Notifikationer

Markér alle som læst Log ud

uffesteenberg Novice

13. august 2007 - 22:39 Der er 36 kommentarer og
2 løsninger

Har jeg virus eller noget lignende??

Puha.. sad og fumlede med min bærbare nede på biblioteket og dum so jeg var kom jeg til at skrive www.331851.com i browseren.. en adresse jeg faldt over et eller andet sted..

BESØG IKKE den side!!

Med det samme kom der en blå skærm frem med en eller anden og computeren genstartede..

Siden har jeg ikke kunnet forbinde til nettet trådløst.. når jeg genstarter og går ind i enhedshåndtering er der røde krydser ved Network Adadpters indtil jeg aktiverer dem, men det gentager sig indimellem..

Hverken Spybot , Windows defender eller AVG Antivirus har fundet noget, men skriver:
Boot sector of disk (C) - reading error..

Kan ikke finde noget om den satans side på Google og kunne heler ikke finde frem til den igen på en anden pc...

Nogen der har en anelse om, hvad jeg har rodet mig ud i?
Ville sgu gerne undgå at skulle formatere hele pc'en...

Synes godt om

fromsej Praktikant

13. august 2007 - 22:47 #1

Følg denne vejledning:
http://www.eksperten.dk/artikler/1123

Synes godt om

uffesteenberg Novice

13. august 2007 - 22:53 #2

Tak... det vil jeg prøve senere... venter lige og ser om der kommer flere indlæg inden jeg går igang med den omfattende undersøgelse :-)

Synes godt om

uffesteenberg Novice

13. august 2007 - 23:40 #3

Kan sgu ikke få den til at starte i fejlsikret tilstand i forbindelse med Super AntiSpyware.. er det ok indtil videre bare at køre det i alm. tilstand?

Synes godt om

uffesteenberg Novice

14. august 2007 - 08:32 #4

Her er så log-filerne... håber du eller andre kan få øje på problemet :-)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/14/2007 at 00:36 AM

Application Version : 3.7.1018

Core Rules Database Version : 3222
Trace Rules Database Version: 1233

Scan type : Complete Scan
Total Scan Time : 00:52:21

Memory items scanned : 577
Memory threats detected : 0
Registry items scanned : 6759
Registry threats detected : 0
File items scanned : 48391
File threats detected : 135

