Log fra combofix:
ComboFix 10-03-12.04 - Administrator 13-03-2010 13:59:36.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.1015.502 [GMT 1:00]
Kører fra: c:\programmer\Virusprogrammer mv\Combofix\ComboFix.exe
Kommandoer benyttet :: c:\programmer\Virusprogrammer mv\Combofix\CFScript.txt
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\emlaep.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))
.
———-\Service_ldufn
((((((((((((((((((((((((((((( Filer skabt fra 2010-02-13 til 2010-03-13 )))))))))))))))))))))))))))))))))))
.
2010-03-13 13:08 . 2010-03-13 13:08 114688 ——a-w- c:\windows\system32\chg.exe
2010-03-13 07:57 . 2010-03-13 07:57 ———— d——-w- c:\windows\system32\wbem\Repository
2010-03-12 17:59 . 2010-03-12 18:11 ———— d——-w- c:\programmer\Enigma Software Group
2010-03-12 15:51 . 2010-03-12 15:51 ———— d——-w- C:\0e52d71266d4203ab1ba29749bd45d
2010-03-08 18:05 . 2010-03-08 18:05 ———— d——-w- c:\programmer\Alwil Software
2010-03-08 18:05 . 2010-03-08 18:05 ———— d——-w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-03-08 17:27 . 2010-02-12 10:03 293376 ———w- c:\windows\system32\browserchoice.exe
2010-02-28 16:40 . 2010-02-28 16:40 ———— d——-w- c:\programmer\TurnTool
2010-02-28 16:40 . 2010-02-28 16:40 ———— d——-w- c:\documents and settings\Administrator\Lokale indstillinger\Application Data\TurnTool
2010-02-27 10:05 . 2010-02-27 10:05 ———— d——-w- c:\documents and settings\LocalService\Lokale indstillinger\Application Data\Google
2010-02-27 10:05 . 2010-02-27 10:05 ———— d——-w- c:\documents and settings\Administrator\Lokale indstillinger\Application Data\Temp
2010-02-26 23:05 . 2010-02-26 23:05 ———— d-sh—w- c:\documents and settings\Administrator\IECompatCache
2010-02-26 23:04 . 2010-02-26 23:04 ———— d-sh—w- c:\documents and settings\Administrator\PrivacIE
2010-02-26 23:02 . 2010-02-26 23:02 ———— d-sh—w- c:\documents and settings\Administrator\IETldCache
2010-02-26 23:00 . 2010-02-28 14:53 ———— d——-w- c:\windows\ie8updates
2010-02-26 22:56 . 2010-02-26 22:59 ———— dc-h—w- c:\windows\ie8
2010-02-26 22:54 . 2009-12-11 08:38 69120 ———w- c:\windows\system32\dllcache\iecompat.dll
2010-02-26 22:54 . 2009-12-21 19:07 246272 ———w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-26 22:54 . 2009-12-21 19:08 12800 ———w- c:\windows\system32\dllcache\xpshims.dll
2010-02-16 21:14 . 2010-02-16 21:14 ———— d——-w- c:\documents and settings\Administrator\Application Data\Sonic
2010-02-16 21:13 . 2010-02-16 21:13 ———— d——-w- c:\documents and settings\Administrator\Application Data\Leadertech
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 10:37 . 2008-12-29 18:45 ———— d——-w- c:\programmer\Virusprogrammer mv
2010-03-09 11:24 . 2008-12-29 18:54 153184 ——a-w- c:\windows\system32\aswBoot.exe
2010-03-09 11:12 . 2008-12-29 18:55 46672 ——a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-09 11:12 . 2008-12-29 18:55 162640 ——a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-09 11:09 . 2008-12-29 18:55 23376 ——a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-09 11:08 . 2008-12-29 18:55 100432 ——a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-09 11:08 . 2008-12-29 18:55 94800 ——a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-09 11:08 . 2008-12-29 18:55 19024 ——a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-09 11:08 . 2008-12-29 18:55 28880 ——a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-03 18:57 . 2010-03-03 18:57 2238 ——a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{22089C24-C28D-4AAE-9285-3553F808786E}\_FA9CCB746E397B9E466F6F.exe
2010-03-03 18:57 . 2010-03-03 18:57 2238 ——a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{22089C24-C28D-4AAE-9285-3553F808786E}\_5F33B40B21FAF45C46D1E0.exe
