dos vindue kommer lige op og blinker

Prøv at se med msconfig fra 'kør' hvad der starter sammen med maskinen. Eller læg en HiJackThis-log her.

http://www.spywarefri.dk/manualer/hijackthis-manual.htm

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:39:11, on 18-04-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmer\Fælles filer\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programmer\Faronics\Deep Freeze Enterprise Server\DF5ServerService.exe
C:\Programmer\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Programmer\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\Programmer\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\Dude\dude.exe
C:\Programmer\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\UAService7.exe
C:\Programmer\Pure Networks\Network Magic\nmsrvc.exe
C:\Programmer\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\HK35E7.EXE
C:\WINDOWS\Explorer.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmer\IBM\Messages By IBM\ibmmessages.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Programmer\Java\jre1.5.0_11\bin\jusched.exe
C:\Programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Programmer\BookPC\BookPCTrayAdmin.exe
C:\Programmer\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\PowerISO\PWRISOVM.EXE
C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\semwltray.exe
C:\Programmer\Google\Gmail Notifier\gnotify.exe
C:\MaxUser\FuncLimi.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Programmer\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe
C:\Programmer\Pando Networks\Pando\Pando.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Programmer\OpenOffice.org 2.0\program\soffice.exe
C:\Programmer\OpenOffice.org 2.0\program\soffice.BIN
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jesper mortensen\Skrivebord\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Programmer\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Programmer\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Programmer\IBM fingerprint software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmer\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Programmer\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programmer\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QCWLIcon] C:\Programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [BookPCTrayAdmin] C:\Programmer\BookPC\BookPCTrayAdmin.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmer\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [StartFoxie] C:\Programmer\Foxie Suite\StartFoxie.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programmer\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [EQOClient] C:\Programmer\EQO\EQO.exe
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [Sony Ericsson Wireless Manager UI] C:\WINDOWS\system32\semwltray
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [FuncLimi] C:\MaxUser\FuncLimi.exe
O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [nmapp] "C:\Programmer\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [bits help boob setup] C:\Documents and Settings\All Users\Application Data\OKAYAMENBITSHELP\Surf Online.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Programmer\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Creative Detector] C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Pando] "C:\Programmer\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKCU\..\Run: [Uploadgrim] C:\DOCUME~1\JESPER~1\APPLIC~1\AIMHTM~1\Send Dumb Type.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programmer\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth - C:\Programmer\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Programmer\CDPoker\casino.exe
O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Programmer\CDPoker\casino.exe
O9 - Extra button: Opdatér ThinkPad-programmer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Programmer\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programmer\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Deep Freeze Server Service (DF5Server) - Faronics Corporation - C:\Programmer\Faronics\Deep Freeze Enterprise Server\DF5ServerService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Programmer\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Programmer\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MService - Unknown owner - C:\MaxUser\MaxClient.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Programmer\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Programmer\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmer\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: The Dude Server - Unknown owner - C:\Programmer\Dude\dude.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Programmer\Fælles filer\Virtual Token\vtserver.exe

--
End of file - 13877 bytes

Mener synes ikke jeg kan se noget galt,,,

Hvad siger du så til bla. disse "programmer" ->
..\OKAYAMENBITSHELP\Surf Online.exe
[Uploadgrim] C:\DOCUME~1\JESPER~1\APPLIC~1\AIMHTM~1\Send Dumb Type.exe

Hent NoLop exe til skrivebordet:
http://www.spywareedge.net/nolop/NoLop.exe
http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item16

Kør den, tryk på - Search and Destroy - knappen. Så vil den scanne efter lop infektioner, og planlagte lop job´s. Hvis den finder noget, bliver du bedt om at trykke på Reboot-knappen, det gør du.

Efter genstart ligger der en en fil: C:\NoLop.txt

Kopier indholdet af den herind sammen med en frisk HiJackThis log...