Adware.Tracking Cookie
C:\Documents and Settings\Uffe\Cookies\uffe@observer.advertserve[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@dealtime[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@e2.emediate[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@track.adform[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ncom.banneradministration[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@bonnier.banneradministration[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@usenext[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@easywarez[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@realmedia[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjnyukdjagq.stats.esomniture[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@banner.fynskemedier[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.zanox[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@xiti[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@advert.travlang[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@toplist[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@dsml.clickexperts[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@stats1.clicktracks[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.multimediaworld[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@media-convert[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@shinystat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@burstnet[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@smileycentral[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.netdebit-counter[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@sdc.krollontrack[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.web-mediaplayer[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.adtoma[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adserver.banneradministration[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.etracker[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wgmygicpwlp.stats.esomniture[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@mediabuy.uk.smarttargetting[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adlog.cdfreaks[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adinterax[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ads.heias[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.e-kolay[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@usenext[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@weborama[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.scanmedios[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.fullreleases[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@tacoda[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ads.ookla[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@tripod[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adecn[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.theadhost[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@partypoker[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ads.us.e-planning[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@directoriowarez[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adfair[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@revsci[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@stat.onestat[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad2.adecn[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@zbox.zanox[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad.adnetinteractive[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@uk.sitestat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@anad.tacoda[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@stat.dealtime[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad-creatividades.infojobs[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[7].txt
C:\Documents and Settings\Uffe\Cookies\uffe@warezlinker[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@int.sitestat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@kanoodle[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.burstbeacon[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@uk.sitestat[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@rotator.adjuggler[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@clicktorrent[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@itxt.vibrantmedia[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@multimediaworld[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.matrixx-media[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@watagame.banneradministration[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.mediarevenue[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.elitebastards[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@altastat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@indextools[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@expatriateliterarycircle[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@1.marketbanker[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad1.clickhype[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www6.addfreestats[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@altacracks[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@estat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@CAZ06146.txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.advertising-department[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@crackfound[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@azjmp[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ads.neowin[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[3].txt
C:\Documents and Settings\Uffe\Cookies\uffe@m1.webstats.motigo[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ad2.billboard[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@advertpro.ya[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@cpvfeed[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@nl.sitestat[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@indexstats[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@dealtime.co[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www8.addfreestats[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@qxl.banneradministration[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[4].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.madlog[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.warezquality[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adultfriendfinder[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@nl.sitestat[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@ads.freeway[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.dealtime[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[5].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adfarm1.adition[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@precisionclick[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@imrworldwide[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@richmedia.yahoo[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@admse006.adbureau[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@eas.apm.emediate[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.burstnet[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@stat.katalysatormedia[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@t1shopper.advertserve[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@tracker.bitebbs[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www3.addfreestats[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@tracking-fundacioneroski[2].txt
C:\Documents and Settings\Uffe\Cookies\uffe@clickaider[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@alivemedia[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@keywordmax[1].txt
C:\Documents and Settings\Uffe\Cookies\uffe@www.googleadservices[6].txt
C:\Documents and Settings\Uffe\Cookies\uffe@adserver.adreactor[1].txt
C:\Documents and Settings\Laila\Cookies\laila@2o7[2].txt
C:\Documents and Settings\Laila\Cookies\laila@4.adbrite[1].txt
C:\Documents and Settings\Laila\Cookies\laila@adbrite[2].txt
C:\Documents and Settings\Laila\Cookies\laila@ads.us.e-planning[1].txt
C:\Documents and Settings\Laila\Cookies\laila@atdmt[2].txt
C:\Documents and Settings\Laila\Cookies\laila@bannere.fyens[2].txt
C:\Documents and Settings\Laila\Cookies\laila@edsa.122.2o7[1].txt
C:\Documents and Settings\Laila\Cookies\laila@rotator.adjuggler[2].txt
C:\Documents and Settings\Laila\Cookies\laila@track.adform[1].txt
C:\Documents and Settings\Laila\Cookies\laila@tradedoubler[2].txt
C:\Documents and Settings\Laila\Cookies\laila@tribalfusion[2].txt
C:\Documents and Settings\Laila\Cookies\laila@www.googleadservices[1].txt
C:\Documents and Settings\Laila\Cookies\laila@www.googleadservices[2].txt
C:\Documents and Settings\Laila\Cookies\laila@www.googleadservices[3].txt

Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\HLDRRR.EXE
------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 00:48:04, on 14-08-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Documents and Settings\Uffe\Desktop\CRASH\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com.ez.statsbiblioteket.dk:2048/lib/stats/support/plugins/ebraryRdr.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.10.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager-kontrol) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/14.23/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1172588387750
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by132fd.bay132.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BEE9F37-756C-4E68-8ACE-5285EF78C648}: NameServer = 212.242.40.3,212.242.40.51
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
---------------------------------------------------------------------------------

********************************* ROOTCHK-(21-07-07)-LOG, by ejvindh
14-08-2007 0:50:05,03

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 00:50:05
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D\n\21]
"DisplayName"="\xb973\x7792"
"DeviceDesc"="\xb973\x7792"
"ProviderName"="\x27fc\21\xee18\x7c90\x286c\21\b"
"MFG"="\xc1bf\b\xe12b\x1803\x640"
"ReinstallString"=".10.1000.5"
"DeviceInstanceIds"=str(7):"d:\a5110\swcd\drivers\chipset\sbdrv\smbus\smbusati.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000203

scanning hidden files ...

hidden processes: 0
hidden files: 0
---------------------------------------------------------------------------------
ComboFix 07-08-09.3 - "Uffe" 2007-08-14 0:54:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.45.1033.18.482 [GMT 2:00]
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))

2007-08-14 00:53 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-13 23:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-08-13 23:27 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\SUPERAntiSpyware.com
2007-08-13 23:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-08-13 23:19 <DIR> d-------- C:\Program Files\CCleaner
2007-08-13 12:22 54,452 --a------ C:\WINDOWS\system32\drivers\pci32.sys
2007-08-13 01:05 637,454 --a------ C:\WINDOWS\system32\trusted.exe
2007-08-13 01:05 629,764 --------- C:\WINDOWS\system32\drivers\hidr.exe
2007-08-13 01:05 <DIR> d-------- C:\WINDOWS\exefnd
2007-08-13 00:42 <DIR> d-------- C:\Program Files\Prismatic Software
2007-08-13 00:41 40,960 --a------ C:\WINDOWS\DelPiv.exe
2007-08-13 00:41 <DIR> d-------- C:\WINDOWS\Profiles
2007-08-08 16:55 <DIR> d-------- C:\Program Files\Bonjour
2007-08-08 16:31 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-08-06 22:53 476,752 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\pswi_preloaded.exe
2007-08-06 22:14 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-08-06 21:56 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\FastStone
2007-08-06 21:46 <DIR> d-------- C:\WINDOWS\system32\IOSUBSYS
2007-08-06 21:39 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\XnView
2007-08-06 21:24 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\ACD Systems
2007-08-06 21:17 <DIR> d-------- C:\Program Files\Common Files\ACD Systems

