HiJackThis viser :

Det var godt nok en slemmert, jeg kigger på den nu.

0. Klik på Start->Kør skriv Services.msc og klik OK.
Find Tjenesten "Network Security Service ( 11Fßä#·ºÄÖ`I)" stop den, højreklik på den og vælg Starttype Deaktiveret.

1. Hent følgende programmer:

- CWShredder, http://cwshredder.net/bin/CWShredder.exe (programmet skal ikke køres endnu)
- AboutBuster5, http://www.majorgeeks.com/download4289.html (pak programmet ud til Skrivebordet)
- Ewido, http://www.spywarefri.dk/forum/links/ewido.htm
- CCleaner, http://www.filehippo.com/download_ccleaner.html

Installer og kør Ewido - opdater programmet (men lad være med at scanne).

2. Genstart i Fejlsikret tilstand (ved at taste F8 under opstart).

3. Kør CWShredder og klik på Fix.

4. Kør AboutBuster og klik på Begin removal. Tillad programmet at lukke Explorer, hvis du bliver spurgt. Programmet laver en log i samme mappe som du har AboutBuster installeret til (AB log.txt) - den skal du kopiere herind når fixet er færdigt.

5. Kør en rensning med CCleaner (ikke strengt nødvendigt, men så kører Ewido scanningen lidt hurtigere).

6. Kør en fuld scanning med Ewido.

7. Kør HijackThis, scan og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp9068.tmp
O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Programmer\Security Toolbar\Security Toolbar.dll
O15 - Trusted Zone: *.coolwebsearch.com
O20 - Winlogon Notify: st3 - C:\WINDOWS\system32\st3.dll
O20 - Winlogon Notify: st3i - C:\WINDOWS\q1379968.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3og.exe


8. Genstart din computer i Normal tilstand og læg en frisk HijackThis log herind, sammen med log'en fra AboutBuster.

Der er sikkert et stykke endnu.

Jeg fik problemer med at installere Ewido, den stoppede ved C:\Doc ans settings\all users\manuen start\programmer\Ewido
men jeg har starten den via CMD manuelt
Processen "Network Security Service ( 11Fßä#·ºÄÖ`I)" kørte ikke, men det kan skyldes at jeg allerrede havde kørt Aboutbuster inden jeg havde fået dit svar.
pt venter jeg på at ewido bliver færdig, og så hører du fra mig.
Du skal lige være opmærksom på at jeg kører hijackthis og aboutbuster fra en USB dongle, idet jeg ellers ikke kan få logfilerne over på min arbejdsstation.

Tak indtil videre

Ja AboutBuster loggen var tom, men der er stadig nok i HiJackThis :

Logfile of HijackThis v1.99.1
Scan saved at 13:19:01, on 05-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\MSN Toolbar Suite\SL\02.05.0001.1119\da-dk\msn_sl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\wuauclt.exe
E:\AntiVirus\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp9470.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &MSN Search - res://C:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/229?6904b29e9aff4f97ad362e683784cf45
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/230?6904b29e9aff4f97ad362e683784cf45
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.coolwebsearch.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125413910828
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Det er godt nok også noget af et sammensurium af infektioner, nå lad os prøve igen.

Hent L2mfix.exe fra et af disse steder:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Gem filen på dit Skrivebord og dobbeltklik på l2mfix.exe. Klik på Install knappen og følg instruktionerne. Åben herefter den nye mappe der er dannet på dit Skrivebord (l2mfix). Dobbeltklik på l2mfix.bat og vælg option 1 (Run Find log) ved at taste "1" og "Enter". Din computer bliver nu scannet - efter et par minutter åbnes en tekstfil i Notesblok. Kopier indholdet herind.
---------------------------------------
NB: Du må ikke køre option 2 eller andre af filerne i l2mfix mappen, før du er blevet bedt om det.
---------------------------------------
Hent og dobbeltklik på smitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
Programmet pakker sig ud til mappen smitRem.
---------------------------------------
Bagefter kører du Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret (tryk på <F8> under opstarten), slet mapper og filer listet længere nede.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jlxrv.dll/sp.html#87649
R3 - Default URLSearchHook is missing
O2 - BHO: HomepageBHO - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp9470.tmp
O15 - Trusted Zone: *.coolwebsearch.com
---------------------------------------
I fejlsikret:
Sletning af \mapper\ og filer:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
<Ingen>
-------------------
Filer:
C:\WINDOWS\system32\jlxrv.dll
C:\WINDOWS\System32\hp9470.tmp
C:\WINDOWS\system32\mssearchnet.exe
---------------------------------------
Åbn mappen smitRem, og dobbeltklik på RunThis.bat (Følg vejledningen i vinduet.)
---------------------------
Genstart og kom med en frisk Hijackthislog.
Find smitfiles.txt via Start/Søg. Kopier også denne log ind.
Husk også loggen fra L2Mfix.(Den første du lavede).

