panda online scan

betterinet er ikke virus men adware. Prøv med adaware.

Du har den nyeste variant af VX2 infektionen. Hent L2mfix.exe fra et af disse steder:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Gem filen på dit Skrivebord og dobbeltklik på l2mfix.exe. Klik på Install knappen og følg instruktionerne. Åben herefter den nye mappe der er dannet på dit Skrivebord (l2mfix). Dobbeltklik på l2mfix.bat og vælg option 1 (Run Find log) ved at taste "1" og "Enter". Din computer bliver nu scannet - efter et par minutter åbnes en tekstfil i Notesblok. Kopier indholdet herind.

NB: Du må ikke køre option 2 eller andre af filerne i l2mfix mappen, før du er blevet bedt om det

her den håber ,jeg har gjort det rigtig



L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Webbmappar"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
  asferror.dll  Fri 28 Jan 2005  15.26.38  A....          8.192    8,00 K
  audiodev.dll  Fri 28 Jan 2005  15.26.32  A....        484.864  473,50 K
  authz.dll      Wed  2 Mar 2005  20.18.12  A....        56.832    55,50 K
  blackbox.dll  Fri 28 Jan 2005  8.53.28  A....        294.912  288,00 K
  browseui.dll  Thu 10 Mar 2005  10.04.12  A....      1.016.832  993,00 K
  cdfview.dll    Thu 10 Mar 2005  10.04.12  A....        151.552  148,00 K
  cewmdm.dll    Fri 28 Jan 2005  8.53.20  A....        164.864  161,00 K
  cmdlin~1.dll  Tue 12 Apr 2005  18.27.38  A....        43.520    42,50 K
  drmclien.dll  Fri 28 Jan 2005  13.32.44  A....        258.296  252,24 K
  drmstor.dll    Fri 28 Jan 2005  8.53.22  A....        96.768    94,50 K
  drmv2clt.dll  Fri 28 Jan 2005  8.53.38  A....        502.272  490,50 K
  iepeers.dll    Thu 10 Mar 2005  10.04.12  A....        250.880  245,00 K
  inseng.dll    Thu 10 Mar 2005  10.04.12  A....        96.768    94,50 K
  laprxy.dll    Fri 28 Jan 2005  8.53.16  A....          6.656    6,50 K
  mshtml.dll    Thu 10 Mar 2005  10.04.12  A....      3.010.560    2,87 M
  msi.dll        Mon 21 Mar 2005  15.00.20  A....      2.890.240    2,75 M
  msihnd.dll    Mon 21 Mar 2005  15.00.22  A....        271.360  265,00 K
  msimsg.dll    Mon 21 Mar 2005  15.00.22  A....        884.736  864,00 K
  msisip.dll    Mon 21 Mar 2005  15.00.22  A....        15.360    15,00 K
  msnetobj.dll  Fri 28 Jan 2005  8.53.22  A....        142.336  139,00 K
  mspmsnsv.dll  Fri 28 Jan 2005  8.53.20  A....        25.088    24,50 K
  mspmsp.dll    Fri 28 Jan 2005  8.53.20  A....        173.568  169,50 K
  msrating.dll  Thu 10 Mar 2005  10.04.12  A....        146.432  143,00 K
  msscp.dll      Fri 28 Jan 2005  13.32.44  A....        364.784  356,23 K
  mswmdm.dll    Fri 28 Jan 2005  15.26.32  A....        315.904  308,50 K
  nvhwvid.dll    Thu 24 Feb 2005  7.32.00  A....        540.672  528,00 K
  nvnt4cpl.dll  Thu 24 Feb 2005  7.32.00  A....        245.760  240,00 K
  nvwimg.dll    Thu 24 Feb 2005  7.32.00  A....      1.019.904  996,00 K
  pncrt.dll      Tue  5 Apr 2005  16.00.02  A....        278.528  272,00 K
  pndx5016.dll  Tue  5 Apr 2005  16.00.04  A....          6.656    6,50 K
  pndx5032.dll  Tue  5 Apr 2005  16.00.04  A....          5.632    5,50 K
  qasf.dll      Fri 28 Jan 2005  8.53.22  A....        221.184  216,00 K
  rmoc3260.dll  Tue  5 Apr 2005  16.00.10  A....        176.167  172,04 K
  rnplf5.dll    Sat  9 Apr 2005  19.54.58  A....            34    0,03 K