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-13 23:26 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 23:21 --------- d-------- C:\Program Files\Yahoo!
2007-08-13 12:20 --------- d-------- C:\Program Files\eMule
2007-08-13 00:03 --------- d-------- C:\Program Files\DC++
2007-08-08 20:10 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-06 22:59 2672 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-06 22:58 88 -r-hs---- C:\WINDOWS\system32\BC80F15C60.sys
2007-08-06 21:46 --------- d-------- C:\Program Files\Picasa2
2007-07-05 22:00 --------- d-------- C:\Program Files\Ares
2007-06-26 22:50 --------- d--h----- C:\Program Files\Zero G Registry
2007-06-26 17:59 43528 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-06-26 17:59 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-06-26 17:59 118056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-06-25 10:47 --------- d-------- C:\DOCUME~1\Uffe\APPLIC~1\U3
2007-06-25 10:07 --------- d-------- C:\Program Files\IrfanView
2007-06-23 00:07 --------- d-------- C:\Program Files\SpywareBlaster
2007-06-23 00:01 --------- d-------- C:\DOCUME~1\Uffe\APPLIC~1\NetPumper
2007-06-22 20:47 --------- d-------- C:\Program Files\MSXML 6.0
2007-06-22 20:44 --------- d-------- C:\Program Files\MSBuild
2007-06-22 20:37 --------- d-------- C:\Program Files\Reference Assemblies
2007-06-21 14:23 --------- d-------- C:\Program Files\Microsoft Works
2007-06-21 14:19 --------- d-------- C:\Program Files\Microsoft.NET
2007-06-19 00:41 --------- d-------- C:\Program Files\Ahead
2007-05-19 22:08 86016 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2007-05-16 17:12 86528 --a------ C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:12 683520 --a------ C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:12 510976 --a------ C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:12 1314816 --a------ C:\WINDOWS\system32\dllcache\msoe.dll
2007-04-26 11:48 103096 --a------ C:\DOCUME~1\Uffe\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-01-26 13:53 81920 --a------ C:\DOCUME~1\Uffe\APPLIC~1\ezpinst.exe
2007-01-26 13:53 47360 --a------ C:\DOCUME~1\Uffe\APPLIC~1\pcouffin.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 23:35]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-10 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 21:00]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 00:54 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 04:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 04:43 C:\WINDOWS\Alcmtr.exe]
"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 23:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 14:07]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 12:12]
"BisonBar"="C:\WINDOWS\BUtilityBar\BisonBar.exe" [2006-09-08 12:49]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 19:26]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 20:40]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 13:11]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"HotKey"="C:\WINDOWS\Twain_32\SlimU2\HotKey.exe" [2002-08-07 11:38]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 07:55]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-07 11:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-18 22:46]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-05-21 23:21]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-23 23:03:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer Empowering Technology.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acer Empowering Technology.lnk
backup=C:\WINDOWS\pss\Acer Empowering Technology.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Uffe^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Uffe\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe Photoshop Elements 4\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\PROGRA~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

R0 SI3112;ATI-4379 Serial ATA Controller;C:\WINDOWS\system32\DRIVERS\SI3112.sys
R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys
R0 viaagp;VIA AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\viaagp.sys
R1 AmdK8;Driver til AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
R2 DritekPortIO;Dritek General Port I/O;\??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys
R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers\tvicport.sys
R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys
R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys
R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys
R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys
R2 zntport;zntport;\??\C:\WINDOWS\system32\drivers\zntport.sys
R3 Cam5603D;Acer OrbiCam;C:\WINDOWS\system32\Drivers\BisonCam.sys
R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
S1 pci32;Derkz864;\??\C:\WINDOWS\system32\drivers\pci32.sys
S1 SABKUTIL;SABKUTIL;\??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\C:\WINDOWS\system32\eLock2FSCTLDriver.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
S3 SABProcEnum;SABProcEnum;\??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ccfdcb5-a47f-11db-8e5b-0016d4661efe}]
AutoRun\command- F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a490c2eb-0868-11dc-9008-0016d4661efe}]
AutoRun\command- F:\wd_windows_tools\setup.exe