--------------------------------------------

PS: Har du helt styr på alle de programmer/services som du starter/loader i starten ?
Typisk IBM/Thinkpad ...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:19:32, on 19-04-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmer\Fælles filer\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programmer\Faronics\Deep Freeze Enterprise Server\DF5ServerService.exe
C:\Programmer\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Programmer\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\Programmer\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\Dude\dude.exe
C:\Programmer\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\UAService7.exe
C:\Programmer\Pure Networks\Network Magic\nmsrvc.exe
C:\Programmer\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\HO8683.EXE
C:\WINDOWS\Explorer.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmer\IBM\Messages By IBM\ibmmessages.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Programmer\Java\jre1.5.0_11\bin\jusched.exe
C:\Programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Programmer\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\PowerISO\PWRISOVM.EXE
C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\Programmer\Trend Micro\OfficeScan Client\pccntupd.exe
C:\WINDOWS\system32\semwltray.exe
C:\Programmer\Google\Gmail Notifier\gnotify.exe
C:\MaxUser\FuncLimi.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Programmer\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Programmer\OpenOffice.org 2.0\program\soffice.exe
C:\Programmer\OpenOffice.org 2.0\program\soffice.BIN
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\Pando Networks\Pando\pando.exe
C:\Documents and Settings\Jesper mortensen\Skrivebord\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Programmer\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Programmer\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Programmer\IBM fingerprint software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmer\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Programmer\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programmer\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QCWLIcon] C:\Programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmer\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programmer\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [Sony Ericsson Wireless Manager UI] C:\WINDOWS\system32\semwltray
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [FuncLimi] C:\MaxUser\FuncLimi.exe
O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [nmapp] "C:\Programmer\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [EQOClient] C:\Programmer\EQO\EQO.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Programmer\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uploadgrim] C:\DOCUME~1\JESPER~1\APPLIC~1\AIMHTM~1\Send Dumb Type.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programmer\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth - C:\Programmer\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Opdatér ThinkPad-programmer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Programmer\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programmer\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Deep Freeze Server Service (DF5Server) - Faronics Corporation - C:\Programmer\Faronics\Deep Freeze Enterprise Server\DF5ServerService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Programmer\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Programmer\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MService - Unknown owner - C:\MaxUser\MaxClient.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Programmer\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Programmer\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmer\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: The Dude Server - Unknown owner - C:\Programmer\Dude\dude.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programmer\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Programmer\Fælles filer\Virtual Token\vtserver.exe

--
End of file - 13015 bytes

de to filer er der stadig, men dem kan man vel bare slette.

(Vil gerne have set Loggen fra denne C:\NoLop.txt )

Resten tager jeg manuelt -

NoLop! Log by Skate_Punk_21

Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

Fix running from: C:\Documents and Settings\Jesper mortensen\Skrivebord
[19-04-2007]
[11:36:36]

---Infection Files Found/Removed---
NO INFECTION FILES FOUND - Cleaning Aborted.

