HER ER HVAD DER STÅR I MIN COMBOFIX HVIS NOGLE KAN TYDE DETTE????
ComboFix 08-01-03.3 - Marian 2008-01-03 17:21:12.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1030.18.136 [GMT 1:00]
Running from: C:\Documents and Settings\Marian\Lokale indstillinger\Temporary Internet Files\Content.IE5\
0R0MLOYN\ComboFix[1].exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\_install.exe blev ikke fundet.
.
((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 )))))))))))))))))))))))))))))))
.
2008-01-03 16:52 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-12-19 10:47 . 2007-12-19 10:47 <DIR> d-------- C:\Documents and Settings\Marian\Application Data\Politiken
2007-12-19 10:46 . 2007-12-19 10:46 <DIR> d-------- C:\Programmer\Polob32
2007-12-15 15:41 . 2007-12-15 15:42 <DIR> d-------- C:\RVAXO
2007-12-15 15:39 . 2007-12-15 12:20 536,766 --a------ C:\WINDOWS\system32\RVAXO.bat
2007-12-15 15:39 . 2001-10-01 14:51 69,632 --a------ C:\WINDOWS\system32\remove.exe
2007-12-05 15:14 . 2007-07-06 18:39 401,720 --a------ C:\Programmer\HJTrenamed.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 20:30 --------- d-----w C:\Documents and Settings\Marian\Application Data\Skype
2007-12-25 11:02 --------- d-----w C:\Programmer\Windows Media Connect 2
2007-12-22 12:23 --------- d-----w C:\Programmer\MioNet
2007-12-05 14:15 9,295 ----a-w C:\Programmer\hijackthis.log
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-22 16:31 --------- d-----w C:\Programmer\iTunes
2007-11-22 16:31 --------- d-----w C:\Programmer\iPod
2007-11-22 16:30 --------- d-----w C:\Programmer\QuickTime
2007-11-22 16:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 19:18 --------- d-----w C:\Programmer\CDex_150
2007-11-04 18:53 --------- d-----w C:\Documents and Settings\Marian\Application Data\fiksdinpc
2007-11-04 18:48 --------- d-----w C:\Programmer\Fælles filer\FiksDinPC
2007-11-04 18:48 --------- d-----r C:\Documents and Settings\All Users\Application Data\fiksdinpc
2007-10-29 22:44 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programmer\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 02:53 15360]
"OM_Monitor"="C:\Programmer\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 17:51 57344]
"H/PC Connection Agent"="C:\Programmer\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 19:54 1204224]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-01 07:52 68856]
"WMPNSCFG"="C:\Programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 10:30 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="C:\Programmer\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 17:50 40960]
"Microsoft Works Update Detection"="C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 05:20 28672]
"LtMoh"="C:\Programmer\ltmoh\Ltmoh.exe" [2003-04-28 08:08 184320]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-11-02 02:03 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-11-02 01:59 126976]
"EzButton"="C:\Programmer\EzButton\EzButton.EXE" [2005-01-03 04:21 417792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-27 02:53 110592 C:\WINDOWS\system32\bthprops.cpl]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"Apoint"="C:\Programmer\Apoint2K\Apoint.exe" [2003-06-18 07:44 151552]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 06:38 88361 C:\WINDOWS\AGRSMMSG.exe]
"Adobe Photo Downloader"="C:\Programmer\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 14:37 40960]
"SoundMan"="SOUNDMAN.EXE" [2005-05-17 17:48 77824 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Programmer\QuickTime\QTTask.exe" [2007-11-14 23:43 286720]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2007-11-15 13:11 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-27 02:53 15360]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
TrayMin315.exe.lnk - C:\Programmer\Philips\Philips SPC315NC Webcam\TrayMin315.exe [2007-09-21 08:09:08]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoldTach]
C:\Programmer\Matinsoft\GoldTach\GoldTach.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2005-11-15 19:54 1204224 --a------ C:\Programmer\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
R1 TsMali;TsMali;C:\WINDOWS\system32\Drivers\tsmali.sys [2007-03-17 15:23]
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys [2004-12-14 11:00]
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys [2004-12-10 03:40]
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys [2004-12-10 03:40]
S3 Cap7134;LifeView WDM Video Capture;C:\WINDOWS\system32\DRIVERS\lvcap214.sys [2004-10-04 11:01]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys []
S3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
S3 PhTVTune;Philips WDM TVTuner;C:\WINDOWS\system32\DRIVERS\Silicon.sys [2004-10-04 11:02]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68bdcca9-a322-11d9-adc8-806d6172696f}]
\Shell\AutoRun\command - D:\Disk1\Setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-12-18 07:37:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-01-03 17:22:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-03 17:23:28
ComboFix2.txt 2008-01-03 15:59:15
ComboFix3.txt 2007-12-15 15:03:02
.
2007-12-26 10:36:37 --- E O F ---