Contents of the 'Scheduled Tasks' folder
2007-02-26 13:10:17 C:\WINDOWS\Tasks\AdsGone.job - C:\Program Files\AdsGone\AdsGone.exe
2007-08-13 20:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-13 22:45:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 00:57:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D\n\21]
"DisplayName"="\xb973\x7792"
"DeviceDesc"="\xb973\x7792"
"ProviderName"="\x27fc\21\xee18\x7c90\x286c\21\b"
"MFG"="\xc1bf\b\xe12b\x1803\x640"
"ReinstallString"=".10.1000.5"
"DeviceInstanceIds"=str(7):"d:\a5110\swcd\drivers\chipset\sbdrv\smbus\smbusati.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000cb5

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\viaagp]
"ImagePath"="system32\DRIVERS\viaagp.sys"

Completion time: 2007-08-14 0:58:22

--- E O F ---

Synes godt om

uffesteenberg Novice

14. august 2007 - 08:34 #5

... og smider gerne x antal flødekager oven i de 200 point :-)

Synes godt om

fromsej Praktikant

14. august 2007 - 18:02 #6

Dine infektioner og problemer stammer ikke kun fra det famøse link!
Du bruger fildeling, det er den største smittespreder overhovedet på nettet.
Afinstaller eMule og DC++ i Tilføj/fjern programmer, genstart.

Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Kopiér indholdet mellem de bølgede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt. Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

~~~~~~~~~~~~~~~~~~~~~~~~~~

File::
C:\WINDOWS\system32\drivers\pci32.sys
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\hidr.exe

Folder::
C:\WINDOWS\exefnd
C:\Program Files\eMule
C:\Program Files\DC++

~~~~~~~~~~~~~~~~~~~~~~~~~~
Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen. - http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Når det er overstået:
Hent og kør dette program:
http://techsupportforum.com/sectools/sUBs/SafeBootKeyRepair-CF.exe
Det tager et øjeblik, programmet laver en log, den skal du kopiere ind i dit næste svar.
Den ligger her:
C:\SafeBoot_Repair.txt.

Vi skal også se den nye Combofixlog og en frisk Hijackthislog.

Hvordan downloader man en flødeskumskage? ;-)

Synes godt om

uffesteenberg Novice

14. august 2007 - 21:12 #7

Hov. havde sgu da glemt at afinstallere dem inden jeg gik i gang. Anyway, så har jeg ikke brugt dem i ugevis og de har aldrig givet mig problemer. Problemerne startede i samme sekund jeg gik ind på ovennævnte side. Men jeg fjerner dem lige og følger din forklaring :-)

Synes godt om

uffesteenberg Novice

15. august 2007 - 00:54 #8

OK, så er alt, der lugter af P2P fjernet og her er de nye logfiler:

ComboFix 07-08-09.3 - "Uffe" 2007-08-15 0:36:44.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.45.1033.18.466 [GMT 2:00]
Command switches used :: C:\Documents and Settings\Uffe\Desktop\CRASH\CFScript
* Created a new restore point

FILE::
C:\WINDOWS\system32\drivers\pci32.sys
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\hidr.exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\exefnd
C:\WINDOWS\exefnd\464781.exe
C:\WINDOWS\exefnd\59342390.exe
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\WINDOWS\system32\trusted.exe
F:\Autorun.inf

((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 )))))))))))))))))))))))))))))))

2007-08-14 00:53 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-13 23:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-08-13 23:27 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\SUPERAntiSpyware.com
2007-08-13 23:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-08-13 23:19 <DIR> d-------- C:\Program Files\CCleaner
2007-08-13 00:42 <DIR> d-------- C:\Program Files\Prismatic Software
2007-08-13 00:41 40,960 --a------ C:\WINDOWS\DelPiv.exe
2007-08-13 00:41 <DIR> d-------- C:\WINDOWS\Profiles
2007-08-08 16:55 <DIR> d-------- C:\Program Files\Bonjour
2007-08-08 16:31 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-08-06 22:53 476,752 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\pswi_preloaded.exe
2007-08-06 22:14 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-08-06 21:56 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\FastStone
2007-08-06 21:46 <DIR> d-------- C:\WINDOWS\system32\IOSUBSYS
2007-08-06 21:39 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\XnView
2007-08-06 21:24 <DIR> d-------- C:\DOCUME~1\Uffe\APPLIC~1\ACD Systems
2007-08-06 21:17 <DIR> d-------- C:\Program Files\Common Files\ACD Systems