Jeg kunne ikke finde/slette filerne : C:\WINDOWS\system32\jlxrv.dll
C:\WINDOWS\System32\hp9470.tmp

---------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 21:09:28, on 05-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SpyTrooper\SpyTrooper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
E:\AntiVirus\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp98B5.tmp (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpyTrooper] C:\Program Files\SpyTrooper\SpyTrooper.exe
O8 - Extra context menu item: &MSN Search - res://C:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/229?6904b29e9aff4f97ad362e683784cf45
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/230?6904b29e9aff4f97ad362e683784cf45
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125413910828
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

-------------------------------------------------------------------------------------
L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Egenskabsark for multimediefiler"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerstyring"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Sikkerhedsside"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskabsside for OLE-dokumentfil"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmkort"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rm"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmpanorering"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security-side"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Udvidelsen Diskcopy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Gr‘nsefladeudvidelser til Microsoft Windows-netv‘rksobjekter"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-sk‘rmstyring"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerstyring"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Gr‘nsefladeudvidelser til filkomprimering"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Gr‘nsefladeudvidelse til webudskrift"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontekstmenu til kryptering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Rejsetaske"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-ikon"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Sikkerhedsside"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-filtype"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto signeringsfiltype"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netv‘rksforbindelser"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netv‘rksforbindelser"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scannere og kameraer"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scannere og kameraer"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scannere og kameraer"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scannere og kameraer"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scannere og kameraer"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-udvidelser til Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-dataforbindelse"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte opgaver"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Proceslinje og menuen Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›g"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="K›r..