2010-03-03 18:57 . 2009-11-21 16:30 ———— d——-w- c:\programmer\Bet Angel
2010-02-24 08:16 . 2009-10-17 11:43 181632 ———w- c:\windows\system32\MpSigStub.exe
2010-02-11 18:53 . 2008-12-29 18:55 38848 ——a-w- c:\windows\system32\avastSS.scr
2010-02-06 12:15 . 2010-02-06 12:01 ———— d——-w- c:\documents and settings\All Users\Application Data\Norton
2010-02-06 12:14 . 2006-08-24 03:35 ———— d——-w- c:\programmer\Fælles filer\Symantec Shared
2010-02-06 12:01 . 2006-08-24 03:35 ———— d——-w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-06 12:01 . 2010-02-06 12:01 ———— d——-w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-31 13:02 . 2010-01-31 13:02 5115823 ——a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes’ Anti-Malware\mbam-setup.exe
2010-01-31 13:00 . 2010-01-31 13:00 ———— d——-w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-31 13:00 . 2010-01-31 13:00 ———— d——-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 23:59 . 2008-09-03 13:22 ———— d——-w- c:\programmer\Google
2010-01-30 18:49 . 2010-01-30 18:49 ———— d——-w- c:\programmer\Conduit
2010-01-30 18:42 . 2009-08-05 19:50 ———— d——-w- c:\programmer\NET TV
2010-01-30 18:10 . 2010-01-30 18:10 ———— d——-w- c:\documents and settings\Administrator\Application Data\StreamTorrent
2010-01-23 15:33 . 2009-05-03 17:11 ———— d——-w- c:\programmer\Microsoft Silverlight
2010-01-17 16:00 . 2010-01-12 20:04 2302 ——a-w- c:\documents and settings\Administrator\Application Data\Roulette1.co.uk\top.exe
2010-01-16 16:53 . 2010-01-12 20:04 ———— d——-w- c:\documents and settings\Administrator\Application Data\Roulette1.co.uk
2010-01-16 15:34 . 2010-01-16 15:34 942080 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\f\flightzonebonus.bb993454d3170414b7655081a3ec7db9.dll
2010-01-16 15:18 . 2010-01-16 15:18 884736 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\f\fatladybonus.1bbd616c1ce52b392c6981c202173fe7.dll
2010-01-16 15:01 . 2010-01-16 15:01 1486848 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_gao_dec_2009.cd728f719824c5074cc6023ea106ea1e.dll
2010-01-16 15:01 . 2010-01-16 15:01 618496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_gao_dec_2009.637d031249b1b22e0b31d5303f3811be.dll
2010-01-16 15:01 . 2010-01-16 15:01 679936 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_gao_dec_2009.ddf657439bc1cbce99e8763fee9803a4.dll
2010-01-16 15:00 . 2010-01-16 15:00 1040384 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_gao_dec_2009.f5605c1fe8513561f2bef5c3c0c1a546.dll
2010-01-16 14:57 . 2010-01-16 14:57 958464 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\h\hilowbonus_flightzone.1173d08d2670eede892e3adf07022f08.dll
2010-01-16 14:57 . 2010-01-16 14:57 3883424 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\n\npswf32.b16ec84e06f26b8b85800f3b07b8d757.dll
2010-01-16 14:57 . 2010-01-16 14:57 106496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\aurora.c0da0abbdaa27e017c6c41de2328f9c3.dll
2010-01-16 14:56 . 2010-01-16 14:56 594192 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\snakesandladdersbonus.1b7d7437b87cc53b7a00c4efd2db679d.dll
2010-01-11 19:31 . 2010-01-11 19:31 1040384 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_novgao_09.0f4a9e5f0c3aacc5fd59c75d3646b44e.dll
2010-01-11 19:31 . 2010-01-11 19:31 1474560 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_novgao_09.bca283e127879ce59170c465ef11ba05.dll
2010-01-11 19:27 . 2010-01-11 19:26 897024 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickxofybonus_novgao_09.cf52962a5fbf37c5c088bd5d667653d4.dll
2010-01-11 19:25 . 2010-01-11 19:25 921600 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickuntilbonus_novgao_09.2d0e2f5fb79a1dee2f0dba3ac916277d.dll