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-13 23:26 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 23:21 --------- d-------- C:\Program Files\Yahoo!
2007-08-08 20:10 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-06 22:59 2672 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-06 22:58 88 -r-hs---- C:\WINDOWS\system32\BC80F15C60.sys
2007-08-06 21:46 --------- d-------- C:\Program Files\Picasa2
2007-06-26 22:50 --------- d--h----- C:\Program Files\Zero G Registry
2007-06-26 17:59 43528 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-06-26 17:59 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-06-26 17:59 118056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-06-25 10:47 --------- d-------- C:\DOCUME~1\Uffe\APPLIC~1\U3
2007-06-25 10:07 --------- d-------- C:\Program Files\IrfanView
2007-06-23 00:07 --------- d-------- C:\Program Files\SpywareBlaster
2007-06-23 00:01 --------- d-------- C:\DOCUME~1\Uffe\APPLIC~1\NetPumper
2007-06-22 20:47 --------- d-------- C:\Program Files\MSXML 6.0
2007-06-22 20:44 --------- d-------- C:\Program Files\MSBuild
2007-06-22 20:37 --------- d-------- C:\Program Files\Reference Assemblies
2007-06-21 14:23 --------- d-------- C:\Program Files\Microsoft Works
2007-06-21 14:19 --------- d-------- C:\Program Files\Microsoft.NET
2007-06-19 00:41 --------- d-------- C:\Program Files\Ahead
2007-05-19 22:08 86016 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2007-05-16 17:12 86528 --a------ C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:12 683520 --a------ C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:12 510976 --a------ C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:12 1314816 --a------ C:\WINDOWS\system32\dllcache\msoe.dll
2007-04-26 11:48 103096 --a------ C:\DOCUME~1\Uffe\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-01-26 13:53 81920 --a------ C:\DOCUME~1\Uffe\APPLIC~1\ezpinst.exe
2007-01-26 13:53 47360 --a------ C:\DOCUME~1\Uffe\APPLIC~1\pcouffin.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 23:35]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-10 21:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 21:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 21:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 21:00]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 00:54 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 04:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 04:43 C:\WINDOWS\Alcmtr.exe]
"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 23:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 14:07]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 12:12]
"BisonBar"="C:\WINDOWS\BUtilityBar\BisonBar.exe" [2006-09-08 12:49]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 19:26]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 20:40]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 13:11]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"HotKey"="C:\WINDOWS\Twain_32\SlimU2\HotKey.exe" [2002-08-07 11:38]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 07:55]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-07 11:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-18 22:46]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-05-21 23:21]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-04-23 23:03:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acer Empowering Technology.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acer Empowering Technology.lnk
backup=C:\WINDOWS\pss\Acer Empowering Technology.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Uffe^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Uffe\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe Photoshop Elements 4\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\PROGRA~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

R0 SI3112;ATI-4379 Serial ATA Controller;C:\WINDOWS\system32\DRIVERS\SI3112.sys
R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys
R0 viaagp;VIA AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\viaagp.sys
R1 AmdK8;Driver til AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
R2 DritekPortIO;Dritek General Port I/O;\??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys
R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers\tvicport.sys
R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys
R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys
R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys
R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys
R2 zntport;zntport;\??\C:\WINDOWS\system32\drivers\zntport.sys
R3 Cam5603D;Acer OrbiCam;C:\WINDOWS\system32\Drivers\BisonCam.sys
R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
S1 pci32;Derkz864;\??\C:\WINDOWS\system32\drivers\pci32.sys
S1 SABKUTIL;SABKUTIL;\??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\C:\WINDOWS\system32\eLock2FSCTLDriver.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 irsir;Microsoft Serial Infrared Driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
S3 SABProcEnum;SABProcEnum;\??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ccfdcb5-a47f-11db-8e5b-0016d4661efe}]
AutoRun\command- F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a490c2eb-0868-11dc-9008-0016d4661efe}]
AutoRun\command- F:\wd_windows_tools\setup.exe