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internettet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="V‘rkt›jslinje til Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Webs›gning"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Redigeringsboks til adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft URL-oversigtstjeneste"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Oversigt"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbillede til Internet Explorer 4-suiten"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internettet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX-cachemappe"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Programstyring"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Opt‘lling af installerede programmer"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Udpakning af miniaturer til GDI+-filer"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Dokumentinfo om miniaturehandler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Udpakning af HTML-miniaturer"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Guiden Webudgivelse"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestil billedudskrift over World Wide Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objekt til guiden Webudgivelse"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Guiden F† et Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brugerkonti"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Genvej til kanal"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappen Offlinefiler"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Efter &personer..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Webmapper"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{13E7F612-F261-4391-BEA2-39DF4F3FA311}"="Windows-pc-s›gning"
"{97090E2F-3062-4459-855B-014F0D3CDBB1}"="MSN Deskbar"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D426CFD0-87FC-4906-98D9-A23F5D515D61}]
@="MSN Desktop Search Outlook Express ISearchFolder Class"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
  addan.dll      Sun 30 Oct 2005  15.17.10  A....              0    0,00 K
  addby.dll      Mon 17 Oct 2005  18.52.42  A....              0    0,00 K
  addcz32.dll    Tue  1 Nov 2005  17.24.04  A....              0    0,00 K
  adddd.dll      Mon 24 Oct 2005  12.36.22  A....              0    0,00 K
  addea32.dll    Sat 22 Oct 2005  15.24.04  A....              0    0,00 K
  addeq.dll      Fri  4 Nov 2005  11.19.02  A....              0    0,00 K
  addgv.dll      Sun  9 Oct 2005  22.57.24  A....              0    0,00 K
  addjx.dll      Sun 16 Oct 2005  19.59.32  A....              0    0,00 K
  addlo.dll      Fri 21 Oct 2005  22.28.38  A....              0    0,00 K
  addmv.dll      Sun  9 Oct 2005  22.24.02  A....              0    0,00 K
  addnd.dll      Tue 18 Oct 2005  15.40.50  A....              0    0,00 K
  addoq.dll      Fri 28 Oct 2005  4.58.44  A....              0    0,00 K
  addry.dll      Tue 25 Oct 2005  1.13.00  A....              0    0,00 K
  addrz32.dll    Wed  2 Nov 2005  8.14.32  A....              0    0,00 K
  addwc32.dll    Thu 20 Oct 2005  2.46.06  A....              0    0,00 K
  addxo.dll      Fri  7 Oct 2005  23.55.38  A....              0    0,00 K
  addyw.dll      Tue 11 Oct 2005  12.15.26  A....              0    0,00 K
  apibm.dll      Sun  9 Oct 2005  2.47.56  A....              0    0,00 K
  apibx.dll      Tue 25 Oct 2005  15.29.54  A....              0    0,00 K
  apico32.dll    Thu 13 Oct 2005  17.55.12  A....              0    0,00 K
  apide32.dll    Sun 23 Oct 2005  8.41.48  A....              0    0,00 K
  apiht32.dll    Tue 11 Oct 2005  3.53.18  A....              0    0,00 K
  apiis32.dll    Thu 27 Oct 2005  3.54.44  A....              0    0,00 K
  apikd.dll      Mon 31 Oct 2005  21.24.48  A....              0    0,00 K
  apikz.dll      Thu  6 Oct 2005  8.14.30  A....              0    0,00 K
  apinw32.dll    Mon 17 Oct 2005  11.46.16  A....              0    0,00 K
  apipx.dll      Sat 29 Oct 2005  5.28.56  A....              0    0,00 K
  apiqw.dll      Wed 19 Oct 2005  3.18.10  A....              0    0,00 K
