Msn virus

http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=29791

Han henviste til denne side og de ting har jeg nu gjort. Kunne ikke få kørt dr web, da det var et købeprogram og brugte AVG i stedet for Ewido.

ogfile of HijackThis v1.99.1
Scan saved at 23:47:45, on 01-06-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmer\Comodo\CBOClean\BOCORE.exe
c:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\PROGRA~1\BITGUARD\FIREWALL\FireSvc.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\FerrariWallpaper\FerrariWP.exe
C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\BitGuard\Firewall\Firewall.Exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmer\UPHClean\uphclean.exe
C:\Programmer\Canon\CAL\CALMAIN.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Marianne\Skrivebord\Alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Det Gode Program - {DB42E355-D1CD-49FC-AB7D-D913D5E401B3} - C:\Programmer\DetGodeProgram\DETGODEPROGRAMREMINDER.DLL
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [FerrariWallpaper] C:\WINDOWS\FerrariWallpaper\FerrariWP.exe
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Empowering Technology.lnk = ?
O4 - Global Startup: BitGuard Personal Firewall.lnk = C:\Programmer\BitGuard\Firewall\Firewall.Exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth-enhed... - c:\Programmer\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: (no name) - {F564794F-9A62-4f4b-96FF-B08DD99C809B} - C:\Programmer\DetGodeProgram\DETGODEPROGRAMREMINDER.DLL
O9 - Extra 'Tools' menuitem: Det Gode Program Home Page - {F564794F-9A62-4f4b-96FF-B08DD99C809B} - C:\Programmer\DetGodeProgram\DETGODEPROGRAMREMINDER.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.praestegaardsskolen.skoleintra.dk
O15 - Trusted Zone: http://forside.skolekom.dk
O15 - Trusted Zone: http://www.skolekom.dk
O15 - Trusted Zone: http://www.spywareterminator.com
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {4445EA6A-9008-40D5-9160-035FDE5214C4} (MultiUpload Class) - http://www.123hjemmeside.dk/builder/pages/Mpu-dk-1-0-0-8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187969322953
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187969287156
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariannehoegh.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.boldesagerskole.skoleintra.dk/Li/_includes/XUpload.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FÆLLES~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BOCore - COMODO - C:\Programmer\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: FirewallService - DanwareSecurity A/S - C:\PROGRA~1\BITGUARD\FIREWALL\FireSvc.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe






Log fra combofix:  AVG, superantispyware fandt intet i fejlsikret tilstand
mboFix 08-06-01.3 - Marianne 2008-06-01 23:35:04.1 - FAT32x86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1030.18.1524 [GMT 2:00]
Running from: C:\Documents and Settings\Marianne\Skrivebord\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\setup.exe
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\Packet.dll
C:\WINDOWS\system32\WanPacket.dll
C:\WINDOWS\system32\wpcap.dll

.
(((((((((((((((((((((((((  Files Created from 2008-05-01 to 2008-06-01  )))))))))))))))))))))))))))))))
.

2008-06-01 22:56 . 2008-06-01 22:56    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2008-06-01 22:53 . 2008-06-01 22:53    <DIR>    d--------    C:\Documents and Settings\Marianne\DoctorWeb
2008-06-01 22:11 . 2008-03-01 14:58    63,488    ---------    C:\WINDOWS\system32\dllcache\icardie.dll
2008-06-01 21:39 . 2008-06-01 22:37    1,355    --a------    C:\WINDOWS\imsins.BAK
2008-05-29 20:23 . 2008-05-29 20:23    <DIR>    d--------    C:\Documents and Settings\New Folder
2008-05-23 18:12 . 2008-05-23 18:12    <DIR>    d--hs----    C:\FOUND.011

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 19:28    94,208    ----a-w    C:\WINDOWS\DUMPe25c.tmp
2008-05-29 18:02    1,246,752    ----a-w    C:\WINDOWS\system32\AutoPartNt.exe
2008-05-04 05:45    94,208    ----a-w    C:\WINDOWS\DUMPebd2.tmp
2008-04-27 09:26    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-27 08:06    ---------    d-----w    C:\Documents and Settings\Marianne\Application Data\SUPERAntiSpyware.com
2008-04-27 08:06    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-20 08:09    1,845,248    ----a-w    C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-20 08:09    1,845,248    ------w    C:\WINDOWS\system32\win32k.sys
2008-03-01 16:28    3,591,680    ----a-w    C:\WINDOWS\system32\dllcache\mshtml.dll
2007-05-06 07:02    138,220    ----a-w    C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat
2007-04-19 11:11    339    ----a-w    C:\Programmer\RegCleanExpert.lnk
.

