Fjerne Lich.exe m.m.

Blev igår hijacked af en virus og kan ikke rigtigt komme af med den. Hvert andet minut popper mit antivirusprogram så op og fortæller at jeg min computer er inficeret af ''Lich.exe''
Jeg kører med AVG antivirus, samt spyware terminator.



Mine logs ser således ud:

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 12:47:26, on 12-06-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
C:\Programmer\CA\eTrust Antivirus\InoRT.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\Programmer\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\services.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Maxtor\OneTouch\utils\Onetouch.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\mHotkey.exe
C:\Programmer\Java\jre1.6.0_06\bin\jusched.exe
C:\Programmer\Home Cinema\PowerDVD\PDVDServ.exe
C:\Programmer\Windows Media Player\WMPNSCFG.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Programmer\OpenVPN\bin\openvpn-gui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Steam\Steam.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\PowerISO\PWRISOVM.EXE
C:\Programmer\KNet Utility\KNet Utility.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programmer\Microsoft Office\Office12\WINWORD.EXE
C:\Programmer\Microsoft Works\WkDStore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\rasphone.exe
C:\Documents and Settings\Thomas\Skrivebord\Mission AntiVira\alternativ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://auth.dtu.dk/dtu/index.jsp?service=https%3a%2f%2fwww.campusnet.dtu.dk%2fcnnet%2flink%2fnag.aspx%3fNagVersion%3dYes
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\services.exe
O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Programmer\KeyScrambler\KeyScramblerIE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programmer\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar4.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programmer\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Programmer\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [openvpn-gui] C:\Programmer\OpenVPN\bin\openvpn-gui.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Programmer\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programmer\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [winlogon] C:\Documents and Settings\Thomas\svchost.exe
O4 - HKLM\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKLM\..\Run: [AntivirusRegistration] "C:\Programmer\CA\Etrust Antivirus\Register.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [K-Net Utility] "C:\Programmer\KNet Utility\KNet Utility.exe" -winstart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Steam] "C:\Programmer\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Programmer\Windows Media Player\WMPNSCFG.exe"
O4 - HKCU\..\Run: [winlogon] C:\Documents and Settings\Thomas\svchost.exe
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: userinit.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Betway Casino - {3063c161-2f7e-4225-ba73-08bc8f64c67e} - C:\Programmer\Betway\Casino\casinogame.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programmer\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Betway.com Poker - {4CBB5C71-1BA0-49ca-93CD-159AF8AA0CC9} - C:\Programmer\Betway\Poker\MPPoker.exe
O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Programmer\KeyScrambler\KeyScramblerIE.dll
O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Programmer\KeyScrambler\KeyScramblerIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Programmer\MANSION\Villa\MANSION.exe
O9 - Extra 'Tools' menuitem: MANSION - {CD03D14B-0EF6-4f5a-BB81-1ECAFFC676AF} - C:\Programmer\MANSION\Villa\MANSION.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130600261343
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.79.2.245:81/activex/AxisCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FLLESF~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\systems.txt
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programmer\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Programmer\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) -  - C:\Programmer\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Programmer\OpenVPN\bin\openvpnserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmer\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Opgavestyring (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\services.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmer\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Programmer\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

________________________________________________

For combofix:

ComboFix 08-06-10.5 - Thomas 2008-06-12 12:51:12.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1030.18.417 [GMT 2:00]
Running from: C:\Documents and Settings\Thomas\Skrivebord\Mission AntiVira\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\ftp34.dll
C:\Documents and Settings\Administrator\svchost.exe
C:\Documents and Settings\LocalService\ftp34.dll
C:\Documents and Settings\LocalService\svchost.exe
C:\Documents and Settings\Thomas\ftp34.dll
C:\Documents and Settings\Thomas\svchost.exe
C:\Documents and Settings\Thomas1\ftp34.dll
C:\Documents and Settings\Thomas1\svchost.exe
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\index.html
C:\WINDOWS\system32\drivers\services.exe
C:\WINDOWS\system32\sft.res
O:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_Schedule
-------\Service_Schedule


(((((((((((((((((((((((((  Files Created from 2008-05-12 to 2008-06-12  )))))))))))))))))))))))))))))))
.

