Spyware Infestation!

Du skal lige hente nyeste version af hijackthis herfra: http://sptlarsenserious.googlepages.com/HJT-sfx.exe

derefter:

-- Hent S!Ri's SmitfraudFix.zip og gem det på dit Skrivebord.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Alternativt herfra:
http://72.232.135.12/siri/SmitfraudFix.exe

NB: Filen "process.exe" som ligger i dette værktøj bliver af visse antivirus-programmer identificeret som "RiskTool". Det har dog ikke noget på sig!

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Kør SmitfraudFix. Tast 2 - svar ja til at rense (y=yes). Lad programmet gennemføre en rensning. Det vil også checke om systemfilen wininet.dll er inficeret. Hvis den er det, vil du blive bedt om tilladelse til at erstatte den med en anden. Her skal du vælge "Yes", ved at taste "y".

Programmet bliver muligvis nødt til at genstarte undervejs. Herefter vil der dukke en liste med resultaterne af rensningen op . Kopiér denne liste ind i tråden.

-- Genstart og læg en frisk log fra Combofix herind, sammen med loggen fra SmitfraudFix (C:\rapport.txt).

Tak for svaret:)

Ok, så langt så godt. Nu har jeg fulgt dine anvisninger og her kommer nogle flere log's:

Nu nævner du ikke om jeg skulle lægge hijackthis log'en med, men for en sikkerheds skyld, kommer den med alligevel. Så det er arrangeret i denne rækkefølge: nr. 1) Hijackthis log 2) SmitfraudFix log (fra fejlsikret tilstand) 3) ComboFix log.

1)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:47:04, on 29-10-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\aaaamonc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe
C:\Programmer\Logitech\QuickCam10\QuickCam10.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\LVComSX.exe
C:\Programmer\Logitech\QuickCam10\COCIManager.exe
C:\Programmer\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
C:\WINDOWS\explorer.exe
C:\Programmer\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [SMSERIAL] C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmer\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GameSpot Download Manager.lnk = C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmer\Fælles filer\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Network DDE DSDM NetDDEdsdmdmadmin (NetDDEdsdmdmadmin) - Unknown owner - C:\WINDOWS\system32\aaaamonc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 10795 bytes

2)

SmitFraudFix v2.242

Scan done at 14:32:52,20, 29-10-2007
Run from C:\Documents and Settings\Administrator\Skrivebord\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1      localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ld???.tmp Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CCS\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CS1\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CS2\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: DhcpNameServer=212.76.224.172 82.216.111.122 82.216.111.121 82.216.111.123
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: DhcpNameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer=85.255.115.38,85.255.112.152
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.115.38 85.255.112.152
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.115.38 85.255.112.152
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.196.45 154.15.250.130 154.15.250.134
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.115.38 85.255.112.152


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

3)

ComboFix 07-10-28.2 - Administrator 2007-10-29 14:43:23.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1030.18.1503 [GMT 1:00]
Running from: C:\Documents and Settings\Administrator\Skrivebord\ComboFix.exe
.

(((((((((((((((((((((((((  Files Created from 2007-09-28 to 2007-10-29  )))))))))))))))))))))))))))))))
.