  apirn32.dll    Fri 28 Oct 2005  18.15.32  A....              0    0,00 K
  apith32.dll    Wed 12 Oct 2005  14.00.26  A....              0    0,00 K
  apixr32.dll    Sun  9 Oct 2005  4.18.56  A....              0    0,00 K
  apixu.dll      Sun 30 Oct 2005  19.20.54  A....              0    0,00 K
  appdb32.dll    Wed 19 Oct 2005  15.43.04  A....              0    0,00 K
  apply32.dll    Thu 20 Oct 2005  8.46.22  A....              0    0,00 K
  appqe32.dll    Wed  2 Nov 2005  9.07.18  A....              0    0,00 K
  apprv32.dll    Sat 29 Oct 2005  4.58.40  A....              0    0,00 K
  appsi.dll      Mon 24 Oct 2005  2.46.54  A....              0    0,00 K
  appzq32.dll    Sun 30 Oct 2005  18.59.34  A....              0    0,00 K
  atlaa.dll      Mon 24 Oct 2005  8.21.22  A....              0    0,00 K
  atlcm.dll      Mon 17 Oct 2005  7.50.56  A....              0    0,00 K
  atldq32.dll    Tue 18 Oct 2005  3.23.22  A....              0    0,00 K
  atlfr.dll      Mon 31 Oct 2005  7.00.24  A....              0    0,00 K
  atlgm.dll      Sat  8 Oct 2005  16.54.34  A....              0    0,00 K
  atliw32.dll    Sun 30 Oct 2005  3.44.40  A....              0    0,00 K
  atliz.dll      Sat 29 Oct 2005  1.48.24  A....              0    0,00 K
  atlmp32.dll    Sat 15 Oct 2005  17.58.58  A....              0    0,00 K
  atlod32.dll    Mon 17 Oct 2005  0.30.02  A....              0    0,00 K
  atlrj.dll      Fri 14 Oct 2005  17.41.56  A....              0    0,00 K
  atluo32.dll    Wed 26 Oct 2005  13.45.38  A....              0    0,00 K
  atlux.dll      Mon 24 Oct 2005  1.41.36  A....              0    0,00 K
  atlwo32.dll    Mon 10 Oct 2005  18.08.10  A....              0    0,00 K
  atlwy.dll      Thu 27 Oct 2005  18.02.52  A....              0    0,00 K
  atlxi32.dll    Thu 13 Oct 2005  13.24.42  A....              0    0,00 K
  cdosys.dll    Sat 10 Sep 2005  3.06.00  A....      2.025.984    1,93 M
  crah32.dll    Tue 11 Oct 2005  9.10.58  A....              0    0,00 K
  crdz32.dll    Sun 30 Oct 2005  17.24.50  A....              0    0,00 K
  crir.dll      Fri  7 Oct 2005  14.45.58  A....              0    0,00 K
  crkz32.dll    Mon 10 Oct 2005  13.19.54  A....              0    0,00 K
  croe32.dll    Thu 27 Oct 2005  11.43.34  A....              0    0,00 K
  crqh32.dll    Tue 18 Oct 2005  15.31.18  A....              0    0,00 K
  crqt32.dll    Sat 15 Oct 2005  1.31.00  A....              0    0,00 K
  crur.dll      Thu 27 Oct 2005  0.29.38  A....              0    0,00 K
  crur32.dll    Tue 11 Oct 2005  20.09.36  A....              0    0,00 K
  crxt32.dll    Mon 31 Oct 2005  21.01.00  A....              0    0,00 K
  cryv32.dll    Thu  6 Oct 2005  16.18.36  A....              0    0,00 K
  d3ap32.dll    Mon 24 Oct 2005  10.47.36  A....              0    0,00 K
  d3fz.dll      Fri  4 Nov 2005  16.42.54  A....              0    0,00 K
  d3jf32.dll    Wed 12 Oct 2005  18.54.32  A....              0    0,00 K
  d3ke32.dll    Thu 27 Oct 2005  21.36.56  A....              0    0,00 K
  d3nu.dll      Fri 21 Oct 2005  16.38.56  A....              0    0,00 K
  d3rs32.dll    Fri 28 Oct 2005  14.40.14  A....              0    0,00 K
  d3sh.dll      Sat  8 Oct 2005  3.01.40  A....              0    0,00 K
  d3to.dll      Wed 26 Oct 2005  4.50.02  A....              0    0,00 K
  d3we32.dll    Tue 18 Oct 2005  13.53.18  A....              0    0,00 K
  d3wx32.dll    Sat 29 Oct 2005  11.28.20  A....              0    0,00 K
  d3xe32.dll    Mon 24 Oct 2005  23.17.14  A....              0    0,00 K
  d3xh.dll      Sun 30 Oct 2005  15.45.36  A....              0    0,00 K
  d3yz32.dll    Wed  5 Oct 2005  22.15.56  A....              0    0,00 K
  d3ze.dll      Thu 20 Oct 2005  22.12.28  A....              0    0,00 K
