Smart fortress - har jeg mon fået ryddet op
Ja så dukkede ovenstående op hos mig. Har forsøgt at rydde op, men vil blive meget glad om der var en der vil checke efter.Har forsøgt at køre guiden, men kunne ikke få kombofix til at køre, selvom jeg lavede en fil (CFSript) med
Killall::
Snapshot::
Kørte dog combofix, blot ved at dobbeltklikke.
Her er hvad der kom ud af det
1. Malwarebytes
Malwarebytes Anti-Malware (Prøveversion) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.05.21.01
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Ejer :: KIMI [administrator]
Beskyttelse: Slået til
21-05-2012 15:17:22
mbam-log-2012-05-21 (15-17-22).txt
Skanningstype: Fuldstændig skanning
Skanningsmuligheder valgt: Hukommelse | Opstart | Registreringsdatabasen | Filsystem | Heuristics/Ekstra | Heuristics/Shuriken | PUP | PUM
Skanningsmuligheder som er deaktiverede: P2P
Objekter skannet: 368003
Tid gået: 1 time(e), 5 minut(ter), 15 sekund(er)
Hukommelses Processorer Inficeret: 0
(Ingen skadelige objekter blev fundet)
Hukommelses Moduler Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabasenøgler Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabaseværdier Inficeret: 0
(Ingen skadelige objekter blev fundet)
Registreringsdatabasedata Objekter Inficeret: 0
(Ingen skadelige objekter blev fundet)
Inficerede Mapper: 0
(Ingen skadelige objekter blev fundet)
Inficerede Filer: 1
C:\System Volume Information\_restore{A724816D-A3E4-4410-B2B8-98C5ECC4E083}\RP412\A0075072.exe (Trojan.LameShield) -> Sat i karantæne og slettet succesfuldt.
(færdig)
2. Combofix
ComboFix 12-05-21.03 - Ejer 21-05-2012 18:19:13.2.3 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.45.1030.18.3327.2652 [GMT 2:00]
Kører fra: c:\documents and settings\Ejer\Skrivebord\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((( Filer skabt fra 2012-04-21 til 2012-05-21 )))))))))))))))))))))))))))))))))))
.
.
2012-05-21 14:59 . 2012-05-21 14:59 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0FBB9DC1-A757-4E84-9322-3E79A2C3E96A}\offreg.dll
2012-05-21 14:59 . 2012-05-21 14:59 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0FBB9DC1-A757-4E84-9322-3E79A2C3E96A}\MpKsl5fbe9a42.sys
2012-05-21 12:38 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0FBB9DC1-A757-4E84-9322-3E79A2C3E96A}\mpengine.dll
2012-05-21 12:34 . 2012-05-21 12:34 388096 ----a-r- c:\documents and settings\Ejer\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-05-21 12:34 . 2012-05-21 12:34 -------- d-----w- c:\programmer\Trend Micro
2012-05-21 11:17 . 2012-05-21 11:17 -------- d-----w- c:\documents and settings\Ejer\Application Data\Malwarebytes
2012-05-21 11:17 . 2012-05-21 12:16 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2012-05-21 11:17 . 2012-05-21 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-05-21 11:17 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-21 09:05 . 2012-05-21 09:05 -------- d-----w- c:\documents and settings\Ejer\Lokale indstillinger\Application Data\PCHealth
2012-05-21 08:54 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-21 08:54 . 2012-05-21 08:54 -------- d-----w- c:\windows\system32\wbem\Repository
2012-05-17 13:36 . 2012-05-17 13:36 -------- d-----w- c:\programmer\VS Revo Group
2012-05-05 12:55 . 2012-05-05 12:55 -------- d-----w- c:\programmer\Digital Photo Navigator 1.5
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 15:08 . 2012-04-15 15:32 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-09 15:08 . 2011-05-25 18:48 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:54 . 2004-08-26 17:50 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:53 . 2004-08-27 12:00 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:53 . 2004-08-27 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-20 18:44 . 2010-03-25 19:30 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-01 10:59 . 2004-08-27 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 10:59 . 2004-08-27 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-01 10:59 . 2004-08-27 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 23:58 . 2011-10-26 17:05 881984 ----a-w- c:\windows\system32\nvgenco32.dll