  shdocvw.dll    Thu 10 Mar 2005  10.04.14  A....      1.483.264    1,41 M
  shell32.dll    Tue  1 Mar 2005  1.12.34  A....      8.461.824    8,07 M
  shlwapi.dll    Thu 10 Mar 2005  10.04.14  A....        473.600  462,50 K
  spmsg.dll      Mon 21 Mar 2005  15.00.06  .....        14.048    13,72 K
  urlmon.dll    Thu 10 Mar 2005  10.04.14  A....        605.696  591,50 K
  user32.dll    Wed  2 Mar 2005  20.18.14  A....        577.024  563,50 K
  wdfapi.dll    Fri 28 Jan 2005  1.35.58  A....        15.872    15,50 K
  wininet.dll    Thu 10 Mar 2005  10.04.14  A....        658.432  643,00 K
  winsrv.dll    Wed  2 Mar 2005  20.18.14  A....        291.328  284,50 K
  wmadmod.dll    Fri 28 Jan 2005  13.32.44  A....        396.528  387,23 K
  wmadmoe.dll    Fri 28 Jan 2005  8.53.18  A....        716.288  699,50 K
  wmasf.dll      Fri 28 Jan 2005  8.53.16  A....        224.768  219,50 K
  wmdmlog.dll    Fri 28 Jan 2005  8.53.20  A....        28.160    27,50 K
  wmdmps.dll    Fri 28 Jan 2005  8.53.20  A....        33.792    33,00 K
  wmdrmdev.dll  Fri 28 Jan 2005  8.53.50  A....        335.872  328,00 K
  wmdrmnet.dll  Fri 28 Jan 2005  8.53.54  A....        290.816  284,00 K
  wmerror.dll    Fri 28 Jan 2005  15.26.40  A....        201.216  196,50 K
  wmidx.dll      Fri 28 Jan 2005  8.53.16  A....        150.016  146,50 K
  wmnetmgr.dll  Fri 28 Jan 2005  8.53.16  A....      1.027.072  1003,00 K
  wmp.dll        Fri 28 Jan 2005  8.53.16  A....      5.525.504    5,27 M
  wmpasf.dll    Fri 28 Jan 2005  8.53.20  A....        135.168  132,00 K
  wmpcd.dll      Fri 28 Jan 2005  8.52.52  A....        20.480    20,00 K
  wmpcore.dll    Fri 28 Jan 2005  8.52.52  A....        20.480    20,00 K
  wmpdxm.dll    Fri 28 Jan 2005  8.53.20  A....        282.624  276,00 K
  wmpencen.dll  Fri 28 Jan 2005  8.53.18  A....      1.594.880    1,52 M
  wmploc.dll    Fri 28 Jan 2005  15.26.34  A....      3.387.392    3,23 M
  wmpshell.dll  Fri 28 Jan 2005  15.26.34  A....        86.016    84,00 K
  wmpsrcwp.dll  Fri 28 Jan 2005  8.53.18  A....        175.104  171,00 K
  wmpui.dll      Fri 28 Jan 2005  8.52.52  A....        20.480    20,00 K
  wmsdmod.dll    Fri 28 Jan 2005  13.32.56  A....        774.904  756,74 K
  wmsdmoe2.dll  Fri 28 Jan 2005  8.53.18  A....      1.119.744    1,07 M
  wmspdmod.dll  Fri 28 Jan 2005  13.32.44  A....        413.944  404,24 K
  wmspdmoe.dll  Fri 28 Jan 2005  8.53.18  A....        940.544  918,50 K
  wmvadvd.dll    Fri 28 Jan 2005  13.32.56  A....      1.218.808    1,16 M
  wmvadve.dll    Fri 28 Jan 2005  8.53.20  A....      1.512.448    1,44 M
  wmvcore.dll    Fri 28 Jan 2005  13.32.58  A....      2.370.296    2,26 M
  wmvdmod.dll    Fri 28 Jan 2005  13.32.58  A....        895.736  874,74 K
  wmvdmoe2.dll  Fri 28 Jan 2005  8.53.18  A....      1.003.008  979,50 K
  wnaspi32.dll  Sat  9 Apr 2005  1.26.44  A....        45.056    44,00 K
  wpdconns.dll  Fri 28 Jan 2005  1.36.20  A....        61.952    60,50 K
  wpdmtp.dll    Fri 28 Jan 2005  1.36.24  A....        114.176  111,50 K
  wpdmtpdr.dll  Fri 28 Jan 2005  1.36.26  A....        331.776  324,00 K
  wpdmtpus.dll  Fri 28 Jan 2005  1.36.22  A....        66.560    65,00 K
  wpdsp.dll      Fri 28 Jan 2005  1.36.28  A....        331.264  323,50 K
  wpdtrace.dll  Fri 28 Jan 2005  1.36.16  A....        10.752    10,50 K
  wpd_ci.dll    Fri 28 Jan 2005  1.36.28  A....        38.912    38,00 K