  d3zr32.dll    Sat 15 Oct 2005  1.42.38  A....              0    0,00 K
  danim.dll      Fri  2 Sep 2005  10.08.16  A....        988.160  965,00 K
  dxtrans.dll    Fri  2 Sep 2005  15.35.16  A....        192.000  187,50 K
  iebf32.dll    Fri 21 Oct 2005  20.06.42  A....              0    0,00 K
  iebl32.dll    Sat 29 Oct 2005  9.52.58  A....              0    0,00 K
  ieej32.dll    Fri 14 Oct 2005  15.44.56  A....              0    0,00 K
  ieek.dll      Sun 30 Oct 2005  6.07.46  A....              0    0,00 K
  ieem.dll      Thu  6 Oct 2005  10.57.14  A....              0    0,00 K
  ieen32.dll    Wed 19 Oct 2005  14.54.40  A....              0    0,00 K
  iefn32.dll    Wed 26 Oct 2005  6.24.32  A....              0    0,00 K
  iejh32.dll    Thu  6 Oct 2005  9.26.14  A....              0    0,00 K
  ielj32.dll    Sun 23 Oct 2005  21.26.54  A....              0    0,00 K
  ieqn.dll      Mon 24 Oct 2005  2.24.12  A....              0    0,00 K
  ierk.dll      Sun 23 Oct 2005  12.15.52  A....              0    0,00 K
  iesf32.dll    Sat 22 Oct 2005  22.16.26  A....              0    0,00 K
  iexr32.dll    Tue 25 Oct 2005  13.21.14  A....              0    0,00 K
  ipbc.dll      Fri 14 Oct 2005  11.01.12  A....              0    0,00 K
  ipbz.dll      Sat 29 Oct 2005  13.59.42  A....              0    0,00 K
  ipci.dll      Fri  4 Nov 2005  14.38.50  A....              0    0,00 K
  ipee.dll      Thu 20 Oct 2005  17.38.28  A....              0    0,00 K
  ipfe32.dll    Sun  9 Oct 2005  18.22.56  A....              0    0,00 K
  ipgc32.dll    Wed 26 Oct 2005  7.13.08  A....              0    0,00 K
  iplz.dll      Mon 31 Oct 2005  11.04.08  A....              0    0,00 K
  ipmz32.dll    Thu 20 Oct 2005  11.48.36  A....              0    0,00 K
  ipov32.dll    Fri 28 Oct 2005  12.04.46  A....              0    0,00 K
  ipoz.dll      Sun 16 Oct 2005  10.43.50  A....              0    0,00 K
  ippi32.dll    Thu  3 Nov 2005  2.17.52  A....              0    0,00 K
  ipqz32.dll    Tue 11 Oct 2005  20.52.14  A....              0    0,00 K
  ipri32.dll    Mon 24 Oct 2005  0.25.02  A....              0    0,00 K
  ipsa32.dll    Sun 23 Oct 2005  14.42.04  A....              0    0,00 K
  ipun32.dll    Fri 21 Oct 2005  4.51.52  A....              0    0,00 K
  ipvc.dll      Fri 28 Oct 2005  11.13.26  A....              0    0,00 K
  javacr32.dll  Thu 27 Oct 2005  7.32.56  A....              0    0,00 K
  javadg.dll    Sun  9 Oct 2005  19.00.22  A....              0    0,00 K
  javadh32.dll  Wed  5 Oct 2005  12.15.26  A....              0    0,00 K
  javafw.dll    Tue 25 Oct 2005  23.41.46  A....              0    0,00 K
  javail32.dll  Sat 15 Oct 2005  18.08.30  A....              0    0,00 K
  javaji.dll    Sat 15 Oct 2005  4.00.08  A....              0    0,00 K
  javaks.dll    Sun 23 Oct 2005  0.30.04  A....              0    0,00 K
  javaku.dll    Sun 16 Oct 2005  5.48.16  A....              0    0,00 K
  javams32.dll  Thu  3 Nov 2005  12.14.02  A....              0    0,00 K
  javamt.dll    Sat 29 Oct 2005  7.07.18  A....              0    0,00 K
  javapt32.dll  Mon 24 Oct 2005  17.15.44  A....              0    0,00 K
  javaqa32.dll  Sat 15 Oct 2005  22.28.36  A....              0    0,00 K
  javarg32.dll  Mon 17 Oct 2005  16.38.08  A....              0    0,00 K
  javarn.dll    Wed  2 Nov 2005  17.55.44  A....              0    0,00 K
  javawg32.dll  Sun 30 Oct 2005  19.54.00  A....              0    0,00 K
  javawt32.dll  Tue 25 Oct 2005  11.37.02  A....              0    0,00 K
  javayd32.dll  Fri  7 Oct 2005  20.08.48  A....              0    0,00 K
  linkinfo.dll  Thu  1 Sep 2005  2.50.40  A....        16.384    16,00 K
  mfccv32.dll    Thu 20 Oct 2005  8.58.00  A....              0    0,00 K