2007-10-29 14:33    2,376    --a------    C:\WINDOWS\system32\tmp.reg
2007-10-29 14:22    401,720    --a------    C:\Programmer\HJTrenamed.exe
2007-10-29 01:12    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-10-29 01:12    10,872    --a------    C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-28 23:23    42,496    --a------    C:\tmp03sz.exe
2007-10-28 18:57    51,200    --a------    C:\WINDOWS\NirCmd.exe
2007-10-28 17:32    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2007-10-28 17:32    <DIR>    d--------    C:\Programmer\Fælles filer\Wise Installation Wizard
2007-10-28 17:32    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-10-28 17:32    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2007-10-28 17:24    <DIR>    d--------    C:\Programmer\CCleaner
2007-10-28 13:07    <DIR>    d--------    C:\Documents and Settings\Administrator\.housecall6.6
2007-10-28 01:25    49,664    -r-hs----    C:\WINDOWS\system32\aaaamonc.exe
2007-10-28 01:23    7,168    --a------    C:\Documents and Settings\Administrator\1.exe
2007-10-27 16:15    3,727,720    --a------    C:\WINDOWS\system32\d3dx9_35.dll
2007-10-27 16:15    1,358,192    --a------    C:\WINDOWS\system32\D3DCompiler_35.dll
2007-10-27 16:15    444,776    --a------    C:\WINDOWS\system32\d3dx10_35.dll
2007-10-27 16:12    <DIR>    d--------    C:\Programmer\Electronic Arts
2007-10-27 15:25    <DIR>    d--------    C:\WINDOWS\system32\URTTemp
2007-10-25 22:09    <DIR>    d--------    C:\Programmer\GameSpot
2007-10-20 11:40    <DIR>    d--------    C:\Programmer\Fælles filer\Logitech
2007-10-20 11:39    <DIR>    d--------    C:\Programmer\Logitech
2007-10-20 11:39    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-20 00:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Programmer\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Programmer\Fælles filer\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Skype
2007-10-18 19:41    59,264    --a------    C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-10-18 19:41    59,264    --a--c---    C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-10-18 19:41    48,640    --a------    C:\WINDOWS\system32\drivers\stream.sys
2007-10-18 19:41    48,640    --a--c---    C:\WINDOWS\system32\dllcache\stream.sys
2007-10-18 19:41    31,616    --a------    C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-18 19:41    31,616    --a--c---    C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-09 20:38    <DIR>    d--------    C:\WINDOWS\pss
2007-10-09 20:32    <DIR>    d--------    C:\Programmer\AdVantage
2007-10-09 20:31    <DIR>    d--------    C:\Programmer\Webteh
2007-10-09 20:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\BSplayer Pro
2007-10-09 20:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\BSplayer
2007-10-08 23:33    <DIR>    d--------    C:\Genveje
2007-10-08 23:31    <DIR>    d--------    C:\WEBBANK
2007-10-08 23:04    12,160    --a------    C:\WINDOWS\system32\drivers\mouhid.sys
2007-10-08 23:04    9,600    --a------    C:\WINDOWS\system32\drivers\hidusb.sys
2007-10-08 15:53    <DIR>    d--------    C:\Spil ISO
2007-10-08 15:46    <DIR>    d--------    C:\Documents and Settings\Administrator\cbt
2007-10-08 15:45    <DIR>    d--------    C:\WINDOWS\Sun
2007-10-08 15:45    <DIR>    d--------    C:\Programmer\Java
2007-10-08 15:44    <DIR>    d--------    C:\Programmer\Fælles filer\Java
2007-10-08 15:43    668    --a------    C:\WINDOWS\mozver.dat
2007-10-08 15:42    0    --a------    C:\WINDOWS\nsreg.dat
2007-10-08 15:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-10-08 14:06    <DIR>    d--------    C:\ETUCE
