Tjek lige denne Hijackthis-log

Hent Combofix, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-- Kør så combofix.exe, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind, sammen med en frisk Hijackthislog.

HIJACK:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 21:19, on 2007-08-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RaUI.exe
C:\Programmer\InstallShield Software Corporation\802.11b Wireless Lan Utility\RtlWake.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Daniel Axelsen\Skrivebord\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {D4C4C6A9-6312-484F-A170-967B9FB26E97} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [xem] C:\WINDOWS\ServicePackFiles\services.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKCU\..\Run: [xem] C:\WINDOWS\ServicePackFiles\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [Kernel32.exe] C:\WINDOWS\Kernel32.exe (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmer\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe
O4 - Global Startup: RtlWake.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmer\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/229?40682a359d894898833d5c707920eee2
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/230?40682a359d894898833d5c707920eee2
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O24 - Desktop Component 0: (no name) - C:\Programmer\Ahead\proprygefsi.html
O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/DANIEL~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 6559 bytes
----------------------------
COMBIFIX:
ComboFix 07-08-03.4 - "Administrator" 2007-08-03 21:06:48.1 [GMT 2:00] - NTFS [SAFE MODE]
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1030.18.Sand


(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))


C:\d.exe
C:\DOCUME~1\CONNIE~1\APPLIC~1\.rdr.ini
C:\DOCUME~1\DANIEL~1\APPLIC~1\.rdr.ini
C:\DOCUME~1\DANIEL~1\APPLIC~1\install.dat
C:\DOCUME~1\LOCALS~1.NTA\APPLIC~1\install.dat
C:\DOCUME~1\NETWOR~1.NTA\APPLIC~1\.rdr.ini
C:\DOCUME~1\NETWOR~1.NTA\APPLIC~1\install.dat
C:\temp\0c2
C:\temp\0c2\tmpFF.log
C:\temp\brr
C:\temp\tn3
C:\Think-Adz.lnk
C:\WINDOWS\acdt-pid67n.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\servicepackfiles\data.ini
C:\WINDOWS\servicepackfiles\services.exe
C:\WINDOWS\spooldr.exe
C:\WINDOWS\system32\arcac.exe.bak
C:\WINDOWS\system32\B0
C:\WINDOWS\system32\B0\kmhp83122.exe
C:\WINDOWS\system32\b06FdUe
C:\WINDOWS\system32\b06FdUe\b06FdUe1083.exe
C:\WINDOWS\system32\B1
C:\WINDOWS\system32\B1\wr716.exe
C:\WINDOWS\system32\B2
C:\WINDOWS\system32\config\systemprofile\application data\.rdr.ini
C:\WINDOWS\system32\DefLib.sys
C:\WINDOWS\system32\dllcache\mswsock.dll
C:\WINDOWS\system32\drivers\asc3550u.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\mm.ini
C:\WINDOWS\system32\notiffy.dll
C:\WINDOWS\system32\ntio256.sys
C:\WINDOWS\system32\printers.exe
C:\WINDOWS\system32\protector.exe
C:\WINDOWS\system32\spooldr.sys
C:\WINDOWS\system32\spoolsvv.exe
C:\WINDOWS\system32\win
C:\WINDOWS\winvip.exe
C:\WINDOWS\winvip.exe.bak


(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC3550U
-------\LEGACY_CORE
-------\LEGACY_NTIO256
-------\LEGACY_NTMLSVC
-------\LEGACY_RUNTIME
-------\LEGACY_SYSLIBRARY
-------\asc3550u
-------\core
-------\nm
-------\ntio256
-------\NtmlSvc
-------\SysLibrary


(((((((((((((((((((((((((  Files Created from 2007-07-03 to 2007-08-03  )))))))))))))))))))))))))))))))


