explore åbner party poker
jeg bruger mozilla firefox men ca 10-20 sek. efter poper Int.explore op med poker - grean cart eller ling. jeg har prøvet spy wapeblarster ccleaner combofixher en log:
ComboFix 08-02.05.3 - Administrator 2008-02-07 11:11:36.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1030.18.1608 [GMT 1:00]
Running from: C:\Documents and Settings\Administrator\Skrivebord\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
.
((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.
2008-02-07 11:12 . 2008-02-07 11:12 <DIR> d-------- C:\TEMP\tn3
2008-02-07 11:11 . 2004-08-26 16:53 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-07 11:11 . 2008-02-07 11:11 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-07 11:03 . 2008-02-07 11:03 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-02-07 10:58 . 2004-08-26 16:53 391,168 --a------ C:\kmd.exe
2008-02-07 10:54 . 2008-02-07 10:56 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-07 10:12 . 2008-02-07 10:15 <DIR> d-------- C:\Programmer\SpywareBlaster
2008-02-07 10:12 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-07 08:07 . 2008-02-07 08:49 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-02-07 08:07 . <DIR> C:\Programmer\Fælles filer\Wise Installation Wizard
2008-02-07 08:07 . 2008-02-07 08:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-07 08:07 . 2008-02-07 08:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-02-07 08:02 . 2008-02-07 08:03 <DIR> d-------- C:\Programmer\CCleaner
2008-02-07 07:39 . 2008-02-07 07:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\.ABC
2008-02-07 07:05 . 2008-02-07 07:15 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-07 06:58 . <DIR> C:\Programmer\Fælles filer\Scanner
2008-02-07 06:58 . 2008-02-07 07:00 <DIR> d-------- C:\Programmer\CA Yahoo! Anti-Spy
2008-02-06 23:50 . 2008-02-06 23:50 <DIR> d-------- C:\WINDOWS\Sun
2008-02-06 23:50 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-06 23:49 . 2008-02-06 23:50 <DIR> d-------- C:\Programmer\Java
2008-02-06 23:49 . <DIR> C:\Programmer\Fælles filer\Java
2008-02-06 18:43 . 2008-02-06 18:43 <DIR> d-------- C:\Programmer\K-Lite Codec Pack
2008-02-06 18:41 . 2008-02-06 18:41 <DIR> d-------- C:\Programmer\Windows Media Connect 2
2008-02-06 18:41 . 2008-02-06 18:41 <DIR> d-------- C:\Programmer\ABC
2008-02-06 18:40 . 2008-02-06 18:40 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-06 18:40 . 2008-02-06 18:41 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-06 15:55 . 2008-02-07 11:12 <DIR> d-------- C:\TEMP
2008-02-06 15:54 . 2008-02-06 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-06 15:53 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-06 15:53 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-06 15:53 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-06 15:52 . 2008-02-06 15:52 <DIR> d-------- C:\Programmer\Alwil Software
2008-02-06 15:52 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-02-06 15:52 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-06 15:52 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-06 15:52 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-06 15:52 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-06 15:52 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-05 23:23 . <DIR> C:\Programmer\Fælles filer\Adobe
2008-02-05 22:14 . 2008-02-06 23:50 1,267 --a------ C:\WINDOWS\mozver.dat
2008-02-05 21:10 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-02-05 21:09 . 2008-02-05 21:09 <DIR> d-------- C:\Programmer\MSBuild
2008-02-05 21:09 . 2008-02-05 21:09 <DIR> d-------- C:\Programmer\Microsoft Works
2008-02-05 21:04 . 2008-02-05 21:08 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-05 21:04 . 2008-02-05 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 21:03 . 2008-02-05 21:03 <DIR> dr-h----- C:\MSOCache
2008-02-05 20:57 . 2008-02-05 20:57 <DIR> d-------- C:\Programmer\MSECache
2008-02-05 20:54 . 2008-02-07 10:32 <DIR> d-------- C:\Programmer\Wolfenstein - Enemy Territory
2008-02-05 16:21 . 2008-02-05 16:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-05 16:21 . 2008-02-05 16:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-02-05 16:21 . 2002-02-21 18:56 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-02-05 16:21 . 2008-02-05 16:21 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-05 16:20 . 2008-02-07 06:58 <DIR> d-------- C:\Programmer\Yahoo!