2007-10-08 12:12    <DIR>    d-a------    C:\Microsoft Photo Story 3
2007-10-08 10:27    <DIR>    d--------    C:\Programmer\Broadcom
2007-10-08 10:27    160,256    --a------    C:\WINDOWS\system32\drivers\b57xp32.sys
2007-10-08 10:27    160,256    --a--c---    C:\WINDOWS\system32\dllcache\b57xp32.sys
2007-10-08 00:30    <DIR>    d--------    C:\Video
2007-10-07 22:34    <DIR>    d--------    C:\Programmer\Sierra Entertainment
2007-10-07 18:10    <DIR>    d--------    C:\Programmer\SEGA
2007-10-07 18:04    <DIR>    dr-h-----    C:\Documents and Settings\Administrator\Application Data\SecuROM
2007-10-07 18:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Bioshock
2007-10-07 18:04    107,888    --a------    C:\WINDOWS\system32\CmdLineExt.dll
2007-10-07 17:44    3,497,832    --a------    C:\WINDOWS\system32\d3dx9_34.dll
2007-10-07 17:44    1,124,720    --a------    C:\WINDOWS\system32\D3DCompiler_34.dll
2007-10-07 17:44    443,752    --a------    C:\WINDOWS\system32\d3dx10_34.dll
2007-10-07 17:44    266,088    --a------    C:\WINDOWS\system32\xactengine2_8.dll
2007-10-07 17:44    18,280    --a------    C:\WINDOWS\system32\x3daudio1_2.dll
2007-10-07 16:38    <DIR>    d--------    C:\Programmer\2K Games
2007-10-07 16:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\InstallShield
2007-10-07 15:38    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\InstallShield Installation Information
2007-10-07 15:38    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Firaxis Games
2007-10-07 15:34    2,297,552    --a------    C:\WINDOWS\system32\d3dx9_26.dll
2007-10-07 15:19    <DIR>    d--------    C:\Ordbøger
2007-10-07 15:15    <DIR>    d--------    C:\DANTYSK
2007-10-07 15:14    <DIR>    d--------    C:\Documents and Settings\Administrator\WINDOWS
2007-10-07 15:14    <DIR>    d--------    C:\DANENG
2007-10-07 15:14    398,416    ---------    C:\WINDOWS\system\VBRUN300.DLL
2007-10-07 15:14    80,304    ---------    C:\WINDOWS\system\TWAVBX.DLL
2007-10-07 15:14    35,712    ---------    C:\WINDOWS\system\TWAOPS01.DLL
2007-10-07 15:14    29,696    ---------    C:\WINDOWS\system\WIN32CMI.DLL
2007-10-07 15:14    28,496    ---------    C:\WINDOWS\system\TWARSC01.DLL
2007-10-07 15:14    20,480    ---------    C:\WINDOWS\system\TWAOPS32.DLL
2007-10-07 15:14    19,456    ---------    C:\WINDOWS\system\TWAVER32.EXE
2007-10-07 15:14    7,968    ---------    C:\WINDOWS\system\TWACALL.EXE
2007-10-07 15:14    7,437    ---------    C:\WINDOWS\system\TWADST10.EXE
2007-10-07 15:04    <DIR>    d--------    C:\Programmer\MSBuild
2007-10-07 15:04    <DIR>    d--------    C:\Programmer\Microsoft Works
2007-10-07 15:04    32,592    --a------    C:\WINDOWS\system32\msonpmon.dll
2007-10-07 15:01    <DIR>    d--------    C:\WINDOWS\SHELLNEW
2007-10-07 15:00    <DIR>    dr-h-----    C:\MSOCache
2007-10-07 15:00    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-07 14:56    <DIR>    d--------    C:\MOffice
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\LocalService\Application Data\AVG7
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\avg7
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\AVG7
2007-10-07 14:25    <DIR>    d---s----    C:\Documents and Settings\Administrator\UserData
2007-10-07 14:17    <DIR>    d--------    C:\Programmer\DAEMON Tools
2007-10-07 14:17    223,128    --a------    C:\WINDOWS\system32\drivers\dtscsi.sys
2007-10-07 14:08    642,560    --a------    C:\WINDOWS\system32\drivers\sptd.sys
2007-10-07 14:08    96,256    --a------    C:\WINDOWS\system32\drivers\sptd4125.sys