2012-02-29 23:58 . 2011-10-26 17:05 1000256 ----a-w- c:\windows\system32\nvdispco32.dll
2012-02-29 23:58 . 2011-06-03 15:12 65536 ----a-w- c:\windows\system32\OpenCL.dll
2012-02-29 23:58 . 2011-06-03 15:12 5918720 ----a-w- c:\windows\system32\nvcuda.dll
2012-02-29 23:58 . 2011-06-03 15:12 2522944 ----a-w- c:\windows\system32\nvcuvid.dll
2012-02-29 23:58 . 2011-06-03 15:12 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-02-29 23:58 . 2011-06-03 15:12 2291712 ----a-w- c:\windows\system32\nvapi.dll
2012-02-29 23:58 . 2011-06-03 15:12 18624512 ----a-w- c:\windows\system32\nvoglnt.dll
2012-02-29 23:58 . 2011-06-03 15:12 17534976 ----a-w- c:\windows\system32\nvcompiler.dll
2012-02-29 23:58 . 2009-09-27 15:12 4309760 ----a-w- c:\windows\system32\nv4_disp.dll
2012-02-29 23:58 . 2009-09-27 15:12 13417632 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-02-29 21:15 . 2012-02-21 20:35 335872 ----a-w- c:\windows\system32\nvrshe.dll
2012-02-29 21:15 . 2012-02-21 20:35 274432 ----a-w- c:\windows\system32\nvrsja.dll
2012-02-29 21:15 . 2012-02-21 20:35 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2012-02-29 21:15 . 2012-02-21 20:35 258048 ----a-w- c:\windows\system32\nvrspl.dll
2012-02-29 21:15 . 2012-02-21 20:35 253952 ----a-w- c:\windows\system32\nvrssv.dll
2012-02-29 21:15 . 2012-02-21 20:35 249856 ----a-w- c:\windows\system32\nvrseng.dll
2012-02-29 21:15 . 2012-02-21 20:35 249856 ----a-w- c:\windows\system32\nvrscs.dll
2012-02-29 21:15 . 2012-02-21 20:35 282624 ----a-w- c:\windows\system32\nvrsit.dll
2012-02-29 21:15 . 2012-02-21 20:35 278528 ----a-w- c:\windows\system32\nvrsde.dll
2012-02-29 21:15 . 2012-02-21 20:35 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2012-02-29 21:15 . 2012-02-21 20:35 258048 ----a-w- c:\windows\system32\nvrssk.dll
2012-02-29 21:15 . 2012-02-21 20:35 274432 ----a-w- c:\windows\system32\nvrspt.dll
2012-02-29 21:15 . 2012-02-21 20:35 262144 ----a-w- c:\windows\system32\nvrshu.dll
2012-02-29 21:15 . 2012-02-21 20:35 266240 ----a-w- c:\windows\system32\nvrsko.dll
2012-02-29 21:15 . 2012-02-21 20:35 282624 ----a-w- c:\windows\system32\nvrses.dll
2012-02-29 21:15 . 2012-02-21 20:35 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2012-02-29 21:15 . 2012-02-21 20:35 258048 ----a-w- c:\windows\system32\nvrstr.dll
2012-02-29 21:15 . 2012-02-21 20:35 253952 ----a-w- c:\windows\system32\nvrsth.dll
2012-02-29 21:15 . 2012-02-21 20:35 253952 ----a-w- c:\windows\system32\nvrsno.dll
2012-02-29 21:15 . 2012-02-21 20:35 335872 ----a-w- c:\windows\system32\nvrsar.dll
2012-02-29 21:15 . 2012-02-21 20:35 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2012-02-29 21:15 . 2012-02-21 20:35 282624 ----a-w- c:\windows\system32\nvrsel.dll
2012-02-29 21:15 . 2012-02-21 20:35 270336 ----a-w- c:\windows\system32\nvrsru.dll
2012-02-29 21:15 . 2012-02-21 20:35 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2012-02-29 21:15 . 2012-02-21 20:35 126976 ----a-w- c:\windows\system32\nvrszht.dll
2012-02-29 21:15 . 2012-02-21 20:35 253952 ----a-w- c:\windows\system32\nvrsda.dll
2012-02-29 21:15 . 2012-02-21 20:35 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2012-02-29 21:15 . 2012-02-21 20:35 258048 ----a-w- c:\windows\system32\nvrssl.dll
2012-02-29 20:30 . 2012-02-21 20:35 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-02-29 20:30 . 2012-02-21 20:35 143680 ----a-w- c:\windows\system32\nvcolor.exe
2012-02-29 20:30 . 2012-02-21 20:35 15494464 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-29 20:30 . 2012-02-21 20:35 164160 ----a-w- c:\windows\system32\nvsvc32.exe
2012-02-29 20:30 . 2012-02-21 20:35 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-02-29 14:10 . 2004-08-27 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-27 12:00 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-27 12:00 385024 ----a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-21_12.28.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-21 16:17 . 2012-05-21 16:17 16384 c:\windows\Temp\Perflib_Perfdata_94.dat
- 2004-08-27 12:00 . 2012-05-21 12:22 67740 c:\windows\system32\perfc009.dat