---Listing AppData sub directories---

C:\Documents and Settings\Administrator\Application Data\Ibm
C:\Documents and Settings\Administrator\Application Data\Identities
C:\Documents and Settings\Administrator\Application Data\Microsoft
C:\Documents and Settings\Administrator\Application Data\Mozilla
C:\Documents and Settings\Administrator\Application Data\Real
C:\Documents and Settings\Administrator\Application Data\Sonic
C:\Documents and Settings\Administrator\Application Data\Sony Ericsson
C:\Documents and Settings\Administrator\Application Data\Symantec  -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Adobe Systems
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Autodesk
C:\Documents and Settings\All Users\Application Data\Creative
C:\Documents and Settings\All Users\Application Data\Earmaster
C:\Documents and Settings\All Users\Application Data\Google
C:\Documents and Settings\All Users\Application Data\Ibm
C:\Documents and Settings\All Users\Application Data\Intel
C:\Documents and Settings\All Users\Application Data\Locktime
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Okayamenbitshelp
C:\Documents and Settings\All Users\Application Data\Pure Networks
C:\Documents and Settings\All Users\Application Data\Skype  -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Vmware
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\Default User\Application Data\Ibm
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User\Application Data\Sonic
C:\Documents and Settings\Default User\Application Data\Symantec  -- EMPTY Directory
C:\Documents and Settings\Jesper Mortensen\Application Data\.bittorrent
C:\Documents and Settings\Jesper Mortensen\Application Data\Adobe
C:\Documents and Settings\Jesper Mortensen\Application Data\Adobeum
C:\Documents and Settings\Jesper Mortensen\Application Data\Ahead
C:\Documents and Settings\Jesper Mortensen\Application Data\Aim Htm Eggs
C:\Documents and Settings\Jesper Mortensen\Application Data\Apple Computer
C:\Documents and Settings\Jesper Mortensen\Application Data\Azureus
C:\Documents and Settings\Jesper Mortensen\Application Data\Bitdownload
C:\Documents and Settings\Jesper Mortensen\Application Data\Buena Vista Games Demos
C:\Documents and Settings\Jesper Mortensen\Application Data\Creative
C:\Documents and Settings\Jesper Mortensen\Application Data\Cryptomathic
C:\Documents and Settings\Jesper Mortensen\Application Data\Divx
C:\Documents and Settings\Jesper Mortensen\Application Data\Dvdcss
C:\Documents and Settings\Jesper Mortensen\Application Data\Earmaster  -- EMPTY Directory
C:\Documents and Settings\Jesper Mortensen\Application Data\Ethereal
C:\Documents and Settings\Jesper Mortensen\Application Data\Google
C:\Documents and Settings\Jesper Mortensen\Application Data\Help  -- EMPTY Directory
C:\Documents and Settings\Jesper Mortensen\Application Data\Ibm
C:\Documents and Settings\Jesper Mortensen\Application Data\Icaclient
C:\Documents and Settings\Jesper Mortensen\Application Data\Identities
C:\Documents and Settings\Jesper Mortensen\Application Data\Intel
C:\Documents and Settings\Jesper Mortensen\Application Data\Intervideo
C:\Documents and Settings\Jesper Mortensen\Application Data\Locktime
C:\Documents and Settings\Jesper Mortensen\Application Data\Macromedia
C:\Documents and Settings\Jesper Mortensen\Application Data\Media Player Classic
C:\Documents and Settings\Jesper Mortensen\Application Data\Microsoft
C:\Documents and Settings\Jesper Mortensen\Application Data\Mozilla
C:\Documents and Settings\Jesper Mortensen\Application Data\Nero
C:\Documents and Settings\Jesper Mortensen\Application Data\Openoffice.org2
C:\Documents and Settings\Jesper Mortensen\Application Data\Real
C:\Documents and Settings\Jesper Mortensen\Application Data\Secondlife
C:\Documents and Settings\Jesper Mortensen\Application Data\Skype
C:\Documents and Settings\Jesper Mortensen\Application Data\Sonic
C:\Documents and Settings\Jesper Mortensen\Application Data\Sony Ericsson
C:\Documents and Settings\Jesper Mortensen\Application Data\Sun
C:\Documents and Settings\Jesper Mortensen\Application Data\Symantec
C:\Documents and Settings\Jesper Mortensen\Application Data\Systemtools
C:\Documents and Settings\Jesper Mortensen\Application Data\Thunderbird
C:\Documents and Settings\Jesper Mortensen\Application Data\Ufasoft
C:\Documents and Settings\Jesper Mortensen\Application Data\Utorrent
C:\Documents and Settings\Jesper Mortensen\Application Data\Vmware
C:\Documents and Settings\Localservice\Application Data\Identities
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Vmware  -- EMPTY Directory
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Symantec

(og resten?)

sådan se den ud, også den gamle,,hmm synes også den slutter lidt brat.
har lige kørt den igen,,,den bliver ikke længer.

... Hmmm...

Prøv dette istedet ->

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

-- Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

-------------------------------------

PS: Har du helt styr på alle de programmer/services som du starter/loader i starten ?
Typisk IBM/Thinkpad ...

Deep Freeze ???
Norton Ghost 2003 ???
The Dude Server ???
MaxUser\MaxClient.exe ???

"Jesper mortensen" - 07-04-20 13:22:48    Service Pack 2 
ComboFix 07-04-19.2V - Running from: C:\Programmer\Mozilla Firefox\


(((((((((((((((((((((((((((((((  Files Created from 2007-03-20 to 2007-04-20  ))))))))))))))))))))))))))))))))))


2007-04-19 10:16    318    --a------    C:\delete.bat
2007-04-19 10:07    <DIR>    d--------    C:\NoLopBackups
2007-04-18 14:54    76,560    --a------    C:\WINDOWS\system32\drivers\tmcomm.sys
2007-04-18 14:50    <DIR>    d--------    C:\DOCUME~1\JESPER~1\.housecall6.6
2007-04-16 09:55    44,544    --a------    C:\WINDOWS\system32\msxml4a.dll
2007-04-01 01:21    <DIR>    d--hs----    C:\found.000
2007-03-20 11:51    <DIR>    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\SecondLife


