Så har jeg kørt combofix og her er loggen:
ComboFix 10-03-17.07 - Allan Bo 18-03-2010 17:55:51.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.1014.286 [GMT 1:00]
Kører fra: c:\documents and settings\Allan Bo.ALLAN\Skrivebord\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Allan Bo.ALLAN\Skrivebord\Sikkerhed\CFScript.txt
AV: Norman Security Suite *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
FILE ::
“c:\docume~1\allanb~1.all\lokale~1\temp\dmskssrh.sys”
“c:\docume~1\alluse~1\applic~1\fiosejgfse.dll”
“c:\windows\system32\drivers\kdrfbw.sys”
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\alluse~1\applic~1\fiosejgfse.dll
c:\windows\system32\drivers\kdrfbw.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))
.
———-\Legacy_DMSKSSRH
———-\Service_DMSKSSRh
———-\Legacy_kdrfbw
———-\Service_kdrfbw
((((((((((((((((((((((((((((( Filer skabt fra 2010-02-18 til 2010-03-18 )))))))))))))))))))))))))))))))))))
.
2010-03-16 17:42 . 2010-03-16 17:42 ———— d——-w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-16 17:41 . 2010-03-16 17:41 ———— d——-w- c:\programmer\SUPERAntiSpyware
2010-03-16 17:41 . 2010-03-16 17:41 ———— d——-w- c:\documents and settings\Allan Bo.ALLAN\Application Data\SUPERAntiSpyware.com
2010-03-15 22:08 . 2010-02-12 10:03 293376 ———w- c:\windows\system32\browserchoice.exe
2010-03-14 22:41 . 2010-03-14 22:41 ———— d——-w- c:\programmer\RegSupreme
2010-03-14 19:48 . 2009-10-23 15:28 3558912 ———w- c:\windows\system32\dllcache\moviemk.exe
2010-03-14 17:50 . 2010-03-14 17:50 ———— d——-w- C:\Download
2010-03-14 17:45 . 2010-01-07 15:07 38224 ——a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-14 17:45 . 2010-03-14 17:45 ———— d——-w- c:\programmer\Malwarebytes’ Anti-Malware
2010-03-14 17:45 . 2010-01-07 15:07 19160 ——a-w- c:\windows\system32\drivers\mbam.sys
2010-03-11 21:07 . 2010-03-11 21:07 ———— d——-w- c:\programmer\Fælles filer\Wise Installation Wizard
2010-03-11 20:47 . 2010-03-11 20:47 ———— d-sh—w- c:\documents and settings\Administrator\IETldCache
2010-03-09 19:11 . 2010-03-09 19:11 ———— d——-w- c:\documents and settings\Allan Bo.ALLAN\DoctorWeb
2010-03-09 16:39 . 2010-03-09 16:39 ———— d——-w- c:\programmer\CCleaner
2010-03-08 16:57 . 2010-03-08 16:57 ———— d-sh—w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-17 15:35 . 2010-02-17 15:35 ———— d——-w- c:\documents and settings\Allan Bo.ALLAN\Application Data\Malwarebytes
2010-02-17 15:35 . 2010-02-17 15:35 ———— d——-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-16 18:03 . 2010-02-16 18:04 ———— d——-w- c:\documents and settings\Allan Bo.ALLAN\Application Data\Wave Systems Corp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-18 17:02 . 2007-04-11 16:31 ———— d——-w- c:\programmer\Norman
2010-03-17 22:25 . 2009-02-16 18:57 ———— d——-w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-14 22:09 . 2009-07-12 16:26 ———— d——-w- c:\programmer\DIFX
2010-03-07 17:20 . 2004-09-16 16:38 1034752 ———w- c:\windows\explorer.exe
2010-02-16 18:04 . 2007-03-16 04:01 ———— d——-w- c:\programmer\Wave Systems Corp
2010-02-13 16:42 . 2007-04-11 16:29 ———— d——-w- c:\programmer\Fælles filer\Adobe
2010-02-10 16:47 . 2007-03-16 04:13 ———— d——-w- c:\programmer\Google