+ 2004-08-27 12:00 . 2012-05-21 16:21 67740 c:\windows\system32\perfc009.dat
- 2004-08-27 12:00 . 2012-05-21 12:22 78232 c:\windows\system32\perfc006.dat
+ 2004-08-27 12:00 . 2012-05-21 16:21 78232 c:\windows\system32\perfc006.dat
- 2004-08-27 12:00 . 2012-05-21 12:22 432784 c:\windows\system32\perfh009.dat
+ 2004-08-27 12:00 . 2012-05-21 16:21 432784 c:\windows\system32\perfh009.dat
+ 2004-08-27 12:00 . 2012-05-21 16:21 447720 c:\windows\system32\perfh006.dat
- 2004-08-27 12:00 . 2012-05-21 12:22 447720 c:\windows\system32\perfh006.dat
+ 2012-05-21 12:34 . 2012-05-21 12:34 1094656 c:\windows\Installer\316342.msi
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-05 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-03 25600]
"ConnectionCenter"="c:\programmer\Citrix\ICA Client\concentr.exe" [2009-09-12 103768]
"Microsoft Default Manager"="c:\programmer\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"SunJavaUpdateSched"="c:\programmer\Fælles filer\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\programmer\Fælles filer\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-29 15494464]
"NvMediaCenter"="NvMCTray.dll" [2012-02-29 108352]
"nwiz"="c:\programmer\NVIDIA Corporation\nview\nwiz.exe" [2012-02-29 1634112]
"MSC"="c:\programmer\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\programmer\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FLLESF~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menuen Start\Programmer\Start\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Ejer^Menuen Start^Programmer^Start^OpenOffice.org 3.3.lnk]
path=c:\documents and settings\Ejer\Menuen Start\Programmer\Start\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 09:07 843712 ----a-r- c:\programmer\Fælles filer\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-03-27 12:41 37296 ----a-w- c:\programmer\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ConnectionCenter]
2009-09-12 22:09 103768 ----a-w- c:\programmer\Citrix\ICA Client\concentr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Network USB Utility]
2008-12-26 16:06 2605312 ----a-w- c:\programmer\D-Link\SharePort\SharePort Network USB Utility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2009-11-18 14:13 54576 ----a-w- c:\programmer\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53 141608 ----a-w- c:\programmer\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 20:16 421888 ----a-w- c:\programmer\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2003-10-31 18:42 32768 ----a-w- c:\programmer\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-08-03 23:48 1242448 ----a-w- c:\programmer\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2011-02-05 16:02 39408 ----a-w- c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WIAWizardMenu]
2008-04-14 16:05 136704 ----a-w- c:\windows\system32\sti_ci.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmer\\D-Link\\SharePort\\SharePort Network USB Utility.exe"=
"c:\\Programmer\\EA GAMES\\Medal of Honor Pacific Assault(tm)\\mohpa.exe"=
"c:\\Programmer\\EA GAMES\\The Sims 2 FreeTime\\TSBin\\Sims2Launcher.exe"=
"c:\\Programmer\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Programmer\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Programmer\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Programmer\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Programmer\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmer\\iTunes\\iTunes.exe"=
"c:\\Programmer\\Steam\\Steam.exe"=
"c:\\Programmer\\2K Games\\BioShock 2\\SP\\Builds\\Binaries\\Bioshock2.exe"=
"c:\\Programmer\\2K Games\\BioShock 2\\MP\\Builds\\Binaries\\Bioshock2.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Programmer\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Programmer\\Steam\\steamapps\\common\\portal 2\\portal2.exe"=
"c:\\Programmer\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"c:\\Programmer\\Steam\\steamapps\\common\\skyrim\\SkyrimLauncher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9303:UDP"= 9303:UDP:SharePort Network USB Utility UDP Port
.
