aa,53,7a,50,e3,19,1b,d9,44,42
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€-€|ÿÿÿÿÀ•€|ù•6~*]
"00000000000000000000000000000000"="c?\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\mscormmc.cfg"
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'lsass.exe'(956)
c:\windows\system32\BGLsp.dll
- - - - - - - > 'explorer.exe'(2028)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmer\BullGuard Ltd\BullGuard\BackupShellHook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
c:\programmer\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\programmer\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\apps\HIDSERVICE\HIDSERVICE.exe
c:\windows\system32\slmdmsr.exe
c:\programmer\HP\Digital Imaging\bin\hpqimzone.exe
c:\apps\Powercinema\Kernel\TV\CLSched.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Gennemført tid: 2010-11-28 16:55:56 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-11-28 15:55
Pre-Kørsel: 16.815.202.304 byte ledig
Post-Kørsel: 17.081.958.400 byte ledig
- - End Of File - - D2ABB417470648F87BF8EDDCC4A6E0EE
Ny bruger
Nybegynder
Opret
Preview