2008-02-05 16:18 . 2008-02-05 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-05 16:16 . 2008-02-05 16:16 <DIR> d-------- C:\WINDOWS\nview
2008-02-05 16:16 . 2008-02-05 16:16 <DIR> d-------- C:\NVIDIA
2008-02-05 16:16 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-02-05 16:16 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-02-05 16:16 . 2008-02-05 16:17 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-02-05 16:16 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-02-05 16:00 . 2004-06-21 20:25 51,088 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-02-05 16:00 . 2004-06-21 20:25 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-02-05 16:00 . 2004-06-21 20:25 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-02-05 15:59 . 2004-06-21 20:25 581,632 -ra------ C:\WINDOWS\system32\hpotscl.dll
2008-02-05 15:59 . 2004-06-21 20:25 278,528 -ra------ C:\WINDOWS\system32\hpgwiamd.dll
2008-02-05 15:59 . 2004-06-21 20:25 270,336 -ra------ C:\WINDOWS\system32\HPZc3212.dll
2008-02-05 15:59 . 2004-06-21 20:25 90,112 -ra------ C:\WINDOWS\system32\hpovst08.dll
2008-02-05 15:59 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-05 15:59 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-05 08:14 . 2008-02-05 08:14 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-02-05 08:14 . 2008-02-05 08:14 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-05 08:14 . 2008-02-05 08:14 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-05 06:38 . 2008-02-05 06:38 103,950 --a------ C:\WINDOWS\hpoins04.dat
2008-02-05 06:38 . 2004-06-21 20:25 17,176 --------- C:\WINDOWS\hpomdl04.dat
2008-02-05 06:32 . 2005-05-03 11:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-02-05 06:27 . 2008-02-05 16:10 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-05 06:25 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-02-05 06:25 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-02-05 06:25 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-02-05 06:25 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-02-05 06:25 . 2007-07-30 19:18 20,824 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-02-05 06:23 . 2008-02-05 06:23 <DIR> d--hs---- C:\Documents and Settings\Administrator\UserData
2008-02-05 06:21 . 2008-02-05 06:21 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-02-05 06:21 . 2008-02-05 06:21 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-02-05 06:20 . 2008-02-07 09:08 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-02-05 06:20 . 2008-02-05 06:20 86,144 --a------ C:\WINDOWS\system32\drivers\ptilinkk.sys
2008-02-05 06:19 . 2008-02-05 06:20 41,168,824 --a------ C:\WINDOWS\system32\avg75avwt_516a1225.exe
2008-02-05 06:17 . 2008-02-05 06:31 <DIR> d-------- C:\Programmer\Realtek
2008-02-05 06:17 . 2006-09-12 07:34 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-02-05 06:17 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-05 06:14 . 2008-02-05 06:14 <DIR> d-------- C:\WINDOWS\vnDrvBas
2008-02-05 06:14 . 2008-02-05 06:17 <DIR> d--h----- C:\Programmer\InstallShield Installation Information
2008-02-05 06:14 . 2005-06-17 04:41 61,440 --a------ C:\WINDOWS\system32\vuins32.dll
2008-02-05 06:14 . 2006-03-15 03:51 43,008 --a------ C:\WINDOWS\system32\drivers\fetnd5bv.sys
2008-02-05 06:13 . 2008-02-05 06:13 <DIR> d-------- C:\Programmer\VIA
2008-02-05 06:13 . 2006-02-23 04:39 11,264 -ra------ C:\WINDOWS\system32\drivers\xfilt.sys
2008-02-05 06:13 . 2006-02-23 04:38 9,728 -ra------ C:\WINDOWS\system32\drivers\videX32.sys
2008-02-05 06:12 . <DIR> C:\Programmer\Fælles filer\InstallShield
2008-02-05 06:12 . 2006-10-11 04:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-02-05 06:12 . 2008-02-05 06:31 4,711 --a------ C:\WINDOWS\Ascd_tmp.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 06:39 --------- d-----w C:\Documents and Settings\Administrator\Application Data\.ABC
2008-02-04 23:27 --------- d-----w C:\Programmer\Fælles filer\ODBC
2008-02-04 23:26 --------- d-----w C:\Programmer\Fælles filer\SpeechEngines
2008-02-04 22:36 --------- d-----w C:\Programmer\microsoft frontpage
2008-02-04 22:34 --------- d-----w C:\Programmer\Onlinetjenester
2008-02-04 22:33 --------- d-----w C:\Programmer\Fælles filer\Tjenester
2008-02-04 22:33 --------- d-----w C:\Programmer\Fælles filer\MSSoap
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-26 16:53 15360]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46 1318128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 09:58 16264192 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"GrooveMonitor"="C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-26 16:53 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 04:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 04:39]
R1 ptilinkk;ptilinkk;C:\WINDOWS\system32\drivers\ptilinkk.sys [2008-02-05 06:20]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 11:14:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2008-02-07 11:15:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-07 10:15:50
ComboFix2.txt 2008-02-07 10:03:36
ComboFix3.txt 2008-02-07 09:25:19
ComboFix4.txt 2008-02-07 08:59:08
ComboFix5.txt 2008-02-07 08:53:45
.
2008-02-07 10:12:14 --- E O F ---