2010-01-11 19:25 . 2010-01-11 19:25 618496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_novgao_09.5e06bb19f897ab866a50c262ff639055.dll
2010-01-11 19:23 . 2010-01-11 19:23 679936 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_novgao_09.002d2269f327b0c9a9e9f327bc91130b.dll
2010-01-11 14:27 . 2010-01-11 14:27 901120 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\s\simplepickxofybonus_octgao_09.8eb7dff6ab1c8166b7a83d669d6f1b7d.dll
2010-01-11 14:08 . 2010-01-11 14:08 1040384 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_octgao_09.b8c78bdbd5f2e8ca0e10a0e307926db4.dll
2010-01-11 14:06 . 2010-01-11 14:06 1478656 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_septgao_09.1d5fda158c9a9d1dcbf9e88c5355d884.dll
2010-01-11 14:05 . 2010-01-11 14:05 1032192 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_wealthspa.2cac89b1bff8f25a6a8d3748201af558.dll
2010-01-11 14:04 . 2010-01-11 14:03 1040384 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_septgao_09.02b3e0bc2a35757d7c030659fd21c70a.dll
2010-01-11 14:03 . 2010-01-11 14:03 421888 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\l\lua51host.6c8dcc3e9f55da70bf5ccd67df48f256.dll
2010-01-11 14:03 . 2010-01-11 14:03 679936 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_septgao_09.04686bb06cfe59ecb3f271eb95218422.dll
2010-01-11 14:03 . 2010-01-11 14:02 1224704 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1xxx_summerholiday.ca5125cc93020b208c8104895ffd4a80.dll
2010-01-11 14:02 . 2010-01-11 14:02 1474560 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_wealthspa.548276e787b133afb9b912eb95b8b5c5.dll
2010-01-11 14:02 . 2010-01-11 14:02 1638400 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_summerholiday.19e3e7b6f28b2f036c0b87d00fc799b9.dll
2010-01-11 14:02 . 2010-01-11 14:02 679936 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_wealthspa.5a3f4e96415d8b3050681cdd275f3d88.dll
2010-01-11 14:02 . 2010-01-11 14:02 1478656 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\a\advancedslots1_octgao_09.c2cbb8fc70fbf865a9d78d9a5874a4ce.dll
2010-01-11 14:02 . 2010-01-11 14:01 679936 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\t\transition_octgao_09.7768fe95f9efff3962c913196fe05f6a.dll
2010-01-11 13:57 . 2010-01-11 13:57 618496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_wealthspa.a58c586ab4d974ea2d4142fb4d851c2b.dll
2010-01-11 13:57 . 2010-01-11 13:57 618496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_octgao_09.ae6289cf11b05446123a7e16d97ef025.dll
2010-01-11 13:57 . 2010-01-11 13:57 618496 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_septgao_09.d8cd6b206ce4b18e0867e42785806a63.dll
2010-01-11 13:57 . 2010-01-11 13:57 606208 ——a-w- c:\documents and settings\All Users\Application Data\MGS\cache\g\gamble2_summerholiday.b02744e18c4cdb3dd3394f69d8987073.dll
2010-01-07 15:07 . 2010-01-31 13:00 38224 ——a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-31 13:00 19160 ——a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2004-08-27 08:00 353792 ——a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-27 08:00 916480 ——a-w- c:\windows\system32\wininet.dll
2009-12-17 21:57 . 2009-12-17 21:57 411368 ——a-w- c:\windows\system32\deploytk.dll
2009-12-17 21:56 . 2009-12-17 21:56 152576 ——a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-17 21:56 . 2009-12-17 21:56 79488 ——a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-17 07:41 . 2004-08-27 08:00 344576 ——a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-27 08:00 33280 ——a-w- c:\windows\system32\csrsrv.dll
2009-01-20 20:01 . 2009-01-20 19:59 24439 ——a-w- c:\programmer\updatejpegprocessing.docx