  mfcdw32.dll    Mon 10 Oct 2005  7.05.10  A....              0    0,00 K
  mfcgs.dll      Mon 24 Oct 2005  5.52.14  A....              0    0,00 K
  mfcho32.dll    Mon 10 Oct 2005  2.46.18  A....              0    0,00 K
  mfclv.dll      Thu  6 Oct 2005  11.15.00  A....              0    0,00 K
  mfcro.dll      Fri  4 Nov 2005  21.31.12  A....              0    0,00 K
  mfcwq.dll      Fri  7 Oct 2005  18.27.12  A....              0    0,00 K
  mfcxb32.dll    Tue 25 Oct 2005  22.31.58  A....              0    0,00 K
  mfczr.dll      Thu 27 Oct 2005  19.11.24  A....              0    0,00 K
  msax.dll      Sun 30 Oct 2005  21.14.16  A....              0    0,00 K
  msfj.dll      Fri  4 Nov 2005  8.09.50  A....              0    0,00 K
  mshtml.dll    Tue  4 Oct 2005  11.33.32  A....      2.700.288    2,57 M
  mshu32.dll    Mon 17 Oct 2005  0.19.26  A....              0    0,00 K
  mskm32.dll    Tue 11 Oct 2005  3.23.54  A....              0    0,00 K
  mskp.dll      Tue  1 Nov 2005  18.25.52  A....              0    0,00 K
  msmp.dll      Sun 16 Oct 2005  22.48.26  A....              0    0,00 K
  msra32.dll    Tue 11 Oct 2005  20.27.10  A....              0    0,00 K
  mssl.dll      Wed  2 Nov 2005  11.29.10  A....              0    0,00 K
  mstask.dll    Tue 30 Aug 2005  20.03.34  A....        261.120  255,00 K
  mstb32.dll    Sat 15 Oct 2005  12.41.18  A....              0    0,00 K
  mstime.dll    Fri  2 Sep 2005  16.31.12  A....        496.128  484,50 K
  msym.dll      Sat 22 Oct 2005  13.06.10  A....              0    0,00 K
  netapi32.dll  Tue 30 Aug 2005  20.03.34  A....        306.688  299,50 K
  netbu.dll      Sat 22 Oct 2005  4.24.32  A....              0    0,00 K
  netcr.dll      Fri  4 Nov 2005  8.57.12  A....              0    0,00 K
  netep32.dll    Tue  1 Nov 2005  12.26.28  A....              0    0,00 K
  nethd.dll      Sun  9 Oct 2005  3.05.28  A....              0    0,00 K
  netjv.dll      Tue 18 Oct 2005  14.58.12  A....              0    0,00 K
  netkv32.dll    Sun  9 Oct 2005  20.02.10  A....              0    0,00 K
  netman.dll    Mon 22 Aug 2005  19.37.14  A....        154.624  151,00 K
  netmw.dll      Wed 19 Oct 2005  13.11.30  A....              0    0,00 K
  netpr.dll      Mon 24 Oct 2005  22.51.10  A....              0    0,00 K
  netwp32.dll    Tue 11 Oct 2005  9.53.34  A....              0    0,00 K
  netzt.dll      Mon 31 Oct 2005  23.22.50  A....              0    0,00 K
  ntaa.dll      Thu 20 Oct 2005  4.54.44  A....              0    0,00 K
  ntea.dll      Fri  7 Oct 2005  13.25.42  A....              0    0,00 K
  ntey32.dll    Tue  1 Nov 2005  3.53.22  A....              0    0,00 K
  ntfx32.dll    Fri 21 Oct 2005  13.22.38  A....              0    0,00 K
  nthp.dll      Fri 28 Oct 2005  15.24.04  A....              0    0,00 K
  ntis32.dll    Mon 10 Oct 2005  21.19.34  A....              0    0,00 K
  ntkr.dll      Thu  3 Nov 2005  22.01.20  A....              0    0,00 K
  ntmi.dll      Sun  9 Oct 2005  18.48.42  A....              0    0,00 K
  ntos32.dll    Fri 21 Oct 2005  7.32.46  A....              0    0,00 K
  ntsc.dll      Tue 25 Oct 2005  10.16.46  A....              0    0,00 K
  ntsf.dll      Tue 18 Oct 2005  14.53.52  A....              0    0,00 K
  ntua32.dll    Thu 13 Oct 2005  2.12.26  A....              0    0,00 K
  ntud32.dll    Thu  6 Oct 2005  14.58.20  A....              0    0,00 K
  ntuu32.dll    Mon 31 Oct 2005  22.03.30  A....              0    0,00 K
  ntvn.dll      Wed  2 Nov 2005  8.02.22  A....              0    0,00 K
  ntys.dll      Tue  1 Nov 2005  19.16.44  A....              0    0,00 K
  ntza32.dll    Sat 29 Oct 2005  8.19.32  A....              0    0,00 K
  ntzf32.dll    Thu 20 Oct 2005  18.54.10  A....              0    0,00 K