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-29 13:37    9,231    ----a-w    C:\Programmer\hijackthis.log
2007-10-28 00:25    49,664    --sh--r    C:\WINDOWS\system32\aaaamonc.exe
2007-10-25 21:09    5,806    ----a-w    C:\Programmer\install.log
2007-10-07 19:19    ---------    d-----w    C:\Programmer\Fælles filer\SpeechEngines
2007-10-07 19:19    ---------    d-----w    C:\Programmer\Fælles filer\ODBC
2007-10-07 15:20    163,644    ----a-w    C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-07 12:28    315,392    ----a-w    C:\WINDOWS\HideWin.exe
2007-10-07 11:27    ---------    d-----w    C:\Programmer\microsoft frontpage
2007-10-07 11:25    ---------    d-----w    C:\Programmer\Onlinetjenester
2007-10-07 11:24    ---------    d-----w    C:\Programmer\Fælles filer\Tjenester
2007-10-07 11:24    ---------    d-----w    C:\Programmer\Fælles filer\MSSoap
.

(((((((((((((((((((((((((((((  snapshot@2007-10-28_19.17.02.96  )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-04 14:59:42    380,144    ----a-w    C:\WINDOWS\Downloaded Program Files\sabspx.dll
- 2007-10-07 11:32:06    16,384    ----a-w    C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-10-29 13:41:34    16,384    ----a-w    C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-10-07 11:32:06    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\index.dat
+ 2007-10-29 13:41:34    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\index.dat
- 2007-10-07 11:32:06    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\index.dat
+ 2007-10-29 13:41:34    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-30 12:10:42    10,872    ----a-w    C:\WINDOWS\system32\drivers\AvgAsCln.sys
+ 2005-03-21 10:00:24    4,096    ----a-w    C:\WINDOWS\system32\sabprocenum.sys
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 10:19]
"IntelWireless"="C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 10:17]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 13:49 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-28 18:05]
"nwiz"="nwiz.exe" [2007-04-28 18:05 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 16:31]
"Acrobat Assistant 7.0"="C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 01:12]
"DAEMON Tools"="C:\Programmer\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-24 07:49]
"GrooveMonitor"="C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"LogitechCommunicationsManager"="C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 08:46]
"LogitechQuickCamRibbon"="C:\Programmer\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 09:34]
"!AVG Anti-Spyware"="C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-26 16:53]
"Skype"="C:\Programmer\Skype\Phone\Skype.exe" [2007-09-13 12:31]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-10-28 18:50]

C:\Documents and Settings\Administrator\Menuen Start\Programmer\Start\
GameSpot Download Manager.lnk - C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe [2007-10-13 01:34:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
"C:\Programmer\AdVantage\AdVantage.exe"

R2 NetDDEdsdmdmadmin;Network DDE DSDM NetDDEdsdmdmadmin;C:\WINDOWS\system32\aaaamonc.exe srv

.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 14:45:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\ntos.exe 381952 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
.
Completion time: 2007-10-29 14:46:27
.
    --- E O F ---

Kopiér indholdet mellem de stiplede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt.
Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

-------------------------

File::
C:\tmp03sz.exe
C:\WINDOWS\system32\aaaamonc.exe
C:\Documents and Settings\Administrator\1.exe
C:\WINDOWS\system32\ntos.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"=-
-------------------------

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen. - http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Kopier indholdet af Combofix.txt her ind sammen med en ny hijackthis log

Hurraaa, Det virkede! Popups er væk: Det var virkelig en lifesaver - tusind tak for hjælpen! :D

Eh, nu ville jeg jo gerne give dig god karma og point, men der er noget der ikke vil samarbejde! Er det fordi jeg kommenterede dit svar før jeg accepterede det? Eller er der noget jeg helt overser?

Nå, men så kan jeg vel lige prøve at lægge de logs der kom ud af det op...

ComboFix 07-10-28.2 - Administrator 2007-10-29 15:34:15.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1030.18.1463 [GMT 1:00]
Running from: C:\Documents and Settings\Administrator\Skrivebord\Anti Spyware\Combifix\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Skrivebord\Anti Spyware\Combifix\CFScript.txt
* Created a new restore point

FILE::
C:\Documents and Settings\Administrator\1.exe
C:\tmp03sz.exe
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\aaaamonc.exe
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\1.exe
C:\tmp03sz.exe
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
C:\WINDOWS\system32\aaaamonc.exe
C:\WINDOWS\system32\wsnpoem

.
(((((((((((((((((((((((((  Files Created from 2007-09-28 to 2007-10-29  )))))))))))))))))))))))))))))))
.