Contents of the 'Scheduled Tasks' folder
2007-02-26 13:10:17 C:\WINDOWS\Tasks\AdsGone.job - C:\Program Files\AdsGone\AdsGone.exe
2007-08-13 20:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-14 20:54:25 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-15 00:37:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\D\n\21]
"DisplayName"="\xb973\x7792"
"DeviceDesc"="\xb973\x7792"
"ProviderName"="\x27fc\21\xee18\x7c90\x286c\21\b"
"MFG"="\xc1bf\b\xe12b\x1803\x640"
"ReinstallString"=".10.1000.5"
"DeviceInstanceIds"=str(7):"d:\a5110\swcd\drivers\chipset\sbdrv\smbus\smbusati.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000006c6

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\viaagp]
"ImagePath"="system32\DRIVERS\viaagp.sys"

Completion time: 2007-08-15 0:38:45
C:\ComboFix-quarantined-files.txt ... 2007-08-15 00:38

--- E O F ---

--------------------------------------------------------------------
Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]

========================

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.
~~\SafeBoot\Minimal\Base
~~\SafeBoot\Minimal\Boot Bus Extender
~~\SafeBoot\Minimal\Boot file system
~~\SafeBoot\Minimal\dmboot.sys
~~\SafeBoot\Minimal\dmio.sys
~~\SafeBoot\Minimal\dmload.sys
~~\SafeBoot\Minimal\dmserver
~~\SafeBoot\Minimal\File system
~~\SafeBoot\Minimal\Filter
~~\SafeBoot\Minimal\PCI Configuration
~~\SafeBoot\Minimal\Primary disk
~~\SafeBoot\Minimal\RpcSs
~~\SafeBoot\Minimal\SCSI Class
~~\SafeBoot\Minimal\sermouse.sys
~~\SafeBoot\Minimal\System Bus Extender
~~\SafeBoot\Minimal\vga.sys
~~\SafeBoot\Minimal\vgasave.sys
~~\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
~~\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}
~~\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}
~~\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}
~~\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}
~~\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}

========================

Error: Key: system\currentcontrolset\control\safeboot\minimal does not exist!

-----------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 00:44:47, on 15-08-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Uffe\Desktop\CRASH\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com.ez.statsbiblioteket.dk:2048/lib/stats/support/plugins/ebraryRdr.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.10.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager-kontrol) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/14.23/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1172588387750
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by132fd.bay132.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BEE9F37-756C-4E68-8ACE-5285EF78C648}: NameServer = 212.242.40.3,212.242.40.51
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

Synes godt om

uffesteenberg Novice

15. august 2007 - 00:55 #9

PS: Regner med at telepatere flødeskumskagen til dig 8-)

Synes godt om

fromsej Praktikant

15. august 2007 - 18:19 #10

Hent Crapcleaner her:
http://www.filehippo.com/download_ccleaner/
Installer Crapcleaner, husk at fjerne fluebenet udfor installation af Yahoo toolbar.
Start programmet, fjern fluebenet i cookies.
Klik på kør Cleaner og lad den fjerne hvad den finder.
Klik så på Problemer ovre i venstre side (den blå terning), klik på Skan efter problemer, når den er færdig, klik på Udbedre valgte problemer, lav evt. en backup af registreringsdatabasen, klik så på udbedre alle valgte problemer.
Klik på OK, klik på Luk når den er færdig.
Genstart.
---------------------------------------
Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.
[black]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
[/black]
---------------------------------------
Vi skal se en frisk hijackthislog.

Kørte du http://techsupportforum.com/sectools/sUBs/SafeBootKeyRepair-CF.exe ?
Hvis ja, kan den så komme i fejlsikret nu?

Synes godt om

fromsej Praktikant

15. august 2007 - 18:20 #11

[black] og [/black] skulle ikke have været med, det er formateringskoder i vores forum, dem glemte jeg lige at redigere ud.

Synes godt om

uffesteenberg Novice

15. august 2007 - 20:40 #12

Jeps kørte programmet, men kan stadig ikke komme i fejlfri. Når jeg vælger Safe Mode, flyver der en masse over skærmen, hvor jeg lige kunne nå at fange ordene Multi - Disk - Partition - Windows - System32 - og så en masse drivers..