2010-01-23 15:17 . 2010-01-23 15:17 ———— d——-w- c:\documents and settings\Allan Bo.ALLAN\Application Data\Office Genuine Advantage
2010-01-21 14:40 . 2009-04-09 07:49 ———— d——-w- c:\programmer\Microsoft Silverlight
2009-12-31 16:50 . 2004-09-16 16:38 353792 ——a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-09-16 16:38 916480 ———w- c:\windows\system32\wininet.dll
2007-04-11 16:32 . 2007-04-11 16:29 21102064 ——a-w- c:\programmer\AdbeRdr80_da_DK.exe
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD292324-974F-4224-CE6F-CC9441768F5D}]
2007-05-15 21:15 629288 ——a-w- c:\programmer\mail.com\Toolbar\Toolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
“{CD292324-974F-4224-CE6F-CC9441768F5D}”= “c:\programmer\mail.com\Toolbar\Toolbar.dll” [2007-05-15 629288]
[HKEY_CLASSES_ROOT\clsid\{cd292324-974f-4224-ce6f-cc9441768f5d}]
[HKEY_CLASSES_ROOT\Toolbar.mail.com]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
“{CD292324-974F-4224-CE6F-CC9441768F5D}”= “c:\programmer\mail.com\Toolbar\Toolbar.dll” [2007-05-15 629288]
[HKEY_CLASSES_ROOT\clsid\{cd292324-974f-4224-ce6f-cc9441768f5d}]
[HKEY_CLASSES_ROOT\Toolbar.mail.com]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ModemOnHold”=“c:\programmer\NetWaiting\netwaiting.exe” [2003-09-10 20480]
“swg”=“c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2008-11-07 68856]
“MsnMsgr”=“c:\programmer\Windows Live\Messenger\MsnMsgr.Exe” [2009-07-26 3883856]
“gStart”=“c:\mapsource\gStart.exe” [2008-08-13 1891416]
“Steam”=“c:\valve\Steam\Steam.exe” [2003-11-11 1081344]
“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“PPort11reminder”=“c:\programmer\ScanSoft\PaperPort\Ereg\Ereg.exe” [2007-02-01 255528]
“SunJavaUpdateSched”=“c:\programmer\Java\jre6\bin\jusched.exe” [2009-10-11 149280]
“SSBkgdUpdate”=“c:\programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe” [2006-10-25 210472]
“SigmatelSysTrayApp”=“stsystra.exe” [2006-03-24 282624]
“QuickTime Task”=“c:\programmer\QuickTime\QTTask.exe” [2009-05-26 413696]
“PaperPort PTD”=“c:\programmer\ScanSoft\PaperPort\pptd40nt.exe” [2007-01-29 30248]
“Norman ZANDA”=“c:\programmer\Norman\Npm\Bin\ZLH.EXE” [2009-11-24 189824]
“KMCONFIG”=“c:\programmer\Trust\Trust R-Series Mouse\StartAutorun.exe” [2007-03-06 212992]
“Kernel and Hardware Abstraction Layer”=“KHALMNPR.EXE” [2007-09-21 55824]
“iTunesHelper”=“c:\programmer\iTunes\iTunesHelper.exe” [2009-06-05 292136]
“ISUSScheduler”=“c:\programmer\Fælles filer\InstallShield\UpdateService\issch.exe” [2005-02-16 81920]
“ISUSPM Startup”=“c:\progra~1\FÆLLES~1\INSTAL~1\UPDATE~1\ISUSPM.exe” [2004-07-27 221184]
“IntelZeroConfig”=“c:\programmer\Intel\Wireless\bin\ZCfgSvc.exe” [2006-10-18 802816]
“IntelWireless”=“c:\programmer\Intel\Wireless\Bin\ifrmewrk.exe” [2006-10-18 696320]
“IndexSearch”=“c:\programmer\ScanSoft\PaperPort\IndexSearch.exe” [2007-01-29 46632]
“igfxtray”=“c:\windows\system32\igfxtray.exe” [2005-12-13 98304]
“igfxpers”=“c:\windows\system32\igfxpers.exe” [2005-12-13 118784]
“igfxhkcmd”=“c:\windows\system32\hkcmd.exe” [2005-12-13 77824]
“DVDLauncher”=“c:\programmer\r\CyberLink\PowerDVD\DVDLauncher.exe” [2005-12-09 49152]
“Document Manager”=“c:\programmer\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe” [2006-09-08 102400]
“DLA”=“c:\windows\System32\DLA\DLACTRLW.EXE” [2005-09-08 122940]