2007-10-29 14:33    2,376    --a------    C:\WINDOWS\system32\tmp.reg
2007-10-29 14:22    401,720    --a------    C:\Programmer\HJTrenamed.exe
2007-10-29 01:12    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-10-29 01:12    10,872    --a------    C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-28 18:57    51,200    --a------    C:\WINDOWS\NirCmd.exe
2007-10-28 17:32    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2007-10-28 17:32    <DIR>    d--------    C:\Programmer\Fælles filer\Wise Installation Wizard
2007-10-28 17:32    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-10-28 17:32    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2007-10-28 17:24    <DIR>    d--------    C:\Programmer\CCleaner
2007-10-28 13:07    <DIR>    d--------    C:\Documents and Settings\Administrator\.housecall6.6
2007-10-27 16:15    3,727,720    --a------    C:\WINDOWS\system32\d3dx9_35.dll
2007-10-27 16:15    1,358,192    --a------    C:\WINDOWS\system32\D3DCompiler_35.dll
2007-10-27 16:15    444,776    --a------    C:\WINDOWS\system32\d3dx10_35.dll
2007-10-27 16:12    <DIR>    d--------    C:\Programmer\Electronic Arts
2007-10-27 15:25    <DIR>    d--------    C:\WINDOWS\system32\URTTemp
2007-10-25 22:09    <DIR>    d--------    C:\Programmer\GameSpot
2007-10-20 11:40    <DIR>    d--------    C:\Programmer\Fælles filer\Logitech
2007-10-20 11:39    <DIR>    d--------    C:\Programmer\Logitech
2007-10-20 11:39    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-20 00:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Programmer\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Programmer\Fælles filer\Skype
2007-10-20 00:03    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Skype
2007-10-18 19:41    59,264    --a------    C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-10-18 19:41    59,264    --a--c---    C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-10-18 19:41    48,640    --a------    C:\WINDOWS\system32\drivers\stream.sys
2007-10-18 19:41    48,640    --a--c---    C:\WINDOWS\system32\dllcache\stream.sys
2007-10-18 19:41    31,616    --a------    C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-18 19:41    31,616    --a--c---    C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-09 20:38    <DIR>    d--------    C:\WINDOWS\pss
2007-10-09 20:32    <DIR>    d--------    C:\Programmer\AdVantage
2007-10-09 20:31    <DIR>    d--------    C:\Programmer\Webteh
2007-10-09 20:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\BSplayer Pro
2007-10-09 20:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\BSplayer
2007-10-08 23:33    <DIR>    d--------    C:\Genveje
2007-10-08 23:31    <DIR>    d--------    C:\WEBBANK
2007-10-08 23:04    12,160    --a------    C:\WINDOWS\system32\drivers\mouhid.sys
2007-10-08 23:04    9,600    --a------    C:\WINDOWS\system32\drivers\hidusb.sys
2007-10-08 15:53    <DIR>    d--------    C:\Spil ISO
2007-10-08 15:46    <DIR>    d--------    C:\Documents and Settings\Administrator\cbt
2007-10-08 15:45    <DIR>    d--------    C:\WINDOWS\Sun
2007-10-08 15:45    <DIR>    d--------    C:\Programmer\Java
2007-10-08 15:44    <DIR>    d--------    C:\Programmer\Fælles filer\Java
2007-10-08 15:43    668    --a------    C:\WINDOWS\mozver.dat
2007-10-08 15:42    0    --a------    C:\WINDOWS\nsreg.dat
2007-10-08 15:31    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-10-08 14:06    <DIR>    d--------    C:\ETUCE
2007-10-08 12:12    <DIR>    d-a------    C:\Microsoft Photo Story 3
2007-10-08 10:27    <DIR>    d--------    C:\Programmer\Broadcom
2007-10-08 10:27    160,256    --a------    C:\WINDOWS\system32\drivers\b57xp32.sys