80 items found:  80 files, 0 directories.
  Total of file sizes:  52.651.737 bytes    50,21 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Disken i drev C er HP_PAVILION
Diskens serienummer er E8F9-B58C

Indhold af C:\WINDOWS\System32

20-04-2005  20:50    <DIR>          dllcache
02-01-2004  06:09    <DIR>          Microsoft
              0 fil(er)                0 byte
              2 mappe(r)  164.825.804.800 byte ledig

Luk alle programmer - du vil om lidt blive bedt om at genstarte din computer.

Fra mappen l2mfix skal du køre l2mfix.bat igen - denne gang skal du vælge option 2 (Run Fix). Herefter skal du taste en tilfældig tast for at genstarte. Efter genstart vil dit Skrivebord og din ikoner vise sig og forsvinde igen - l2mfix vil fortsætte med at scanne din computer og når programmet er færdigt, vil en ny tekstfil blive åbnet i Notesblok. Kopier indholdet herind sammen med en frisk HijackThis log.

NB: Du må ikke køre andre af filerne i l2mfix mappen, før du er blevet bedt om det

L2Mfix 1.03

Running From:
C:\Documents and Settings\Ejer\Skrivebord\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI)    DENY  --C-------      BUILTIN\Administratorer
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Ejer\Skrivebord\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Ejer\Skrivebord\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1420 'explorer.exe'
Killing PID 1420 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1848 'rundll32.exe'
Killing PID 1996 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Zipping up files for submission:
  adding: clear.reg (188 bytes security) (deflated 2%)
  adding: echo.reg (188 bytes security) (deflated 9%)
  adding: direct.txt (188 bytes security) (stored 0%)
  adding: lo2.txt (188 bytes security) (deflated 70%)
  adding: readme.txt (188 bytes security) (deflated 49%)
  adding: report.txt (188 bytes security) (deflated 75%)
  adding: test.txt (188 bytes security) (stored 0%)
  adding: test2.txt (188 bytes security) (stored 0%)
  adding: test3.txt (188 bytes security) (stored 0%)
  adding: test5.txt (188 bytes security) (stored 0%)
  adding: backregs/shell.reg (188 bytes security) (deflated 63%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators  ... failed (GetAccountSid(Administrators)=1332


The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok. 
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
    

Logfile of HijackThis v1.99.1
Scan saved at 12:18:17, on 22-04-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe
C:\Programmer\Multimedia Card Reader\shwicon2k.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ejer\Skrivebord\download\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Programmer\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Programmer\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Programmer\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mwavscan] "C:\Kaspersky\mwavscan.com" /s
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Programmer\HP\Digital Imaging\bin\backupnotify.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F9} (Flatcast Viewer 4.12) - http://www.1mal1.com/flatcast/NpFv412.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Din log er ren.
Jeg ville dog fixe denne, så Mwav ikke kører ved hver opstart:
O4 - HKLM\..\Run: [mwavscan] "C:\Kaspersky\mwavscan.com" /s
Kør Hijackthis igen, sæt flueben ved linien, klik på fix Checked.

Er dit problem løst?

hej,har scanet med panda oneline scan igen ,og den siger at den stadig er i registrering.