“Dell QuickSet”=“c:\programmer\Dell\QuickSet\quickset.exe” [2006-06-29 1032192]
“ControlCenter3”=“c:\programmer\Brother\ControlCenter3\brctrcen.exe” [2007-01-26 65536]
“BrMfcWnd”=“c:\programmer\Brother\Brmfcmon\BrMfcWnd.exe” [2007-03-12 663552]
“AppleSyncNotifier”=“c:\programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe” [2009-05-20 177472]
“Apoint”=“c:\programmer\Apoint\Apoint.exe” [2005-10-07 176128]
“Adobe Reader Speed Launcher”=“c:\programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2009-12-22 35760]
“Adobe ARM”=“c:\programmer\Fælles filer\Adobe\ARM\1.0\AdobeARM.exe” [2009-12-11 948672]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Bluetooth Manager.lnk - c:\programmer\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]
Digital Line Detect.lnk - c:\programmer\Digital Line Detect\DLG.exe [2007-3-16 24576]
EMBASSY Trust Suite Secure Update.lnk - c:\programmer\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-8-25 192512]
NkbMonitor.exe.lnk - c:\programmer\Nikon\PictureProject\NkbMonitor.exe [2008-7-21 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
“{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\programmer\SUPERAntiSpyware\SASSEH.DLL” [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 ——a-w- c:\programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\\system32\\sessmgr.exe”=
“c:\\Programmer\\Messenger\\msmsgs.exe”=
“%windir%\\Network Diagnostic\\xpnetdiag.exe”=
“c:\\Valve\\Condition Zero\\czero.exe”=
“c:\\Programmer\\Bonjour\\mDNSResponder.exe”=
“c:\\Programmer\\iTunes\\iTunes.exe”=
“c:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe”=
“c:\\Programmer\\Windows Live\\Sync\\WindowsLiveSync.exe”=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
“8085:TCP”= 8085:TCP:OKOGate
R1 NGS;Norman General Security Driver;c:\programmer\Norman\Ngs\Bin\ngs.sys [06-04-2009 13:38 25032]
R1 NPROSEC;Norman Security driver;c:\programmer\Norman\Ngs\Bin\nprosec.sys [12-05-2009 14:52 61512]
R1 SASDIFSV;SASDIFSV;c:\programmer\SUPERAntiSpyware\sasdifsv.sys [29-02-2008 16:03 8944]
R1 SASKUTIL;SASKUTIL;c:\programmer\SUPERAntiSpyware\SASKUTIL.SYS [29-02-2008 16:03 51440]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\programmer\Trust\Trust R-Series Mouse\KMWDSrv.exe [08-06-2007 23:23 208896]
R2 Ndiskio;Ndiskio;c:\programmer\Norman\Nse\Bin\Ndiskio.sys [16-10-2009 16:18 24168]
R2 NPROSECSVC;Norman Security service;c:\programmer\Norman\Ngs\Bin\nprosec.exe [12-05-2009 14:52 103752]
R2 NVOY;Norman Resource Provider;c:\programmer\Norman\Npm\Bin\nvoy.exe [06-04-2009 13:39 128328]
R3 nsesvc;Norman Scanner Engine Service;c:\programmer\Norman\Nse\Bin\Nsesvc.exe [16-10-2009 16:18 283976]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [06-04-2009 13:38 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\programmer\Norman\nvc\bin\Nvcoas.exe [06-04-2009 13:38 202056]
R3 Scheduler;Norman Scheduler Service;c:\programmer\Norman\Npm\Bin\scheduler.exe [12-05-2009 14:52 133272]
S2 gupdate1c990688a5e85be;Tjenesten Google Update (gupdate1c990688a5e85be);c:\programmer\Google\Update\GoogleUpdate.exe [16-02-2009 19:58 133104]
S3 NVCScheduler;Norman Virus Control Scheduler;“c:\programmer\Norman\Npm\Bin\Nvcsched.exe”—> c:\programmer\Norman\Npm\Bin\Nvcsched.exe [?]
