tjek af diverse logfiler

Sidder hos en kammerat der har lidt probs med sin pc og kan ikke logge ind diverse sites..
maskinen opfører sig mystisk
Har lige gennemført Fromsejs artikel ang. scan af pc..
er der en venlig sjæl der gider kigge alle logs igennem

SAS:

SUPERAntiSpyware Scan Log
Generated 10/21/2006 at 05:19 PM

Core Rules Database Version : 3089
Trace Rules Database Version: 1118

Memory threats detected  : 0
Registry threats detected : 0
File threats detected    : 36

Adware.Tracking Cookie
    C:\Documents and Settings\Net\Cookies\net@cgi-bin[3].txt
    C:\Documents and Settings\Net\Cookies\net@sextracker[1].txt
    C:\Documents and Settings\Net\Cookies\net@advertising[1].txt
    C:\Documents and Settings\Net\Cookies\net@tradedoubler[1].txt
    C:\Documents and Settings\Net\Cookies\net@ad1.emediate[2].txt
    C:\Documents and Settings\Net\Cookies\net@winantivirus[1].txt
    C:\Documents and Settings\Net\Cookies\net@stats1.reliablestats[1].txt
    C:\Documents and Settings\Net\Cookies\net@counter6.sextracker[1].txt
    C:\Documents and Settings\Net\Cookies\net@mediaplex[1].txt
    C:\Documents and Settings\Net\Cookies\net@statse.webtrendslive[1].txt
    C:\Documents and Settings\Net\Cookies\net@track.adform[1].txt
    C:\Documents and Settings\Net\Cookies\net@dyre-sex[2].txt
    C:\Documents and Settings\Net\Cookies\net@mb[1].txt
    C:\Documents and Settings\Net\Cookies\net@image.masterstats[1].txt
    C:\Documents and Settings\Net\Cookies\net@clicksor[1].txt
    C:\Documents and Settings\Net\Cookies\net@revsci[2].txt
    C:\Documents and Settings\Net\Cookies\net@sexfriends[1].txt
    C:\Documents and Settings\Net\Cookies\net@2o7[1].txt
    C:\Documents and Settings\Net\Cookies\net@atdmt[2].txt
    C:\Documents and Settings\Net\Cookies\net@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Net\Cookies\net@z1.adserver[1].txt
    C:\Documents and Settings\Net\Cookies\net@sexdebut[1].txt
    C:\Documents and Settings\Net\Cookies\net@questionmarket[2].txt
    C:\Documents and Settings\Net\Cookies\net@cgi-bin[1].txt
    C:\Documents and Settings\Net\Cookies\net@adtech[2].txt
    C:\Documents and Settings\Net\Cookies\net@sexnoveller[2].txt
    C:\Documents and Settings\Net\Cookies\net@www.winantivirus[1].txt
    C:\Documents and Settings\Net\Cookies\net@scanner[1].txt
    C:\Documents and Settings\Net\Cookies\net@www.sexdebut[1].txt
    C:\Documents and Settings\Net\Cookies\net@cz3.clickzs[2].txt
    C:\Documents and Settings\Net\Cookies\net@ad.yieldmanager[2].txt
    C:\Documents and Settings\Net\Cookies\net@zedo[2].txt
    C:\Documents and Settings\Net\Cookies\net@doubleclick[1].txt
    C:\Documents and Settings\Net\Cookies\net@paycounter[1].txt
    C:\Documents and Settings\Net\Cookies\net@partners.webmasterplan[2].txt
    C:\Documents and Settings\Net\Cookies\net@adbrite[2].txt


Ewido :

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            17:35:39, 21-10-2006
+ Rapport-Checksum:        C460D881

+ Scanningsresultat:
    C:\Documents and Settings\Net\Cookies\net@chicagotribune.com[1].txt -> TrackingCookie.Com : Renset med backup
    C:\Documents and Settings\Net\Cookies\net@com[1].txt -> TrackingCookie.Com : Renset med backup
    C:\Programmer\DAEMON Tools\SetupDTSB.#xe -> Adware.SaveNow : Renset med backup


::Rapport slut

Dr.Web cure :

ProduKey.exe    C:\Documents and Settings\Net\Dokumenter\My Received Files\Microsoft Key 2006(Primus)    Tool.PassView    Renamed.
SetupDTSB.exe    C:\Programmer\DAEMON Tools    Adware.SaveNow    Renamed.
ZaiIRC.exe    C:\Programmer\ZaiIRC    Program.mIRC.603    Renamed.
moo.dll    C:\Programmer\ZaiIRC\sys\dlls    Program.MotherboardMonitor    Renamed.
ZaiIRC.exe    C:\RECYCLER\S-1-5-21-789336058-1390067357-839522115-1003\Dc547\ZaiIRC    Program.mIRC.603    Renamed.
moo.dll    C:\RECYCLER\S-1-5-21-789336058-1390067357-839522115-1003\Dc547\ZaiIRC\sys\dlls    Program.MotherboardMonitor    Renamed.
A0021485.exe    C:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP144    Adware.SaveNow    Renamed.
A0021486.exe    C:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP144    Program.mIRC.603    Renamed.
A0021487.dll    C:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP144    Program.MotherboardMonitor    Renamed.
A0021488.exe    C:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP144    Program.mIRC.603    Renamed.
A0021489.dll    C:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP144    Program.MotherboardMonitor    Renamed.
A0016901.dll    F:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP113    Tool.Moo    Renamed.
A0017001.dll    F:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP113    IRC.Flood    Deleted.
A0017009.DLL    F:\System Volume Information\_restore{F6F49765-080C-4AAE-AB98-E4AED75F3CB1}\RP113    Tool.Moo    Renamed.


Hijack :

Logfile of HijackThis v1.99.1
Scan saved at 17:41:58, on 21-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\programmer\pstrip.exe
C:\Programmer\DAEMON Tools\daemon.exe
F:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\steam\Steam.exe
F:\programmer\Phone\Skype.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wscntfy.exe
F:\programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
C:\Programmer\Logitech\SetPoint\SetPoint.exe
C:\Programmer\Fælles filer\Logitech\KHAL\KHALMNPR.EXE
C:\Programmer\SEC\Natural Color\NaturalColorLoad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Net\Skrivebord\hijack\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PowerStrip] f:\programmer\pstrip.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RemoteControl] F:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Programmer\steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "F:\programmer\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Programmer\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = F:\programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Programmer\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Highlight Zone II.lnk = C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
O4 - Global Startup: Logitech Harmony Remote V5.lnk = C:\Programmer\Logitech\Harmony Remote\HarmonyClient.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmer\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Programmer\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?86b790e0dce14d50ad70c247d72048a0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Programmer\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?86b790e0dce14d50ad70c247d72048a0
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

en meget lang post men på forhånd tak Bouggi