((((((((((((((((((((((((((((((((((((((((((((((((  Find3M Report  )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-20 13:21    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\skype
2007-04-20 13:19    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\openoffice.org2
2007-04-19 10:29    --------    d--------    C:\Programmer\pc-doctor for windows
2007-04-19 09:50    --------    d--------    C:\Programmer\mozilla thunderbird
2007-04-19 09:49    --------    d--------    C:\Programmer\google
2007-04-16 20:54    --------    d--------    C:\Programmer\emule
2007-03-26 18:12    70206    --a------    C:\WINDOWS\system32\perfc006.dat
2007-03-26 18:12    413144    --a------    C:\WINDOWS\system32\perfh006.dat
2007-03-17 15:46    292864    --a------    C:\WINDOWS\system32\winsrv.dll
2007-03-15 21:03    --------    d--------    C:\Programmer\tdc
2007-03-15 21:03    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\cryptomathic
2007-03-15 21:02    --------    d--------    C:\Programmer\F‘lles filer\wise installation wizard
2007-03-11 12:24    --------    d--------    C:\Programmer\youtube downloader
2007-03-09 11:34    --------    d--h-----    C:\Programmer\installshield installation information
2007-03-09 11:23    --------    d--------    C:\Programmer\guitar speed trainer
2007-03-09 11:21    --------    d--------    C:\Programmer\bitdownload
2007-03-08 20:43    --------    d--------    C:\Programmer\java
2007-03-08 17:51    578048    --a------    C:\WINDOWS\system32\user32.dll
2007-03-08 17:51    40960    --a------    C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:51    282112    --a------    C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:47    1843968    --a------    C:\WINDOWS\system32\win32k.sys
2007-02-28 09:45    7110    --a------    C:\WINDOWS\mozver.dat
2007-02-28 09:45    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\thunderbird
2007-02-27 16:14    --------    d--------    C:\Programmer\divx
2007-02-27 08:15    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\google
2007-02-26 09:27    --------    d--------    C:\Programmer\msn messenger
2007-02-22 21:41    --------    d--------    C:\Programmer\dc++
2007-02-22 20:05    --------    d--------    C:\DOCUME~1\JESPER~1\APPLIC~1\bitdownload
2007-02-05 22:19    185344    --a------    C:\WINDOWS\system32\upnphost.dll
2007-02-01 06:56    823296    --a------    C:\WINDOWS\system32\divx_xx0c.dll
2007-02-01 06:56    823296    --a------    C:\WINDOWS\system32\divx_xx07.dll
2007-02-01 06:56    802816    --a------    C:\WINDOWS\system32\divx_xx11.dll
2007-02-01 06:56    639066    --a------    C:\WINDOWS\system32\divx.dll
2007-01-31 23:27    524288    --a------    C:\WINDOWS\system32\divxsm.exe
2007-01-31 01:15    118784    --a------    C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-01-30 07:03    3596288    --a------    C:\WINDOWS\system32\qt-dx331.dll
2007-01-30 07:03    200704    --a------    C:\WINDOWS\system32\ssldivx.dll
2007-01-30 07:03    1044480    --a------    C:\WINDOWS\system32\libdivx.dll
2007-01-30 06:56    73728    --a------    C:\WINDOWS\system32\dpl100.dll
2007-01-30 06:56    593920    --a------    C:\WINDOWS\system32\dpugui11.dll
2007-01-30 06:56    57344    --a------    C:\WINDOWS\system32\dpv11.dll
2007-01-30 06:56    53248    --a------    C:\WINDOWS\system32\dpugui10.dll
2007-01-30 06:56    344064    --a------    C:\WINDOWS\system32\dpus11.dll
2007-01-30 06:56    294912    --a------    C:\WINDOWS\system32\dpu11.dll
2007-01-30 06:56    294912    --a------    C:\WINDOWS\system32\dpu10.dll
2007-01-30 06:56    196608    --a------    C:\WINDOWS\system32\dtu100.dll