2007-10-08 10:27    160,256    --a--c---    C:\WINDOWS\system32\dllcache\b57xp32.sys
2007-10-08 00:30    <DIR>    d--------    C:\Video
2007-10-07 22:34    <DIR>    d--------    C:\Programmer\Sierra Entertainment
2007-10-07 18:10    <DIR>    d--------    C:\Programmer\SEGA
2007-10-07 18:04    <DIR>    dr-h-----    C:\Documents and Settings\Administrator\Application Data\SecuROM
2007-10-07 18:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Bioshock
2007-10-07 18:04    107,888    --a------    C:\WINDOWS\system32\CmdLineExt.dll
2007-10-07 17:44    3,497,832    --a------    C:\WINDOWS\system32\d3dx9_34.dll
2007-10-07 17:44    1,124,720    --a------    C:\WINDOWS\system32\D3DCompiler_34.dll
2007-10-07 17:44    443,752    --a------    C:\WINDOWS\system32\d3dx10_34.dll
2007-10-07 17:44    266,088    --a------    C:\WINDOWS\system32\xactengine2_8.dll
2007-10-07 17:44    18,280    --a------    C:\WINDOWS\system32\x3daudio1_2.dll
2007-10-07 16:38    <DIR>    d--------    C:\Programmer\2K Games
2007-10-07 16:04    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\InstallShield
2007-10-07 15:38    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\InstallShield Installation Information
2007-10-07 15:38    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Firaxis Games
2007-10-07 15:34    2,297,552    --a------    C:\WINDOWS\system32\d3dx9_26.dll
2007-10-07 15:19    <DIR>    d--------    C:\Ordbøger
2007-10-07 15:15    <DIR>    d--------    C:\DANTYSK
2007-10-07 15:14    <DIR>    d--------    C:\Documents and Settings\Administrator\WINDOWS
2007-10-07 15:14    <DIR>    d--------    C:\DANENG
2007-10-07 15:14    398,416    ---------    C:\WINDOWS\system\VBRUN300.DLL
2007-10-07 15:14    80,304    ---------    C:\WINDOWS\system\TWAVBX.DLL
2007-10-07 15:14    35,712    ---------    C:\WINDOWS\system\TWAOPS01.DLL
2007-10-07 15:14    29,696    ---------    C:\WINDOWS\system\WIN32CMI.DLL
2007-10-07 15:14    28,496    ---------    C:\WINDOWS\system\TWARSC01.DLL
2007-10-07 15:14    20,480    ---------    C:\WINDOWS\system\TWAOPS32.DLL
2007-10-07 15:14    19,456    ---------    C:\WINDOWS\system\TWAVER32.EXE
2007-10-07 15:14    7,968    ---------    C:\WINDOWS\system\TWACALL.EXE
2007-10-07 15:14    7,437    ---------    C:\WINDOWS\system\TWADST10.EXE
2007-10-07 15:04    <DIR>    d--------    C:\Programmer\MSBuild
2007-10-07 15:04    <DIR>    d--------    C:\Programmer\Microsoft Works
2007-10-07 15:04    32,592    --a------    C:\WINDOWS\system32\msonpmon.dll
2007-10-07 15:01    <DIR>    d--------    C:\WINDOWS\SHELLNEW
2007-10-07 15:00    <DIR>    dr-h-----    C:\MSOCache
2007-10-07 15:00    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-07 14:56    <DIR>    d--------    C:\MOffice
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\LocalService\Application Data\AVG7
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\avg7
2007-10-07 14:51    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\AVG7
2007-10-07 14:25    <DIR>    d---s----    C:\Documents and Settings\Administrator\UserData
2007-10-07 14:17    <DIR>    d--------    C:\Programmer\DAEMON Tools
2007-10-07 14:17    223,128    --a------    C:\WINDOWS\system32\drivers\dtscsi.sys
2007-10-07 14:08    642,560    --a------    C:\WINDOWS\system32\drivers\sptd.sys
2007-10-07 14:08    96,256    --a------    C:\WINDOWS\system32\drivers\sptd4125.sys
2007-10-07 14:06    <DIR>    d--------    C:\Programmer\Fælles filer\Adobe Systems Shared
2007-10-07 14:06    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-10-07 14:05    <DIR>    d--------    C:\Programmer\Fælles filer\Adobe