Mener jeg faldt over noget på Spywarefri om, at man kan tvinge den i fejlfri tilstand via BIOS, men det er ikke noget jeg har erfaring med overhovedet... er det noget vi skal ud i eller..??

Nå, men i hvert fald så følger jeg lige forklaringen i dit seneste indlæg :-)

Synes godt om

uffesteenberg Novice

15. august 2007 - 21:17 #13

Her kommer så seneste Hijackthis-log...
PS: Ups, fik ved en fejl ikke sat fluben ved:
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
...men ved næste scan kan jeg nu heller ikke se denne linie...

Logfile of HijackThis v1.99.1
Scan saved at 21:14:41, on 15-08-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Documents and Settings\Uffe\Desktop\CRASH\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com.ez.statsbiblioteket.dk:2048/lib/stats/support/plugins/ebraryRdr.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.10.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager-kontrol) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/14.23/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1172588387750
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by132fd.bay132.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BEE9F37-756C-4E68-8ACE-5285EF78C648}: NameServer = 212.242.40.3,212.242.40.51
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

Synes godt om

Computer Hjælp (Gratis) Mester

16. august 2007 - 08:13 #14

"...fejlfri tilstand via BIOS..." har ikke noget med hinanden at gøre ...

http://www.spywareinfo.dk/#/htm/fejlsikret_tilstand.htm

Synes godt om

uffesteenberg Novice

16. august 2007 - 20:18 #15

OK, tak... det er sort snak for mig anyway :-)

Håber at få lokaliseret problemet.. har mulighed for at backe alt up til ekstern harddisk og formatere, men det ville da være rart at slippe for det..

Afventer yderlige instruktioner ;-)

Synes godt om

uffesteenberg Novice

16. august 2007 - 23:38 #16

Hmmmm... scannede osgå lige med AVG's antispyware og den fandt en sjover kaldet "dropper.small", som den vurderede til at være højrisiko. Desværre frøs computeren fuldstændig og jeg måtte til sidst slukke på knappen - og nu bipper den højlydt under opstart og er i sort skærm... :-(

Synes godt om

uffesteenberg Novice

16. august 2007 - 23:54 #17

Som sagt er der totalt sort skærm, men klikker jeg rundt med musen kan jeg ramme billedet til min brugerkonto og høre start-lyden, så helt død er den jo ikke - men skærmen forbliver sort... hulk hulk.. kunne jeg dog bare få den til at starte op, så jeg kan køre en backup eller lignende :-(

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 00:12 #18

... er SKÆRMEN "...totalt sort skærm..." hele vejen igennem ? Også under BIOS opstart ?

Synes godt om

uffesteenberg Novice

17. august 2007 - 00:26 #19

Ja desværre.. fra jeg trykker på power-knappen og fremefter...

Synes godt om

uffesteenberg Novice

17. august 2007 - 00:37 #20

Bare lige en tanke, HVIS nu den er helt gal:
Kan jeg få adgang tl harddisken ved at forbinde den til en anden computer på en eller anden måde? Min kæreste har en lignende Acer bærbar, men med andre specifikationer, så man kan vel ikke bare smide den over i den.. men kan den forbindes eksternt på en eller anden måde?

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 08:26 #21

1) En anden SKÆRM ?
2) Prøv SKÆRMEN på en anden PC ?

Synes godt om

uffesteenberg Novice

17. august 2007 - 08:30 #22

Det havde jeg også tænkt kunne være en mulighed.. men hvordan sætter jeg en anden skærm til en bærbar???
Kan jeg bruge en anden bærbar eller skal jeg bruge min fladskærm til den stationære?

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 08:40 #23

... Havde ikke bemærket at det var en BÆRBAR *S* ...

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 08:45 #24

... så er det en 'rigtig' hardware fejl - altså ikke noget med Virus ell. lign. ...

Du _kan_ muligvis sætte en anden skærm til dertil beregnet VGA stik på PC'en. Det er så et ? om den automatisk bliver aktiveret. Den skal måske brugs en Fn tastkombination (Se på tastatur)

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 08:47 #25

"...forbinde den til en anden computer på en eller anden måde..." - kun hvis du har givet tiladelse - og det kniber jo da du ikke ka' se hvad du laver *S*

Synes godt om

uffesteenberg Novice

17. august 2007 - 08:47 #26

Ok... så må jeg nøjes med at sidde at hamre hovedet ned i bordet :-(

Nå men, hvad gør jeg?

