Her er de 3 logfiler jeg har fundet frem til. Gider du, fromsej, at kigge på dem?
Det skal siges at jeg ingen trusler har fundet med de 4 programmer jeg benyttede.
Logfile of HijackThis v1.99.1
Scan saved at 15:59:21, on 21-03-2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HP\HP Software Update\HPWuSchd.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Documents and Settings\BH\Skrivebord\Cleaners\alternativ.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Media Player Classic - {CE0487CA-8B02-431E-BA63-D38844E020B5} - C:\WINDOWS\ausctv32a.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmer\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203613878608O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ComboFix 08-03-20.5 - BH 2008-03-21 16:00:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.45.1030.18.234 [GMT 1:00]
Running from: C:\Documents and Settings\BH\Skrivebord\Cleaners\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.
2008-03-21 15:30 . 2008-03-21 15:30 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-03-21 15:30 . 2008-03-21 15:30 <DIR> d-------- C:\Documents and Settings\BH\Application Data\SUPERAntiSpyware.com
2008-03-21 15:30 . 2008-03-21 15:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-21 15:27 . 2008-03-21 15:27 <DIR> d-------- C:\Programmer\CCleaner
2008-03-21 14:10 . 2008-03-21 14:10 <DIR> d-------- C:\Programmer\Trend Micro
2008-03-21 13:06 . 2008-03-21 13:06 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-03-21 13:06 . 2008-03-21 13:06 <DIR> d-------- C:\Programmer\Lavasoft
2008-03-21 13:06 . 2008-03-21 13:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-21 13:05 . 2008-03-21 15:30 <DIR> d-------- C:\Programmer\Fælles filer\Wise Installation Wizard
2008-03-21 13:03 . 2008-03-21 12:46 691,545 --a------ C:\WINDOWS\unins000.exe
2008-03-21 13:03 . 2008-03-21 13:03 2,551 --a------ C:\WINDOWS\unins000.dat
2008-03-21 12:45 . 2008-03-21 13:59 <DIR> d-------- C:\Programmer\Spybot - Search & Destroy
2008-03-21 12:45 . 2008-03-21 15:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-21 12:38 . 2002-07-25 11:45 845,584 --a------ C:\WINDOWS\system32\msdxm.ocx
2008-03-21 12:38 . 2002-07-25 11:45 498,960 --a------ C:\WINDOWS\system32\dxmasf.dll
2008-03-21 12:38 . 2002-07-25 11:45 251,904 --a------ C:\WINDOWS\system32\strmdll.dll
2008-03-20 21:00 . 2008-03-20 21:00 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 20:52 . 2008-03-21 12:38 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-03-20 20:39 . 2008-03-20 20:52 <DIR> d-------- C:\WINDOWS\Installationsfiler til Windows Update
2008-03-20 20:38 . 2008-03-20 20:38 <DIR> d-------- C:\WINDOWS\Oversigt
2008-03-20 20:29 . 2008-03-20 20:29 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-19 10:12 . 2008-03-19 10:12 222,208 --a------ C:\WINDOWS\ausctv32a.dll
2008-03-19 10:11 . 2008-03-19 10:12 44 --a------ C:\xmp.bat
2008-03-17 10:58 . 2001-10-04 17:07 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-03-17 10:58 . 2001-10-04 17:07 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-03-01 11:35 . 2008-03-01 11:35 <DIR> d-------- C:\Programmer\Serif
2008-03-01 11:35 . 2008-03-01 11:35 <DIR> d--h----- C:\Programmer\InstallShield Installation Information
2008-03-01 11:35 . 1998-12-08 20:53 212,480 --------- C:\WINDOWS\pcdlib32.dll
2008-03-01 11:34 . 2008-03-01 11:34 <DIR> d-------- C:\Programmer\Fælles filer\InstallShield
2008-02-21 19:13 . 2008-02-21 19:13 <DIR> d-------- C:\Programmer\Fælles filer\Adobe
2008-02-21 18:17 . 2008-02-21 18:17 <DIR> d--h-c--- C:\WINDOWS\$xpsp1hfm$
2008-02-21 18:17 . 2002-09-21 12:44 24,576 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2008-02-21 18:13 . 2008-02-21 18:13 <DIR> d-------- C:\WINDOWS\system32\bits
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 13:19 --------- d-----w C:\Documents and Settings\BH\Application Data\AVG7
2008-03-20 19:41 --------- d-----w C:\Programmer\Fælles filer\Tjenester
2008-02-19 10:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-18 14:19 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-18 14:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-17 15:52 --------- d-----w C:\Programmer\HP
2008-02-17 15:52 --------- d-----w C:\Programmer\Fælles filer\Hewlett-Packard
2008-02-17 15:50 43,488 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-02-17 15:50 --------- d-----w C:\Programmer\Fælles filer\HP
2008-02-17 15:28 --------- d-----w C:\Programmer\Microsoft.NET
2008-02-17 15:28 --------- d-----w C:\Programmer\Microsoft ActiveSync
2008-02-17 15:21 --------- d-----w C:\Programmer\Intel
2008-02-17 14:58 --------- d-----w C:\Documents and Settings\BH\Application Data\MSN6
2008-02-17 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-02-17 14:23 --------- d-----w C:\Programmer\microsoft frontpage
2008-02-17 14:22 --------- d-----w C:\Programmer\Onlinetjenester
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CE0487CA-8B02-431E-BA63-D38844E020B5}]
2008-03-19 10:12 222208 --a------ C:\WINDOWS\ausctv32a.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-09 12:00 13312]
"MSMSGS"="C:\Programmer\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277]
"SpybotSD TeaTimer"="C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Programmer\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
"HP Component Manager"="C:\Programmer\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-18 15:19 579072]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-09 12:00 13312]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-18 15:19 219136]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
HP Digital Imaging Monitor.lnk - C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24 237568]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-03-21 16:01:45
Windows 5.1.2600 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-21 16:02:07
.
2008-02-21 18:19:51 --- E O F ---
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 03/21/2008 at 03:54 PM
Application Version : 4.0.1154
Core Rules Database Version : 3422
Trace Rules Database Version: 1414
Scan type : Complete Scan
Total Scan Time : 00:16:39
Memory items scanned : 165
Memory threats detected : 0
Registry items scanned : 4206
Registry threats detected : 0
File items scanned : 7463
File threats detected : 0