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-29 13:47    10,797    ----a-w    C:\Programmer\hijackthis.log
2007-10-25 21:09    5,806    ----a-w    C:\Programmer\install.log
2007-10-07 19:19    ---------    d-----w    C:\Programmer\Fælles filer\SpeechEngines
2007-10-07 19:19    ---------    d-----w    C:\Programmer\Fælles filer\ODBC
2007-10-07 15:20    163,644    ----a-w    C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-07 12:28    315,392    ----a-w    C:\WINDOWS\HideWin.exe
2007-10-07 11:27    ---------    d-----w    C:\Programmer\microsoft frontpage
2007-10-07 11:25    ---------    d-----w    C:\Programmer\Onlinetjenester
2007-10-07 11:24    ---------    d-----w    C:\Programmer\Fælles filer\Tjenester
2007-10-07 11:24    ---------    d-----w    C:\Programmer\Fælles filer\MSSoap
.

(((((((((((((((((((((((((((((  snapshot@2007-10-28_19.17.02.96  )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-04 14:59:42    380,144    ----a-w    C:\WINDOWS\Downloaded Program Files\sabspx.dll
- 2007-10-07 11:32:06    16,384    ----a-w    C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-10-29 13:41:34    16,384    ----a-w    C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-10-07 11:32:06    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\index.dat
+ 2007-10-29 13:41:34    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\index.dat
- 2007-10-07 11:32:06    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\index.dat
+ 2007-10-29 13:41:34    32,768    ----a-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\index.dat
+ 2005-03-21 10:00:24    4,096    ----a-w    C:\WINDOWS\system32\sabprocenum.sys
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 10:19]
"IntelWireless"="C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 10:17]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 13:49 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-28 18:05]
"nwiz"="nwiz.exe" [2007-04-28 18:05 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 16:31]
"Acrobat Assistant 7.0"="C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 01:12]
"DAEMON Tools"="C:\Programmer\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-24 07:49]
"GrooveMonitor"="C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"LogitechCommunicationsManager"="C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 08:46]
"LogitechQuickCamRibbon"="C:\Programmer\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 09:34]
"!AVG Anti-Spyware"="C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-26 16:53]
"Skype"="C:\Programmer\Skype\Phone\Skype.exe" [2007-09-13 12:31]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-10-28 18:50]

C:\Documents and Settings\Administrator\Menuen Start\Programmer\Start\
GameSpot Download Manager.lnk - C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe [2007-10-13 01:34:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
"C:\Programmer\AdVantage\AdVantage.exe"

S2 NetDDEdsdmdmadmin;Network DDE DSDM NetDDEdsdmdmadmin;C:\WINDOWS\system32\aaaamonc.exe srv

.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 15:39:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-29 15:41:08 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-29 14:46
.
    --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:09:49, on 29-10-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe
C:\Programmer\Logitech\QuickCam10\QuickCam10.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\LVComSX.exe
C:\Programmer\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programmer\Logitech\QuickCam10\COCIManager.exe
C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
C:\Programmer\Skype\Plugin Manager\skypePM.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/ig?hl=da
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [SMSERIAL] C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmer\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GameSpot Download Manager.lnk = C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmer\Fælles filer\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Network DDE DSDM NetDDEdsdmdmadmin (NetDDEdsdmdmadmin) - Unknown owner - C:\WINDOWS\system32\aaaamonc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 10773 bytes

Ah, nu forstår jeg! Det var slet ikke et svar du gav, men en kommentar... Det køre lidt langsomt...: det er jo også mandag!

Ja, vi er der næsten, mangler lige lidt..

Hent FixWareout :
http://downloads.subratam.org/Fixwareout.exe

2. Gem filen på dit Skrivebord og dobbeltklik på den. Klik Next -> Install og check, at der er et flueben i "Run fixit" - klik herefter på Finish. Fixet vil nu starte, og du skal blot følge instruktionerne. Du vil blive bedt om at genstarte din computer - gør venligst det. Genstarten vil tage lidt længere tid end normalt...

3. Når dit system genstarter skal du fortsat følge den vejledning, der gives på skærmen. Når fixet er færdigt vil HijackThis starte automatisk.

Maksimer HijackThis vinduet. Luk alle andre vinduer. Sæt et flueben ved disse linier, og klik FIX CHECKED:

O17 - HKLM\System\CCS\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{78075C20-B0C2-4132-B6CF-55D8B6183D54}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{82CF603E-4246-4F23-9026-9DC0CEBB777C}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.38 85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\..\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}: NameServer = 85.255.115.38,85.255.112.152


4. Luk HJT og klik på OK for at fortsætte. Genstart din computer, og kopier indholdet af C:\fixwareout\report.txt herind sammen med en frisk HijackThis log, og fortæl hvordan computeren kører.

