Spyware-angreb i forbindelse med Panda

... for en go' ordens skyld; stik os/mig en HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis.exe

(Jooo - jeg har 'virus' på hjernen...)

Jeg har kørt en HJT, men kan ikke huske, hvordan jeg får overført resultatet til dig

... står i http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm ...

Jeg fandt ud af det, tror jeg

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:40:49, on 06-03-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
f:\programmer\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
F:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\Explorer.EXE
F:\Programmer\NetProject\scit.exe
F:\Programmer\NetProject\sbmntr.exe
F:\Programmer\NetProject\scm.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE
F:\Programmer\Mouse Driver\MouseDrv.exe
F:\Programmer\Multimedia Combo Set\PS2USBKbdDrv.exe
F:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
F:\WINDOWS\system32\RunDll32.exe
F:\Programmer\AdvancedCleaner Free\UADC.exe
F:\Programmer\AdvancedCleaner Free\UADCcw.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programmer\VirusHeat 4.3\VirusHeat 4.3.exe
F:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
C:\Program Files\WinSpyKiller\WinSpyKiller.exe
F:\Programmer\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\uWDF.exe
F:\Programmer\Internet Explorer\iexplore.exe
F:\EasyPHP\HiJackThis.exe
F:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - F:\Programmer\Helper\1204733157.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\programmer\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Programmer\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - F:\Programmer\NetProject\sbmdl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\programmer\google\googletoolbar4.dll
O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - F:\Programmer\NetProject\wamdl.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [APVXDWIN] "F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CreativeMouse ] F:\Programmer\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessMouse ] F:\Programmer\Multimedia Combo Set\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessKeyboard ] F:\Programmer\Multimedia Combo Set\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [BullGuard] "F:\Programmer\BullGuard Software\BullGuard\bullguard.exe" -boot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirusHeat 4.3] "F:\Programmer\VirusHeat 4.3\VirusHeat 4.3.exe" /h
O4 - HKLM\..\Run: [AdvancedCleaner Free] "F:\Programmer\AdvancedCleaner Free\UADC.exe" /min
O4 - HKLM\..\Run: [UADCDK_2591950470] "F:\Programmer\AdvancedCleaner Free\UADCcw.exe" -c
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [swg] F:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "F:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BullGuard] "F:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] F:\Programmer\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [start] F:\Programmer\NetProject\sbmntr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = F:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchecker/controles/AvDetInst.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O22 - SharedTaskScheduler: dikage - {d4c51fa4-9192-4a9a-8d2a-a0690c92f171} - F:\WINDOWS\system32\lruvqvw.dll
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - Unknown owner - F:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - F:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - f:\programmer\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

--
End of file - 9278 bytes

*SUK* Endnu én i NetProject 'fælden' ... og meget mere 'snavs' ...

---------------------------------------

Afinstaller (Hvis de er der?)
* WinSpyKiller.exe
* AdvancedCleaner Free
* VirusHeat
* AntiSpywareShield
via
[Start][Indstilninger][Kontrolpanel][Tilføj/fjern programmer]

Genstart for at fuldføre afinstalationen...

---------------------------------------

-- Hent Avenger her:
http://swandog46.geekstogo.com/avenger.zip

-- Pak Avenger-programmet ud og dobbeltklik på avenger.exe

-- Sæt en prik i "Input Script Manually" og klik på Luppen - nu dukker der et lille vindue op, hvor du skal kopiere indholdet mellem ~~~~~~~ skrift ind:

~~~~~~~
Folders to delete:
C:\Program Files\WinSpyKiller\
F:\Programmer\VirusHeat 4.3\
F:\Programmer\AdvancedCleaner Free\
F:\Programmer\NetProject\
C:\Program Files\AntiSpywareShield\
~~~~~~~

-- Klik på Trafiklyset i Avenger. Programmet vil opfordre dig til at genstarte computeren straks, hvilket du skal gøre. Programmet vil lukke din computer, slette filerne og starte computeren igen.

-- Efter genstarten vil der dukke et notepad-vindue op, med en log for Avengers handlinger. Den må du gerne lægge ind i dit næste svar.

-- Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.

O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - F:\Programmer\NetProject\sbmdl.dll
O4 - HKLM\..\Run: [VirusHeat 4.3] "F:\Programmer\VirusHeat 4.3\VirusHeat 4.3.exe" /h
O4 - HKLM\..\Run: [AdvancedCleaner Free] "F:\Programmer\AdvancedCleaner Free\UADC.exe" /min
O4 - HKLM\..\Run: [UADCDK_2591950470] "F:\Programmer\AdvancedCleaner Free\UADCcw.exe" -c
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] F:\Programmer\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [start] F:\Programmer\NetProject\sbmntr.exe
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O22 - SharedTaskScheduler: dikage - {d4c51fa4-9192-4a9a-8d2a-a0690c92f171} - F:\WINDOWS\system32\lruvqvw.dll
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - Unknown owner - F:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe (file missing)

Genstart computeren normalt, og lav en ny log med Hijackthis, som du lægger herind sammen med loggen fra Avenger.