2007-08-03 21:05    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-08-03 20:06    524,288    --ah-----    C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-08-03 20:06    <DIR>    dr-------    C:\DOCUME~1\ADMINI~1\Menuen Start
2007-08-03 20:06    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Skabeloner
2007-08-03 20:06    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Printere
2007-08-03 20:06    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Lokale indstillinger
2007-08-03 20:06    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Andre computere
2007-08-03 20:06    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\Skrivebord
2007-08-03 20:06    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\Foretrukne
2007-08-03 20:06    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\Dokumenter
2007-08-02 11:59    <DIR>    d--------    C:\WINDOWS\system32\da-dk
2007-08-02 11:55    <DIR>    d--------    C:\WINDOWS\network diagnostic
2007-08-02 11:46    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
2007-07-29 23:25    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-07-29 22:24    <DIR>    d--------    C:\Programmer\Abexo
2007-07-29 22:24    <DIR>    d--------    C:\DOCUME~1\CONNIE~1\APPLIC~1\Abexo
2007-07-29 22:21    <DIR>    d--------    C:\Programmer\SpywareBlaster
2007-07-29 22:08    <DIR>    d--------    C:\WINDOWS\system32\Kaspersky Lab
2007-07-25 00:50    45,056    --a------    C:\WINDOWS\system32\IeExtenderPlugin.dll
2007-07-25 00:49    211,917    --a------    C:\Temp\bY004.exe
2007-07-25 00:49    <DIR>    dr-------    C:\DOCUME~1\NETWOR~1.NTA\Foretrukne
2007-07-25 00:49    <DIR>    dr-------    C:\DOCUME~1\LOCALS~1.NTA\Foretrukne
2007-07-25 00:49    <DIR>    d--------    C:\DOCUME~1\NETWOR~1.NTA\Menuen Start
2007-07-25 00:48    192,619    --a------    C:\WINDOWS\system32\owinkndt.exe
2007-07-25 00:48    <DIR>    d--------    C:\Temp
2007-07-25 00:47    6,689    --a------    C:\WINDOWS\system32\ldcore.dll
2007-07-25 00:47    3,804    --a------    C:\cwio.exe
2007-07-24 14:31    <DIR>    d--------    C:\DOCUME~1\CONNIE~1\APPLIC~1\Lavasoft
2007-07-23 13:41    11,520    --a------    C:\DOCUME~1\DANIEL~1\ejowhl.exe
2007-07-14 13:31    <DIR>    d--------    C:\DOCUME~1\DANIEL~1\.limewire
2007-07-14 00:08    <DIR>    d--------    C:\DOCUME~1\DANIEL~1\APPLIC~1\LimeWire
2007-07-12 19:35    <DIR>    d--------    C:\Programmer\QuickTime
2007-07-04 13:14    <DIR>    d--------    C:\DOCUME~1\CONNIE~1\APPLIC~1\Google
2007-07-03 19:01    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
2007-07-03 18:57    <DIR>    d--------    C:\Programmer\Eidos Interactive


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-29 21:53    ---------    d--------    C:\Programmer\Windows NT
2007-07-25 11:48    ---------    d--------    C:\Programmer\Ahead
2007-07-25 09:15    ---------    d--------    C:\Programmer\Lexmark 1200 Series
2007-07-24 14:55    374912    --a--c---    C:\WINDOWS\system32\dllcache\tcpip.sys
2007-07-24 14:30    374912    --a------    C:\WINDOWS\system32\drivers\tcpip.sys
2007-07-16 20:01    63870    --a------    C:\WINDOWS\system32\perfc006.dat
2007-07-16 20:01    398348    --a------    C:\WINDOWS\system32\perfh006.dat
2007-07-11 19:40    ---------    d--------    C:\Programmer\Google
2007-07-11 17:16    ---------    d--------    C:\Programmer\CyberLink
2007-07-11 17:12    ---------    d--h-----    C:\Programmer\InstallShield Installation Information
2007-07-11 16:22    ---------    d--------    C:\Programmer\Microsoft AutoRoute
2007-07-01 11:57    335    --a------    C:\WINDOWS\nsreg.dat
2007-06-14 21:55    143    --a------    C:\Programmer\page.html
2007-06-13 15:16    ---------    d--------    C:\Programmer\Messenger
2007-05-16 17:14    86528    -----c---    C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:14    85504    -----c---    C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:14    683520    --a------    C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:14    683520    -----c---    C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:14    510976    -----c---    C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:14    1314816    -----c---    C:\WINDOWS\system32\dllcache\msoe.dll
2006-12-03 03:05    2522    --a------    C:\Programmer\func.js
2006-11-25 09:57    482    --a------    C:\Programmer\Del.js
2006-06-08 09:02    2048    --a------    C:\Programmer\func.exe
    ---------        C:\Programmer\Fælles filer\System

C:\WINDOWS\system32\drivers\tcpip.sys ... is infected !! (additional data below)
360,576 2006-04-20 12:18:35  C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
332,928 2002-09-16 12:00:00  C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
359,040 2004-08-04 06:14:40  C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
374,912 2007-07-24 12:55:54  C:\WINDOWS\system32\dllcache\tcpip.sys
374,912 2007-07-24 12:30:33  C:\WINDOWS\system32\drivers\tcpip.sys


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4C4C6A9-6312-484F-A170-967B9FB26E97}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xem"="C:\WINDOWS\ServicePackFiles\services.exe" []
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2004-10-25 12:08]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2004-08-17 19:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xem"="C:\WINDOWS\ServicePackFiles\services.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 02:53]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"msnmsgr"="C:\Programmer\MSN Messenger\msnmsgr.exe" /background

C:\Documents and Settings\All Users.WINDOWS\Menuen Start\Programmer\Start\
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Programmer\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
Ralink Wireless Utility.lnk - C:\WINDOWS\RaUI.exe [2006-10-23 16:21:59]
RtlWake.lnk - C:\Programmer\InstallShield Software Corporation\802.11b Wireless Lan Utility\RtlWake.exe [2003-05-16 15:04:02]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Programmer\Ahead\proprygefsi.html
FriendlyName=