  quartz.dll    Tue 30 Aug 2005  5.03.58  A....      1.162.752    1,11 M
  schedsvc.dll  Tue 30 Aug 2005  20.03.34  A....        172.544  168,50 K
  sdkef.dll      Mon 24 Oct 2005  21.42.44  A....              0    0,00 K
  sdkgg.dll      Sat 15 Oct 2005  2.44.26  A....              0    0,00 K
  sdkgs32.dll    Thu 13 Oct 2005  6.29.26  A....              0    0,00 K
  sdkjl32.dll    Sat 29 Oct 2005  19.39.30  A....              0    0,00 K
  sdkki32.dll    Mon 10 Oct 2005  10.06.10  A....              0    0,00 K
  sdkky.dll      Fri 28 Oct 2005  17.13.44  A....              0    0,00 K
  sdkll.dll      Wed 26 Oct 2005  7.30.42  A....              0    0,00 K
  sdknl.dll      Sat 29 Oct 2005  23.44.48  A....              0    0,00 K
  sdkom32.dll    Fri  4 Nov 2005  2.04.48  A....              0    0,00 K
  sdkse32.dll    Tue 11 Oct 2005  3.09.26  A....              0    0,00 K
  sdksv32.dll    Sat 22 Oct 2005  13.05.42  A....              0    0,00 K
  sdktq.dll      Mon 31 Oct 2005  10.51.34  A....              0    0,00 K
  sdkuf.dll      Sun 23 Oct 2005  0.38.18  A....              0    0,00 K
  shell32.dll    Fri 23 Sep 2005  4.28.48  A....      8.360.448    7,97 M
  shlwapi.dll    Wed 31 Aug 2005  17.50.40  A....        409.088  399,50 K
  sirenacm.dll  Mon 19 Sep 2005  6.00.34  A....        119.856  117,05 K
  sysbm.dll      Thu 27 Oct 2005  13.15.30  A....              0    0,00 K
  sysde32.dll    Sun  9 Oct 2005  21.47.16  A....              0    0,00 K
  sysen.dll      Wed  2 Nov 2005  19.52.44  A....              0    0,00 K
  sysfq.dll      Tue 18 Oct 2005  1.36.50  A....              0    0,00 K
  sysfq32.dll    Tue  1 Nov 2005  17.06.30  A....              0    0,00 K
  sysis32.dll    Sat 22 Oct 2005  22.08.12  A....              0    0,00 K
  syskm.dll      Tue 18 Oct 2005  13.04.22  A....              0    0,00 K
  syskz.dll      Thu 20 Oct 2005  15.20.06  A....              0    0,00 K
  sysnz32.dll    Wed  2 Nov 2005  20.42.10  A....              0    0,00 K
  sysow32.dll    Sun  9 Oct 2005  3.18.52  A....              0    0,00 K
  sysrx32.dll    Wed 19 Oct 2005  11.02.52  A....              0    0,00 K
  systg32.dll    Sun  9 Oct 2005  16.38.30  A....              0    0,00 K
  sysxu.dll      Mon 17 Oct 2005  8.33.32  A....              0    0,00 K
  sysyv.dll      Sun 23 Oct 2005  9.46.42  A....              0    0,00 K
  umpnpmgr.dll  Tue 23 Aug 2005  4.52.22  A....        112.128  109,50 K
  urlmon.dll    Fri  2 Sep 2005  16.31.14  A....        458.240  447,50 K
  winbq.dll      Tue 18 Oct 2005  11.30.12  A....              0    0,00 K
  windr32.dll    Wed 19 Oct 2005  15.47.26  A....              0    0,00 K
  winei32.dll    Sat  5 Nov 2005  4.03.42  A....              0    0,00 K
  winep32.dll    Wed 19 Oct 2005  1.39.06  A....              0    0,00 K
  winmk32.dll    Tue 18 Oct 2005  19.49.12  A....              0    0,00 K
  winol32.dll    Tue 18 Oct 2005  6.32.52  A....              0    0,00 K
  winri32.dll    Tue 25 Oct 2005  17.50.30  A....              0    0,00 K
  winsq.dll      Fri  7 Oct 2005  2.40.28  A....              0    0,00 K
  winsrv.dll    Thu  1 Sep 2005  2.50.40  A....        278.016  271,50 K
  wintk32.dll    Sat 15 Oct 2005  22.52.12  A....              0    0,00 K
  winuk.dll      Sun 30 Oct 2005  14.21.52  A....              0    0,00 K
  winvi32.dll    Mon 17 Oct 2005  7.22.26  A....              0    0,00 K
  winvt.dll      Mon 17 Oct 2005  3.09.28  A....              0    0,00 K
  winyd.dll      Fri 21 Oct 2005  7.03.20  A....              0    0,00 K
  winzy.dll      Thu  3 Nov 2005  1.33.08  A....              0    0,00 K
  xpsp2res.dll  Tue 27 Sep 2005  1.41.12  A....        598.016  584,00 K