(Der _kan_ godt være mere; det tager vi i næste omgang...)


PS: Det er da noget rod med nogle elementer/programmer på C: og andre på F: ???

-- Sæt en prik i "Input Script Manually" og klik på Luppen - nu dukker der et lille vindue op, hvor du skal kopiere indholdet mellem ~~~~~~~ skrift ind:
Jeg får ikke muligheden for at sætte en prik.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at F:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished!  Terminate.

Der er sørme ændret/forbedre i Avenger programmet !!!

Lige en hurtig -> gennemfør HiJackThis proceduren som beskrevet - Genstart - MANUELT slet omtalte mapper - hvis de findes...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:48, on 07-03-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
f:\programmer\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
F:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\Explorer.EXE
F:\Programmer\NetProject\scit.exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE
F:\Programmer\NetProject\scm.exe
F:\Programmer\Mouse Driver\MouseDrv.exe
F:\Programmer\Multimedia Combo Set\PS2USBKbdDrv.exe
F:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
F:\WINDOWS\system32\RunDll32.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\Programmer\MSN Messenger\MsnMsgr.Exe
F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
F:\WINDOWS\system32\uWDF.exe
F:\Documents and Settings\Klaus\Skrivebord\HiJackThis.exe
F:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - F:\Programmer\Helper\1204733157.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\programmer\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Programmer\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\programmer\google\googletoolbar4.dll
O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - F:\Programmer\NetProject\wamdl.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [APVXDWIN] "F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CreativeMouse ] F:\Programmer\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessMouse ] F:\Programmer\Multimedia Combo Set\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessKeyboard ] F:\Programmer\Multimedia Combo Set\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [BullGuard] "F:\Programmer\BullGuard Software\BullGuard\bullguard.exe" -boot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] F:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "F:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BullGuard] "F:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] F:\Programmer\NetProject\scit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = F:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchecker/controles/AvDetInst.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - Unknown owner - F:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - F:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - f:\programmer\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - F:\Programmer\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

--
End of file - 7955 bytes

"nogle elementer/programmer på C: og andre på F: ???" :
Da PCén var ny troede jeg, at det var "smart" at have harddisken opdelt i flere drev.
Jeg har nu kun to tilbage og lville egentlig også gerne have dem lagt sammen, men ved ikke hvordan.

Da Windows ligger på F:\ er der kun en total geninstall for at få det på C:\

HAR du gennemført [06/03-2008 13:26:23] (Undtagen Avenger delen) ???

ja

Start op i fejlsikret tilstand http://www.spywareinfo.dk/#/htm/fejlsikret_tilstand.htm

og slet disse mapper MED indhold:

C:\Program Files\WinSpyKiller\
F:\Programmer\VirusHeat 4.3\
F:\Programmer\AdvancedCleaner Free\
F:\Programmer\NetProject\
C:\Program Files\AntiSpywareShield\

Genstart normalt...

Derefter med HiJackThis 'fixe' disse linier (hvis de er der):

O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - F:\Programmer\NetProject\sbmdl.dll
O4 - HKLM\..\Run: [VirusHeat 4.3] "F:\Programmer\VirusHeat 4.3\VirusHeat 4.3.exe" /h
O4 - HKLM\..\Run: [AdvancedCleaner Free] "F:\Programmer\AdvancedCleaner Free\UADC.exe" /min
O4 - HKLM\..\Run: [UADCDK_2591950470] "F:\Programmer\AdvancedCleaner Free\UADCcw.exe" -c
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKCU\..\Run: [WinSpyKiller] C:\Program Files\WinSpyKiller\WinSpyKiller.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] F:\Programmer\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [start] F:\Programmer\NetProject\sbmntr.exe
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)
O22 - SharedTaskScheduler: dikage - {d4c51fa4-9192-4a9a-8d2a-a0690c92f171} - F:\WINDOWS\system32\lruvqvw.dll
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - Unknown owner - F:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe (file missing)

Genstart normalt og en frisk HiJackThis Log ...

Jeg har besluttet at geninstallere Windows.
TIL karise_larry : Du gjorde en stor indsats for at hjælpe mig, så læg et svar (jeg har øget til max point).
Tak for hjælpen.
Mvh
carlt

Ping...
(Det var et [svar]...)

Men pas på den slags 'snyde' programmer som ovennævnte !!!
http://www.spywarefri.dk/artikler.htm#spywarefjernere

Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Safe Surfing...