((((((((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}    C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{38D3FE60-3D53-4F37-BB0E-C7A97A26A156}    C:\Programmer\Pando Networks\Pando\PandoIEPlugin.dll
{53707962-6F74-2D53-2644-206D7942484F}    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{5CA3D70E-1895-11CF-8E15-001234567890}    C:\WINDOWS\system32\dla\tfswshx.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}    C:\Programmer\Java\jre1.5.0_11\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6}    C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SynTPLpr"="C:\\Programmer\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Programmer\\Synaptics\\SynTP\\SynTPEnh.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"TpShocks"="TpShocks.exe"
"ControlCenter"="\"C:\\Programmer\\IBM fingerprint software\\ctlcntr.exe\" /startup"
"TP4EX"="tp4ex.exe"
"SoundMAXPnP"="C:\\Programmer\\Analog Devices\\SoundMAX\\SMax4PNP.exe"
"SoundMAX"="C:\\Programmer\\Analog Devices\\SoundMAX\\Smax4.exe /tray"
"UpdateManager"="\"C:\\Programmer\\Fælles filer\\Sonic\\Update Manager\\sgtray.exe\" /r"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
@=""
"ibmmessages"="C:\\Programmer\\IBM\\Messages By IBM\\\\ibmmessages.exe"
"IBMPRC"="C:\\IBMTOOLS\\UTILS\\ibmprc.exe"
"QuickTime Task"="\"C:\\Programmer\\QuickTime\\qttask.exe\" -atboottime"
"GhostStartTrayApp"="C:\\Programmer\\Symantec\\Norton Ghost 2003\\GhostStartTrayApp.exe"
"SunJavaUpdateSched"="\"C:\\Programmer\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"HttpDetect"=""
"OfficeScanNT Monitor"="\"C:\\Programmer\\Trend Micro\\OfficeScan Client\\pccntmon.exe\" -HideWindow"
"TkBellExe"="\"C:\\Programmer\\Fælles filer\\Real\\Update_OB\\realsched.exe\"  -osboot"
"DAEMON Tools"="\"C:\\Programmer\\DAEMON Tools\\daemon.exe\" -lang 1033"
"PWRISOVM.EXE"="C:\\Programmer\\PowerISO\\PWRISOVM.EXE"
"GCXX-Manager-Class"="\"C:\\Programmer\\Sony Ericsson\\Wireless Manager\\GCXXManager.exe\" -startup"
"Sony Ericsson Wireless Manager UI"="C:\\WINDOWS\\system32\\semwltray"
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Programmer\\Google\\Gmail Notifier\\gnotify.exe"
"NeroFilterCheck"="C:\\Programmer\\Fælles filer\\Ahead\\Lib\\NeroCheck.exe"
"FuncLimi"="C:\\MaxUser\\FuncLimi.exe"
"QCTray"="C:\\PROGRA~1\\ThinkPad\\CONNEC~1\\QCTray.exe"
"nmapp"="\"C:\\Programmer\\Pure Networks\\Network Magic\\nmapp.exe\" -autorun -nosplash"
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
"EQOClient"="C:\\Programmer\\EQO\\EQO.exe"
"TPKMAPHELPER"="C:\\Programmer\\ThinkPad\\Utilities\\TpKmapAp.exe -helper"
"TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe"
"StartFoxie"="C:\\Programmer\\Foxie Suite\\StartFoxie.exe"
"QCWLIcon"="C:\\Programmer\\ThinkPad\\ConnectUtilities\\QCWLICON.EXE"
"PWRMGRTR"="rundll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\PWRMGRTR.DLL,PwrMgrBkGndMonitor"
"EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.Exe"
"BookPCTrayAdmin"="C:\\Programmer\\BookPC\\BookPCTrayAdmin.exe"
"BLOG"="rundll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"ibmmessages"="C:\\Programmer\\IBM\\Messages By IBM\\ibmmessages.exe"
"Creative Detector"="C:\\Programmer\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Programmer\\Fælles filer\\Ahead\\Lib\\NMBgMonitor.exe\""
"Uploadgrim"="C:\\DOCUME~1\\JESPER~1\\APPLIC~1\\AIMHTM~1\\Send Dumb Type.exe"
"SpybotSD TeaTimer"="C:\\Programmer\\Spybot - Search & Destroy\\TeaTimer.exe"
"Skype"="\"C:\\Programmer\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Pando"="\"C:\\Programmer\\Pando Networks\\Pando\\Pando.exe\" /Minimized"
@=""
"msnmsgr"="\"C:\\Programmer\\MSN Messenger\\msnmsgr.exe\" /background"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
  Authentication Packages    REG_MULTI_SZ      msv1_0\0\0
  Security Packages    REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
  Notification Packages    REG_MULTI_SZ      scecli\0pwdmon\0\0


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter    REG_MULTI_SZ      HTTPFilter\0\0
LocalService    REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService    REG_MULTI_SZ      DnsCache\0\0
DcomLaunch    REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss    REG_MULTI_SZ      RpcSs\0\0
imgsvc    REG_MULTI_SZ      StiSvc\0\0
termsvcs    REG_MULTI_SZ      TermService\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\PMTask.job

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-20 13:34:30
C:\ComboFix-quarantined-files.txt ... 07-04-20 13:34

Ja. jeg har styr på min deep freeze og de andre ting,,bruger dem til mit arbejde.

Jeg ka' se at du har/har haft P2P programer i systemet

* emule
* bitdownload
* dc++

... så er der nok en grund til at du har fået noget 'snavs' ind i systemet...

Kommer tilbage senere iaften ...

ja. men har ikke brugt de programmer i lang lang tid, og det problem jeg har nu opstod for et par dage siden.

Jeg fjernede det med SAS, som jeg fik fra et link på eksperten.dk