231 items found:  231 files, 0 directories.
  Total of file sizes:  18.812.464 bytes    17,94 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
  hp98b5.tmp    Sat  5 Nov 2005  18.30.08  A....        16.384    16,00 K

1 item found:  1 file, 0 directories.
  Total of file sizes:  16.384 bytes    16,00 K
**********************************************************************************
Directory Listing of system files:
Disken i drev C har ikke noget navn.
Diskens serienummer er A4E7-C227

Indhold af C:\WINDOWS\System32

20-10-2005  16:13    <DIR>          dllcache
25-08-2005  17:04    <DIR>          Microsoft
              0 fil(er)                0 byte
              2 mappe(r)  69.172.023.296 byte ledig
------------------------------------------------------------------------------------

  smitRem log file
    version 2.6

    by noahdfear


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

msvol.tlb
ncompat.tlb
nvctrl.exe
mscornet.exe


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



  Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

msvol.tlb
ncompat.tlb
nvctrl.exe
mscornet.exe


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

wininet.dll is missing!!

Hent Wininet.zip her:
http://www.dll-files.com/dllindex/dll-files.shtml?wininet
Pak den ud i C:\windows\system32, det skal du gøre som det første.

Luk alle programmer - du vil om lidt blive bedt om at genstarte din computer.

Fra mappen l2mfix skal du køre l2mfix.bat igen - denne gang skal du vælge option 2 (Run Fix). Herefter skal du taste en tilfældig tast for at genstarte. Efter genstart vil dit Skrivebord og din ikoner vise sig og forsvinde igen - l2mfix vil fortsætte med at scanne din computer og når programmet er færdigt, vil en ny tekstfil blive åbnet i Notesblok. Kopier indholdet herind sammen med en frisk HijackThis log.
Kommer der ikke en ny logtekst, så gør følgende:
Åbn mappen med l2mfix, find filen second.bat, og dobbeltklik på den. Så skulle fixet helt sikkert gå i gang.

Jeg får ikke lov at kopiere wininet.dll da den er lukket af en anden proces.

Prøv i fejlsikret, det jeg ikke kan lide er at Smitrem skriver "Missing".
Ellers fortsæt med vejledningen.

Det hjalp ikke i fejlsikret, filen er stadig låst af en anden person/process.

Logfile of HijackThis v1.99.1
Scan saved at 18:15:51, on 06-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
E:\AntiVirus\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp98B5.tmp (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &MSN Search - res://C:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/229?6904b29e9aff4f97ad362e683784cf45
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/230?6904b29e9aff4f97ad362e683784cf45
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125413910828
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

-------------------------------------------------------------------------------------
Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1460 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1504 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Zipping up files for submission:
  adding: clear.reg (188 bytes security) (deflated 2%)
  adding: lo2.txt (188 bytes security) (deflated 49%)
  adding: smitfiles.txt (188 bytes security) (deflated 70%)
  adding: test.txt (188 bytes security) (stored 0%)
  adding: test2.txt (188 bytes security) (stored 0%)
  adding: test3.txt (188 bytes security) (stored 0%)
  adding: test5.txt (188 bytes security) (stored 0%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators  ... failed (GetAccountSid(Administrators)=1332

Restoring Windows Update Certificates.:


The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok. 
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

Kør Hijackthis igen og fix:
O2 - BHO: (no name) - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hp98B5.tmp (file missing)

Så er din log ren.
Du bør lige deaktivere systemgendannelse, genstarte og genaktivere samt sætte filvisning til normal.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.
Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis ikke skjulte filer og mapper".

For at holde den ren kan du kigge på vores pakke til formålet.
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://fromsej.dk/html/avoid.html
Mvh:
Fromsej/Team Spywarefri.

Tak for point.*S*