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“swg”=“c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-12-29 39408]
“WMPNSCFG”=“c:\programmer\Windows Media Player\WMPNSCFG.exe” [2006-11-15 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“MsmqIntCert”=“mqrt.dll” [2008-04-14 177152]
“SoundMAXPnP”=“c:\programmer\Analog Devices\Core\smax4pnp.exe” [2005-05-20 925696]
“SunJavaUpdateSched”=“c:\programmer\Java\jre6\bin\jusched.exe” [2009-12-17 149280]
“HP Software Update”=“c:\programmer\Hp\HP Software Update\HPWuSchd2.exe” [2005-02-16 49152]
“DLA”=“c:\windows\System32\DLA\DLACTRLW.EXE” [2005-08-31 122940]
“igfxtray”=“c:\windows\system32\igfxtray.exe” [2006-03-23 94208]
“igfxhkcmd”=“c:\windows\system32\hkcmd.exe” [2006-03-23 77824]
“igfxpers”=“c:\windows\system32\igfxpers.exe” [2006-03-23 118784]
“hpWirelessAssistant”=“c:\programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe” [2006-02-14 454656]
“CognizanceTS”=“c:\progra~1\HPQ\IAM\Bin\AsTsVcc.dll” [2003-12-22 17920]
“QlbCtrl”=“c:\programmer\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe” [2006-05-08 131072]
“Cpqset”=“c:\programmer\HPQ\Default Settings\cpqset.exe” [2006-01-26 172094]
“Recguard”=“c:\windows\Sminst\Recguard.exe” [2005-12-20 1187840]
“Reminder”=“c:\windows\Creator\Remind_XP.exe” [2006-03-09 806912]
“Scheduler”=“c:\windows\SMINST\Scheduler.exe” [2006-02-15 892928]
“WatchDog”=“c:\programmer\InterVideo\DVD Check\DVDCheck.exe” [2005-11-08 184320]
“OfficeScanNT Monitor”=“c:\programmer\Trend Micro\OfficeScan Client\pccntmon.exe” [2006-02-07 356352]
“Windows Defender”=“c:\programmer\Windows Defender\MSASCui.exe” [2006-11-03 866584]
“avast5”=“c:\progra~1\ALWILS~1\Avast5\avastUI.exe” [2010-03-09 2769336]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Hurtigstart.lnk - c:\programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
BTTray.lnk - c:\programmer\WIDCOMM\Bluetooth-software\BTTray.exe [2006-1-18 581693]
DVD Check.lnk - c:\programmer\InterVideo\DVD Check\DVDCheck.exe [2008-9-3 184320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2005-07-25 18:41 40960 ——a-w- c:\programmer\HPQ\IAM\Bin\AsWlnPkg.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=“Service”
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2006-02-14 09:56 122880 ——a-w- c:\programmer\HPQ\HP ProtectTools Security Manager\pthosttr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-03 16:46 761948 ——a-w- c:\programmer\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusOverride”=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\\system32\\sessmgr.exe”=
“c:\\WINDOWS\\system32\\mqsvc.exe”=
“c:\\WINDOWS\\SMINST\\Scheduler.exe”=
“%windir%\\Network Diagnostic\\xpnetdiag.exe”=
“c:\\Programmer\\NET TV\\SOPCAST\\adv\\SopAdver.exe”=
“c:\\Programmer\\NET TV\\SOPCAST\\SopCast.exe”=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29-12-2008 19:55 162640]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [27-08-2004 09:00 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29-12-2008 19:55 19024]
R2 TmFilter;Trend Micro Filter;c:\programmer\Trend Micro\OfficeScan Client\tmxpflt.sys [09-11-2005 19:34 205328]
R2 TmPreFilter;Trend Micro PreFilter;c:\programmer\Trend Micro\OfficeScan Client\tmpreflt.sys [09-11-2005 19:34 36368]
R2 WinDefend;Windows Defender;c:\programmer\Windows Defender\MsMpEng.exe [03-11-2006 19:19 13592]
S2 gupdate;Tjenesten Google Update (gupdate);c:\programmer\Google\Update\GoogleUpdate.exe [31-01-2010 00:59 135664]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\DRIVERS\gtipci21.sys—> c:\windows\system32\DRIVERS\gtipci21.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel
.