------- Sigcheck -------

2004-08-27 05:00  14336  46fe2ed518fdfbfd289f014a3078575c    C:\WINDOWS\system32\svchost.exe
2004-08-27 05:00  14336  46fe2ed518fdfbfd289f014a3078575c    C:\WINDOWS\system32\dllcache\svchost.exe

2007-03-08 17:38  577536  4e3d092a2600b8888f1874e7c9a7e0b7    C:\WINDOWS\system32\user32.dll
2007-03-08 17:38  577536  4e3d092a2600b8888f1874e7c9a7e0b7    C:\WINDOWS\system32\dllcache\user32.dll
2007-03-08 17:51  578048  5b48d00db4c1d0c3d3af83a984a13020    C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
2005-03-02 20:20  577024  b0c3b7a16fc7779566843e9ee1912649    C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2005-03-02 20:18  577024  0c1cdb3d46e1eaadf16269fa7dfaf490    C:\WINDOWS\$NtUninstallKB925902$\user32.dll
2004-08-27 05:00  577024  b9730010e7364f87234d23ce0e05f0c3    C:\WINDOWS\$NtUninstallKB890859$\user32.dll

2004-08-27 05:00  82944  3c83a9029bc93e4cdcf7975decfdae5d    C:\WINDOWS\system32\ws2_32.dll
2004-08-27 05:00  82944  3c83a9029bc93e4cdcf7975decfdae5d    C:\WINDOWS\system32\dllcache\ws2_32.dll

2004-08-27 05:00  502272  713ad65b9ff9cee0a43181b442d846eb    C:\WINDOWS\system32\winlogon.exe
2004-08-27 05:00  502272  713ad65b9ff9cee0a43181b442d846eb    C:\WINDOWS\system32\dllcache\winlogon.exe

2004-08-27 05:00  182912  558635d3af1c7546d26067d5d9b6959e    C:\WINDOWS\system32\drivers\ndis.sys
2004-08-27 05:00  182912  558635d3af1c7546d26067d5d9b6959e    C:\WINDOWS\system32\dllcache\ndis.sys

2004-08-27 05:00  29056  4448006b6bc60e6c027932cfc38d6855    C:\WINDOWS\system32\drivers\ip6fw.sys
2004-08-27 05:00  29056  4448006b6bc60e6c027932cfc38d6855    C:\WINDOWS\system32\dllcache\ip6fw.sys

2007-02-28 18:08  2019840  f76416618989f49e8a52988944ea6c65    C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 08:08  2061952  08c79da378870aa75dc87f322ab69cca    C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2005-09-29 20:28  2060032  24e80385392e13e7554372cd6096117a    C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2004-08-27 05:00  2017792  659c696f88e4fd786b4e450fd08e31bd    C:\WINDOWS\$NtUninstallKB896256$\ntkrnlpa.exe
2005-03-02 20:13  2059520  610527b58729660ec06ecc71302e9490    C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2005-09-29 20:28  2018304  bbf20f90b6e43a600b2c02dc3859f0fe    C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe

2007-02-28 18:08  2140160  b74fa7071dd2f090670a68f86c7666bc    C:\WINDOWS\system32\ntoskrnl.exe
2007-02-28 18:08  2184704  e4733821bb00d6d3581e07fb3f58abbe    C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2005-09-29 20:29  2182784  8031758729009a281bcd2728b2d4e554    C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2004-08-27 05:00  2150912  e9e9283182050ebdd28386add2311df3    C:\WINDOWS\$NtUninstallKB896256$\ntoskrnl.exe
2005-03-02 20:13  2182144  1a7cb4ea702393225b2a21e610d3d91a    C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2005-09-29 20:28  2138624  089c0adf44ed30138cd23c994373883b    C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe

2007-06-13 15:22  1034240  91e15a22e62a11014db521fb589b6093    C:\WINDOWS\explorer.exe
2007-06-13 15:22  1034240  91e15a22e62a11014db521fb589b6093    C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 15:10  1034240  9d7a9e7f4a89aa43d108c4e4c153b561    C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-27 05:00  1033216  da77b9561cc9ac54584c86cab36ebf25    C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

2004-08-27 05:00  108032  55bbe54a196b1a9f99ec2e01f4ac1215    C:\WINDOWS\system32\services.exe
2004-08-27 05:00  108032  55bbe54a196b1a9f99ec2e01f4ac1215    C:\WINDOWS\system32\dllcache\services.exe

2004-08-27 05:00  13312  9086126fb5fd15ceb387121506400244    C:\WINDOWS\system32\lsass.exe
2004-08-27 05:00  13312  9086126fb5fd15ceb387121506400244    C:\WINDOWS\system32\dllcache\lsass.exe

2004-08-27 05:00  15360  8289923e26d00213080e3e3d7e219f4c    C:\WINDOWS\system32\ctfmon.exe
2004-08-27 05:00  15360  8289923e26d00213080e3e3d7e219f4c    C:\WINDOWS\system32\dllcache\ctfmon.exe
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.