Jeg har nu gennemført første halvdel, men de omtalte filer figurerer ikke på hijackthis loggen - jeg har lagt den nyeste log fra hijackthis op efter fixwareout loggen.
Hijackthis startede heller ikke automatisk efter comp genstart, men der kom en besked om at jeg skulle kopiere loggen til min forum hjælper og den kommer her:

Username "Administrator" - 29-10-2007 18:02:13 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.115.38 85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{78075C20-B0C2-4132-B6CF-55D8B6183D54}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{82CF603E-4246-4F23-9026-9DC0CEBB777C}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D076084D-20BD-435B-A0A5-0AD3D5FC1B06}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}
"nameserver"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{23905058-CDAD-4D8D-93E9-B5F14FEA2D0A}
"DhcpNameServer"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{72EA3C47-10FF-4105-9D3D-3C5275AE272A}
"DhcpNameServer"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{82CF603E-4246-4F23-9026-9DC0CEBB777C}
"DhcpNameServer"="85.255.115.38,85.255.112.152" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F9EED0BE-CAFC-41E0-87B3-80B29A009C60}
"DhcpNameServer"="85.255.115.38,85.255.112.152" <Value cleared.

DNS Resolver Cache blev tømt.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\_r "}2FFFC0986FEF-D5BA-7AE4-1BD5-BBEF5A16{"  Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\_r "}A60EF487AC53-78EA-75D4-0139-584A7F4A{"  Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\_r "}E85E2F9FB80A-308B-9854-4107-A2DDA3C1{"  Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\_r "}27BD4F150F14-B748-50D4-2539-F8FDA420{"  Deleted
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"IntelZeroConfig"="\"C:\\Programmer\\Intel\\Wireless\\bin\\ZCfgSvc.exe\""
"IntelWireless"="\"C:\\Programmer\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"RTHDCPL"="RTHDCPL.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /installquiet /keeploaded /nodetect"
"SMSERIAL"="C:\\Programmer\\Motorola\\SMSERIAL\\sm56hlpr.exe"
"Acrobat Assistant 7.0"="\"C:\\Programmer\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\""
"DAEMON Tools"="\"C:\\Programmer\\DAEMON Tools\\daemon.exe\" -lang 1033"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"GrooveMonitor"="\"C:\\Programmer\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
"SunJavaUpdateSched"="\"C:\\Programmer\\Java\\jre1.6.0_03\\bin\\jusched.exe\""
"LogitechCommunicationsManager"="\"C:\\Programmer\\Fælles filer\\Logitech\\LComMgr\\Communications_Helper.exe\""
"LogitechQuickCamRibbon"="\"C:\\Programmer\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide"
"!AVG Anti-Spyware"="\"C:\\Programmer\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Skype"="\"C:\\Programmer\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"SUPERAntiSpyware"="C:\\Programmer\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:19:30, on 29-10-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe
C:\Programmer\Logitech\QuickCam10\QuickCam10.exe
C:\Programmer\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\Logitech\LComMgr\LVComSX.exe
C:\Programmer\Logitech\QuickCam10\COCIManager.exe
C:\Programmer\Skype\Plugin Manager\skypePM.exe
C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\HJTrenamed.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/ig?hl=da
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [SMSERIAL] C:\Programmer\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmer\Fælles filer\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmer\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GameSpot Download Manager.lnk = C:\Programmer\GameSpot\GameSpotDownloadManager_Win32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmer\Fælles filer\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Network DDE DSDM NetDDEdsdmdmadmin (NetDDEdsdmdmadmin) - Unknown owner - C:\WINDOWS\system32\aaaamonc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 9546 bytes

Så tog fixet dem alle sammen, derfor var der ikke nogen i hijackthis loggen, så det er godt...

Så ser det bedre ud..

Hjalp kuren??

Kør lige trin 5 og 6 herfra: http://www.malwarecheck.dk/forum/viewtopic.php?t=11

Her kan du læse om vores skudsikre sikkerhedspakke: http://www.malwarecheck.dk/forum/viewtopic.php?t=156 .
Hvis du har nogle spørgsmål, så spørger du bare..

Kuren var helt i top og alt ser ud til at funfere perfekt: ingen popups eller andet gøgl.

Det var virkellig en lettelse og en lærerig gennemgang! Nu skal der nok lidt mere end en tilfældig søndags-spy-malware-greyware-bug til at trænge igennem den mur af forsvarsværker jeg har fået installeret og hurra for det:)

Og igen, tusind tak for hjælpen!

Velbekommen og tak for point