S3 SASENUM;SASENUM;c:\programmer\SUPERAntiSpyware\SASENUM.SYS [16-02-2006 16:51 4096]
S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [21-07-2008 12:13 39424]
—- Andre Services/Drivers i Hukommelsen—-
*Deregistered* - mchInjDrv
.
Indhold af mappen ‘Planlagte Opgaver’
2009-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]
2010-03-18 c:\windows\Tasks\Google Software Updater.job
- c:\programmer\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-21 05:51]
2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2009-02-16 18:58]
2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2009-02-16 18:58]
2010-03-18 c:\windows\Tasks\User_Feed_Synchronization-{92F160D4-5847-4E0E-B51E-BF519818AC30}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
———- Yderligere scanning———-
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: E&ksporter; til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\programmer\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: danid.dk
Trusted Zone: danid.dk
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
DPF: {4F2A3649-7A9F-4950-9C31-409FAC6FC7C8} - hxxps://danid.dk/csp/authenticode/csp.exe
FF - ProfilePath - c:\documents and settings\Allan Bo.ALLAN\Application Data\Mozilla\Firefox\Profiles\l4iqirck.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Webster
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:da:official
FF - prefs.js: keyword.URL - hxxp://search.addthis.com/search?pco=fxe-3.0.0&locale=da&q=
FF - plugin: c:\programmer\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programmer\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\programmer\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\programmer\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programmer\Picasa2\npPicasa3.dll
FF - plugin: c:\programmer\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
——FIREFOX POLITIKKER——
c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref(“browser.fixup.alternate.suffix”, “.dk”);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-18 18:04
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
——————————- DLLs startet under kørende Processer——————————-
- - - - - - - > ‘winlogon.exe’(1120)
c:\programmer\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > ‘lsass.exe’(1176)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
- - - - - - - > ‘explorer.exe’(1280)
c:\programmer\Norman\nvc\bin\Niphk.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
————————————Andre kørende processer————————————
.
c:\programmer\Norman\Npm\Bin\Elogsvc.exe
c:\programmer\Intel\Wireless\Bin\EvtEng.exe
c:\programmer\Intel\Wireless\Bin\S24EvMon.exe
c:\programmer\Intel\Wireless\Bin\WLKeeper.exe
c:\programmer\Norman\Npm\Bin\Zanda.exe
c:\windows\System32\SCardSvr.exe
c:\programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmer\Bonjour\mDNSResponder.exe
c:\programmer\Wave Systems Corp\Common\DataServer.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\stsystra.exe
c:\programmer\Dell\QuickSet\NICCONFIGSVC.exe
c:\programmer\Trust\Trust R-Series Mouse\KMConfig.exe
c:\programmer\Intel\Wireless\Bin\RegSrvc.exe
c:\programmer\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\programmer\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
c:\programmer\Trust\Trust R-Series Mouse\KMProcess.exe
c:\windows\system32\igfxsrvc.exe
c:\programmer\Brother\ControlCenter3\brccMCtl.exe
c:\programmer\Norman\Npm\Bin\Njeeves.exe
c:\programmer\iPod\bin\iPodService.exe
c:\programmer\Brother\Brmfcmon\BrMfcmon.exe
c:\programmer\Apoint\Apntex.exe
c:\programmer\Apoint\HidFind.exe
c:\programmer\Intel\Wireless\Bin\Dot1XCfg.exe
c:\programmer\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\programmer\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\programmer\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\programmer\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\programmer\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
c:\programmer\Norman\Nvc\Bin\Nip.exe
c:\programmer\Norman\Nvc\Bin\cclaw.exe
c:\programmer\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Gennemført tid: 2010-03-18 18:11:14 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-03-18 17:11
ComboFix2.txt 2010-03-16 22:45
Pre-Kørsel: 57.931.091.968 byte ledig
Post-Kørsel: 57.894.526.976 byte ledig
- - End Of File - - 8CC42210B0B0D24C30EEF59DF93EF1DF