R0 gagp30kx;Microsoft AGPv3.0-standardfilter til K8-processorplatforme;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R0 prohlp02;StarForce Protection Helper Driver v2;C:\WINDOWS\system32\drivers\prohlp02.sys
R0 prosync1;StarForce Protection Synchronization Driver v1;C:\WINDOWS\system32\drivers\prosync1.sys
R0 sfhlp01;StarForce Protection Helper Driver;C:\WINDOWS\system32\drivers\sfhlp01.sys
R1 MPFIREWL;MPFIREWL;C:\WINDOWS\system32\Drivers\MpFirewall.sys
R1 prodrv06;StarForce Protection Environment Driver v6;C:\WINDOWS\system32\drivers\prodrv06.sys
R1 Tcpip6;Microsoft IPv6-protokoldriver;C:\WINDOWS\system32\DRIVERS\tcpip6.sys
R2 6to4;IPv6-hj‘lpetjeneste;C:\WINDOWS\system32\svchost.exe -k netsvcs
R2 EAPPkt;802.11b EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys
R3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys
R3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys
R3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys
R3 tunmp;Driver til Microsoft Tun Miniport-kort;C:\WINDOWS\system32\DRIVERS\tunmp.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 NaiFiltr;NaiFiltr;C:\WINDOWS\system32\DRIVERS\NaiFiltr.sys
S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys
S3 rtl8180;802.11b Wireless LAN CardBus (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS


Contents of the 'Scheduled Tasks' folder
2007-08-03 19:14:00 C:\WINDOWS\Tasks\McAfee.com Update Check (NA-N11T33NBMXYN-Connie og Kamran).job - C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
2007-08-03 19:12:02 C:\WINDOWS\Tasks\McAfee.com Update Check (NA-N11T33NBMXYN-Daniel Axelsen).job - C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
2007-08-03 19:15:00 C:\WINDOWS\Tasks\McAfee.com Update Check (NA-N11T33NBMXYN-Maria).job - C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
2007-08-03 17:52:00 C:\WINDOWS\Tasks\Søg efter opdateringer til Windows Live Toolbar.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-03 21:12:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

C:\WINDOWS\bak sana  Paris Hilton ne hale gelmis hapiste :(16.zip 121038 bytes hidden from API
C:\WINDOWS\bak sana  Paris Hilton ne hale gelmis hapiste :(8.zip 121036 bytes hidden from API
C:\WINDOWS\bak sana  Paris Hilton ne hale gelmis hapiste :(84.zip 121038 bytes hidden from API
C:\WINDOWS\bak sana  Paris Hilton ne hale gelmis hapiste :(93.zip 121038 bytes hidden from API

scan completed successfully
hidden files: 4

**************************************************************************

Completion time: 2007-08-03 21:16:18
C:\ComboFix-quarantined-files.txt ... 2007-08-03 21:16

    --- E O F ---
--------------

Hvad kan du så fortælle?
Så det meget slemt ud?

Ja det gjorde, og den primære årsag er Limewire, gid i dog ville droppe det åndssvage fildeling, det er langt den største årsag til spredningen af skidtet.
Afinstaller Limewire, og evt. andre fildelingsprogrammer, så brygger jeg en vejledning sammen.

Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Find så mappen C:\WINDOWS\$NtServicePackUninstall$\ højreklik på tcpip.sys, vælg Kopier, åbn mappen C:\WINDOWS\system32\drivers\ højreklik et tomt sted i den og vælg Sæt ind, svar Ja til at overskrive.
Får du ikke lov, så prøv i fejlsikret.
---------------------------
Kopiér indholdet mellem de bølgede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt. Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

~~~~~~~~~~~~~~~~~~~~~~~~~~

File::
C:\cwio.exe
C:\Temp\bY004.exe
C:\WINDOWS\ServicePackFiles\services.exe
C:\WINDOWS\Kernel32.exe
C:\WINDOWS\system32\ldcore.dll
C:\Documents and Settings\Daniel Axelsen\ejowhl.exe

Folder::
C:\Documents and Settings\Daniel Axelsen\.limewire
C:\Documents and Settings\Daniel Axelsen\APPLICATION DATA\LimeWire
C:\Documents and Settings\Daniel Axelsen\LOKALE INDSTILLINGER\Temp\msohtml1

~~~~~~~~~~~~~~~~~~~~~~~~~~
Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Når det er gjort, så kør de to værktøjer fra denne artikel:
http://www.eksperten.dk/artikler/1124
Så skulle den nye MSN virus også gerne blive fjernet, husk at jeg skal se loggen derfra også, sammen med den nye Combofixlog og en frisk Hijackthislog.

Alles ist jetzt paletti ... super ... tak igen engang fromsej.
Smid svar og modtag point

Velbekomme. :-)