Indhold af mappen ‘Planlagte Opgaver’
2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2010-01-30 23:59]
2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2010-01-30 23:59]
2010-03-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmer\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
2010-03-13 c:\windows\Tasks\User_Feed_Synchronization-{F2EF1A46-726B-4C4E-B6C7-A05A9C3BD8FB}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
———- Yderligere scanning———-
.
uStart Page = hxxp://signon.stofanet.dk/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksporter; til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki ... - c:\programmer\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Send til &Bluetooth; - c:\programmer\WIDCOMM\Bluetooth-software\btsendto_ie_ctx.htm
IE: {{A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - c:\casino\Bwin\CD Poker\CDPoker\casino.exe
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.djs-netbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
DPF: {C8C1066B-FE9E-4B1B-9951-1BBC5EE03E38} - hxxps://www2.web-direct.dk/WDX.CAB
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 14:09
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\programmer\HPQ\Default Settings\cpqset.exe???????X[??????n??|?@???? ??4B????????? ????hB?????X[?
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
——————————- LÅSTE REGISTRERINGS NØGLER——————————-
[HKEY_USERS\S-1-5-21-4031063971-2685612392-1083774949-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
“88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977”=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,eb,68,a7,a4,48,6c,41,b1,aa,1c,\
“2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81”=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,eb,68,a7,a4,48,6c,41,b1,aa,1c,\
“6256FFB019F8FDFBD36745B06F4540E9AEAF222A25”=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,eb,68,a7,a4,48,6c,41,b1,aa,1c,\
.
——————————- DLLs startet under kørende Processer——————————-
- - - - - - - > ‘winlogon.exe’(860)
c:\programmer\HPQ\IAM\Bin\AsWlnPkg.dll
- - - - - - - > ‘explorer.exe’(3488)
c:\programmer\HPQ\IAM\Bin\SFSShell.dll
c:\programmer\HPQ\IAM\bin\ItMsg.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
————————————Andre kørende processer————————————
.
c:\programmer\HPQ\IAM\bin\asghost.exe
c:\windows\system32\DllHost.exe
c:\programmer\Alwil Software\Avast5\AvastSvc.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\msdtc.exe
c:\programmer\WIDCOMM\Bluetooth-software\bin\btwdins.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\Fælles filer\LightScribe\LSSrvc.exe
c:\programmer\Trend Micro\OfficeScan Client\ntrtscan.exe
c:\programmer\Trend Micro\OfficeScan Client\tmlisten.exe
c:\windows\system32\mqsvc.exe
c:\programmer\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
c:\programmer\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\TEMP\NC8815.EXE
c:\programmer\Windows Media Player\WMPNetwk.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Gennemført tid: 2010-03-13 14:13:46 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-03-13 13:13
ComboFix2.txt 2010-02-06 12:36
Pre-Kørsel: 30.017.511.424 byte ledig
Post-Kørsel: 30.033.125.376 byte ledig
- - End Of File - - BDAC2D46089B00CCD29128D49B9B9D03