Jeg fik ikke ikke skrevet, at jeg brugte Ccleaner, før jeg brugte SAS og AVG. Håber nogen vil hjælpe

Jeg ser på den....

Der er umiddelbart ikke spor efter noget 'snavs' ?!?

Lidt generel oprydning ->

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: (no name) - {F564794F-9A62-4f4b-96FF-B08DD99C809B} -
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)

Genstart normalt, kør en ny scanning med hijackthis, og kopier en frisk log herind til tjek.

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Hmmm... Jeg forstår ikke liiiige helt sætningen ->

"En person der er godt kendt med computere fortalte min kone at hun havde fået en msn virus. Der poppede ting op på hans computer selv når hun var offline."

Hmmm... Jeg forstår ikke liiiige helt sætningen -> osv. Han har engang da jeg brugte windows hjulpet os meget med diverse ting. Derfor tog især min kone hans advarsel meget alvorligt.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:38:30, on 02-06-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\FerrariWallpaper\FerrariWP.exe
C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\BitGuard\Firewall\Firewall.Exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmer\Comodo\CBOClean\BOCORE.exe
c:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\PROGRA~1\BITGUARD\FIREWALL\FireSvc.Exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmer\UPHClean\uphclean.exe
C:\Programmer\Canon\CAL\CALMAIN.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Marianne\Lokale indstillinger\Temporary Internet Files\Content.IE5\1S5I0Y3C\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Det Gode Program - {DB42E355-D1CD-49FC-AB7D-D913D5E401B3} - C:\Programmer\DetGodeProgram\DETGODEPROGRAMREMINDER.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [FerrariWallpaper] C:\WINDOWS\FerrariWallpaper\FerrariWP.exe
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Empowering Technology.lnk = ?
O4 - Global Startup: BitGuard Personal Firewall.lnk = C:\Programmer\BitGuard\Firewall\Firewall.Exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth-enhed... - c:\Programmer\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: http://www.praestegaardsskolen.skoleintra.dk
O15 - Trusted Zone: http://forside.skolekom.dk
O15 - Trusted Zone: http://www.skolekom.dk
O15 - Trusted Zone: http://www.spywareterminator.com
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {4445EA6A-9008-40D5-9160-035FDE5214C4} (MultiUpload Class) - http://www.123hjemmeside.dk/builder/pages/Mpu-dk-1-0-0-8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187969322953
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187969287156
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariannehoegh.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.boldesagerskole.skoleintra.dk/Li/_includes/XUpload.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FÆLLES~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BOCore - COMODO - C:\Programmer\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: FirewallService - DanwareSecurity A/S - C:\PROGRA~1\BITGUARD\FIREWALL\FireSvc.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\programmer\fælles filer\logitech\lvmvfm\LVPrcSrv.exe

--
End of file - 8803 bytes

Der poppede ting op på hans computer selv når hun var offline." -----> Måske var dette du ikke forstod. Han sagde at han også blev tilsendt links fra hende f.eks, mens hun var både offline og online.
Håber der er orden på det nu

Der er ikke noget at spore !

"..Han sagde at han også blev tilsendt links fra hende f.eks, mens hun var både offline og online. ..." - det ka' godt ske at 'noget' ude i verden (mis)bruger en andens navn/E-mail til sådan noget!

Der er ikke mere 'snavs' ifølge din Log...

Du er velkommen en anden gang...

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.

Safe Surfing...

--------------

Registreringsdatabase oprydning kan anbefales ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Register]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller NEJ til den.

--------------

Du bør også install M$ ServicePack3 -> http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=da

Vi siger tusind tak for din hjælp.

Jeg har bevidst valgt ikke at installere SP3, da denne computer kører med  AMD cpu, hvor jeg har læst mange steder, at netop det, kan giver problemer med SP3. Måske Mikrosoft har fået orden på det nu ?

... jeg vil mene at M$ har fået styr på dette SP3 / AMD probem - har dog ikke noget 'bevis' for dette lige her og nu...