R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [08-09-2009 19:13 65584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [23-07-2011 17:42 218688]
R1 MpKsl5fbe9a42;MpKsl5fbe9a42;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0FBB9DC1-A757-4E84-9322-3E79A2C3E96A}\MpKsl5fbe9a42.sys [21-05-2012 16:59 29904]
R2 MBAMService;MBAMService;c:\programmer\Malwarebytes' Anti-Malware\mbamservice.exe [21-05-2012 13:17 654408]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\programmer\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [21-02-2012 22:35 2348352]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [04-06-2009 03:46 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [04-06-2009 03:46 1324056]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [04-06-2009 03:46 72728]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [21-05-2012 13:17 22344]
S2 gupdate;Tjenesten Google Update (gupdate);c:\programmer\Google\Update\GoogleUpdate.exe [07-05-2010 17:23 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15-04-2012 17:32 257696]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\programmer\Fælles filer\Creative Labs Shared\Service\CTAELicensing.exe [16-11-2009 22:54 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [04-06-2009 03:46 171032]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [04-06-2009 03:46 1324056]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [04-06-2009 03:46 72728]
S3 gupdatem;Google Update Tjeneste (gupdatem);c:\programmer\Google\Update\GoogleUpdate.exe [07-05-2010 17:23 136176]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [05-03-2012 23:39 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [05-03-2012 23:39 8576]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [03-03-2010 00:30 47360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Indhold af mappen 'Planlagte Opgaver'
.
2012-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 15:08]
.
2012-05-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2010-05-07 15:23]
.
2012-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2010-05-07 15:23]
.
2012-05-21 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\programmer\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: localhost
Trusted Zone: topsoe.dk\rvn
TCP: DhcpNameServer = 10.0.0.1 212.242.40.3 212.242.40.51
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-21 18:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanner skjulte processer ...
.
scanner skjulte autostarter ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
.
scanner skjulte filer ...
.
scanning gennemført med succes
skjulte filer: 0
.
**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
.
[HKEY_USERS\S-1-5-21-1645522239-1659004503-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:fa,01,cb,1f,25,d3,74,ba,0d,ce,c5,18,ee,ba,4a,61,9d,a2,79,6a,91,
82,cc,d0,83,5f,d0,20,7f,3e,8a,02,f3,10,8b,e7,ae,1c,2c,42,33,51,28,6d,c9,56,\
"rkeysecu"=hex:5d,d3,94,17,a9,52,2c,4a,5f,87,c5,18,6a,44,37,08
.
--------------------- DLLs startet under kørende Processer ---------------------
.
- - - - - - - > 'explorer.exe'(2648)
c:\programmer\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
c:\programmer\Fælles filer\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\programmer\Fælles filer\Adobe\Acrobat\ActiveX\PDFShell.DAN
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Gennemført tid: 2012-05-21 18:25:51
ComboFix-quarantined-files.txt 2012-05-21 16:25
ComboFix2.txt 2012-05-21 12:30
.
Pre-Kørsel: 347.355.496.448 byte ledig
Post-Kørsel: 347.346.124.800 byte ledig
.
- - End Of File - - D6512FD2A6201DC2B33729BF243164E0
3. Hijackthis
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:15:33, on 21-05-2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Programmer\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Creative\Shared Files\CTAudSvc.exe
C:\Programmer\Citrix\ICA Client\concentr.exe
C:\Programmer\Fælles filer\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Programmer\Citrix\ICA Client\wfcrun32.exe
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\Programmer\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Trend Micro\HiJackThis\HiJackThis.exe
C:\Programmer\internet explorer\iexplore.exe
C:\Programmer\internet explorer\iexplore.exe
C:\Programmer\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programmer\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmer\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programmer\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmer\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Programmer\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Programmer\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Fælles filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmer\Fælles filer\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Programmer\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [MSC] "c:\Programmer\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programmer\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [swg] "C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-21-1645522239-1659004503-682003330-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Vis eller skjul HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programmer\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Registrering af enheder) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.lsb.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} (UploadListView Class) - https://picasaweb.google.com/s/v/71.18/uploader2.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1257807744375
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15109/CTPID.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Programmer\Fælles filer\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Programmer\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Tjenesten Google Update (gupdate) (gupdate) - Google Inc. - C:\Programmer\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Tjeneste (gupdatem) (gupdatem) - Google Inc. - C:\Programmer\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programmer\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Programmer\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: ServiceLayer - Nokia - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Programmer\Fælles filer\Steam\SteamService.exe
--
End of file - 9594 bytes