1- Kan jeg på en eller anden måde få adgang til harddisken ved at forbinde den til en anden computer?

2- Skal jeg indlevere den til reparation/undersøgelse og kan jeg være sikker på jeg kan komme ind på harddisken bagefter (går ud fra det er grafikkort eller RAM eller noget i den stil, den er gal med).

NB: Bør jeg oprette nyt spørgsmål nu da problemet er gået fra spyware/virus til hardware-problem?? Smider gerne flere point efter gode råd..

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 08:55 #27

... du kan ikke bare flytte HD'en over i en anden PC og så boote op der. Det skal være en PC med samme specifikationer/chipsæt for at det går godt ...

Alternativ: Der findes et kabelsæt (USB <-> EDI) hvor du forbinder din HD (kun HD'en) til en anden PC's USB stik og jupti så ka' du se den som et extra drev i stifinder...
Dette kabelsæt ka' jeg ikke finde lige nu... det har været her før... koster <100 Dkr.

Kan ikke nå mere nu ...

Synes godt om

uffesteenberg Novice

17. august 2007 - 08:57 #28

Lyder interessant... hører gerne nærmere om det kabel!!!

Jeg kan vel ikke smide harddisken i en usb-boks og sætte den til eksternt på en anden pc?

Tak for hjælpen i øvrigt :-)

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 09:02 #29

... hvis USB boxen har det rigtige HD stik - så ja ...

Synes godt om

Computer Hjælp (Gratis) Mester

17. august 2007 - 09:13 #30

Her er en universalbox til det -> http://simanote.dk/?page=tilbehor&id=58 (øverst)

Synes godt om

uffesteenberg Novice

17. august 2007 - 09:21 #31

Fino...de har vist noget i den stil nede hos min lokale Zitech.. smutter ned og hører, hvad de siger...

Synes godt om

tafkab Nybegynder

17. august 2007 - 09:28 #32

Det har de nemlig, men du skal lige sikre dig om harddisken i den bærbare er en ATA eller SATA - da der findes 2 forskellige modeller:

http://www.zitech.dk/Product/Details.aspx?ID=158935

http://www.zitech.dk/Product/Details.aspx?ID=159470

Hvis du kan, så pil evt. harddisken ud og tag den med derne.

Synes godt om

uffesteenberg Novice

17. august 2007 - 09:29 #33

Sikkert sata.. jeg tager disken med derned :-)

Synes godt om

uffesteenberg Novice

17. august 2007 - 20:26 #34

Nå, det er vist umuligt at skaffe en til SATA-harddisk i Århus idag, men regner med at få fat på denne her på tirsdag fra SHG i Århus - så må vi se om det lykkes at få mine sager over på en anden pc.
http://www.raidsonic.de/en/pages/search/search_list.php?we_objectID=4388&pid=0

Synes godt om

uffesteenberg Novice

18. august 2007 - 20:59 #35

Lader lige denne tråd stå... Har oprettet et nyt spørgsmål i forbindelse med mine nye problemer (at komme ind på harddisken).
Jeg vender naturligvis tilbage med point i denne tråd :-)
..Og I er MEGET velkomne til at give en hånd eller kommentere i den nye tråd -->

http://www.eksperten.dk/spm/792329

Synes godt om

uffesteenberg Novice

11. maj 2008 - 14:10 #36

Læg bare svar :-)

Synes godt om

Computer Hjælp (Gratis) Mester

11. maj 2008 - 15:54 #37

Ping...

Synes godt om

fromsej Praktikant

12. maj 2008 - 09:55 #38

Pong...

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Andet hardware kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
DVB T2 tuner med optagefunktion Af ErikHg i Andet hardware	5	22/07/202620:19	29/07/202620:30
overføre internet til gæstehus Af Malm i Andet hardware	16	14/07/202613:08	23/08/202610:08
Et wifi net til en kolonihave uden wifi Af Andershoegh i Andet hardware	12	09/07/202615:37	13/07/202617:24
Sletning af WD Elements - som er krypteret (og ikke kommer normalt frem på skærmen med indtast af kode). Af Rikke i Andet hardware	18	07/07/202611:24	30/07/202616:18
Creative Soundblaster Audigy FX v2 Af ErikHg i Andet hardware	5	28/06/202620:51	29/06/202617:09

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS