hj log

hejsa - hvordan ser disse ud?

ComboFix 10-04-29.05 - Mikes PC 30-04-2010  22:52:36.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.45.1030.18.991.555 [GMT 2:00]
Kører fra: c:\documents and settings\Mikes PC\Dokumenter\safe\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Mikes PC\Dokumenter\safe\CFScript.txt

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

(((((((((((((((((((((((((((((  Filer skabt fra 2010-03-28 til 2010-04-30  )))))))))))))))))))))))))))))))))))
.

2010-04-30 20:06 . 2010-04-30 20:06    --------    d-----w-    c:\documents and settings\Mikes PC\Application Data\Malwarebytes
2010-04-30 20:06 . 2010-04-29 13:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 20:06 . 2010-04-30 20:06    --------    d-----w-    c:\programmer\Malwarebytes' Anti-Malware
2010-04-30 20:06 . 2010-04-30 20:06    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-30 20:06 . 2010-04-29 13:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-04-30 20:04 . 2010-04-30 20:04    --------    d-----w-    c:\programmer\CCleaner
2010-04-30 19:48 . 2004-08-26 15:53    21504    -c--a-w-    c:\windows\system32\dllcache\hidserv.dll
2010-04-30 19:48 . 2004-08-26 15:53    21504    ----a-w-    c:\windows\system32\hidserv.dll
2010-04-30 19:48 . 2004-08-26 15:49    14848    -c--a-w-    c:\windows\system32\dllcache\kbdhid.sys
2010-04-30 19:48 . 2004-08-26 15:49    14848    ----a-w-    c:\windows\system32\drivers\kbdhid.sys

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-30 19:49 . 2004-08-27 12:00    47474    ----a-w-    c:\windows\system32\perfc006.dat
2010-04-30 19:49 . 2004-08-27 12:00    325198    ----a-w-    c:\windows\system32\perfh006.dat
2010-02-11 18:38 . 2010-02-11 18:28    117120    ----a-w-    c:\windows\system32\drivers\Rtnicxp.sys
2010-02-11 18:29 . 2009-04-20 20:00    105216    ----a-w-    c:\windows\system32\drivers\EMCR7SK.sys
2010-02-11 18:27 . 2010-02-11 18:28    9728    ----a-w-    c:\windows\system32\RtNicProp32.dll
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-27 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCTVOICE"="pctspk.exe" [2003-11-06 180224]
"SynTPLpr"="c:\programmer\Synaptics\SynTP\SynTPLpr.exe" [2003-09-26 98304]
"SynTPEnh"="c:\programmer\Synaptics\SynTP\SynTPEnh.exe" [2003-09-26 503808]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2010-02-11 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2010-02-11 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2010-02-11 118784]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-27 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [20-04-2009 22:00 105216]
.
Indhold af mappen 'Planlagte Opgaver'

2010-04-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-11-15 21:18]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-30 22:56
Windows 5.1.2600 Service Pack 2 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'explorer.exe'(3496)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\pctspk.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\programmer\Internet Explorer\IEXPLORE.EXE
c:\programmer\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Gennemført tid: 2010-04-30  22:59:46 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2010-04-30 20:59

Pre-Kørsel: 31.843.983.360 byte ledig
Post-Kørsel: 31.809.720.320 byte ledig

- - End Of File - - 6DD795D25CC77F75A0177BC62564B388




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:03:39, on 30-04-2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmer\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exae
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe

--
End of file - 2387 bytes