2008-06-12 12:30 . 2008-06-12 12:30    <DIR>    d--------    C:\Programmer\CCleaner
2008-06-12 12:00 . 2008-06-12 12:46    <DIR>    d--------    C:\Programmer\uTorrent
2008-06-12 12:00 . 2008-06-12 12:46    <DIR>    d--------    C:\Documents and Settings\Thomas\Application Data\uTorrent
2008-06-12 10:32 . 2008-06-12 11:19    <DIR>    d--------    C:\Documents and Settings\Thomas1\Application Data\BitTorrent
2008-06-12 10:29 . 2008-06-12 10:29    0    --a------    C:\Documents and Settings\Thomas1\Application Data\wklnhst.dat
2008-06-12 10:24 . 2008-06-12 10:24    <DIR>    d--------    C:\Documents and Settings\Thomas1\Application Data\AVG7
2008-06-12 10:19 . 2005-10-29 17:37    <DIR>    d---s----    C:\Documents and Settings\Thomas1\UserData
2008-06-12 10:19 . 2008-06-12 10:31    <DIR>    d--------    C:\Documents and Settings\Thomas1\Skrivebord
2008-06-12 10:19 . 2005-10-20 09:08    <DIR>    d--h-----    C:\Documents and Settings\Thomas1\Skabeloner
2008-06-12 10:19 . 2005-10-20 02:05    <DIR>    d--h-----    C:\Documents and Settings\Thomas1\Printere
2008-06-12 10:19 . 2005-10-20 02:05    <DIR>    dr-------    C:\Documents and Settings\Thomas1\Menuen Start
2008-06-12 10:19 . 2008-06-12 10:28    <DIR>    d--h-----    C:\Documents and Settings\Thomas1\Lokale indstillinger
2008-06-12 10:19 . 2008-06-12 10:21    <DIR>    dr-------    C:\Documents and Settings\Thomas1\Foretrukne
2008-06-12 10:19 . 2008-06-12 10:21    <DIR>    dr-------    C:\Documents and Settings\Thomas1\Dokumenter
2008-06-12 10:19 . 2005-10-30 16:12    <DIR>    d--------    C:\Documents and Settings\Thomas1\Application Data\CyberLink
2008-06-12 10:19 . 2005-10-20 02:05    <DIR>    d--h-----    C:\Documents and Settings\Thomas1\Andre computere
2008-06-12 10:19 . 2008-06-12 12:54    <DIR>    d--------    C:\Documents and Settings\Thomas1
2008-06-12 09:54 . 2008-06-12 10:00    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\BitTorrent
2008-06-12 03:13 . 2008-06-12 12:00    <DIR>    d--------    C:\Programmer\BitTorrent
2008-06-12 02:49 . 2008-06-12 02:49    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Azureus
2008-06-12 02:48 . 2008-06-12 09:02    <DIR>    d--------    C:\Programmer\Azureus
2008-06-12 02:48 . 2008-06-12 02:48    <DIR>    d--------    C:\Programmer\AskSBar
2008-06-12 02:48 . 2008-06-12 09:02    <DIR>    d--------    C:\Documents and Settings\Thomas\Application Data\Azureus
2008-06-11 16:03 . 2008-06-12 02:34    <DIR>    d--------    C:\Programmer\Windows Live Safety Center
2008-06-11 14:28 . 2008-06-12 10:18    <DIR>    d--------    C:\Programmer\Spyware Terminator
2008-06-11 14:28 . 2008-06-12 10:19    <DIR>    d--------    C:\Documents and Settings\Thomas\Application Data\Spyware Terminator
2008-06-11 14:28 . 2008-06-12 10:13    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-11 14:28 . 2008-06-11 14:28    141,312    --a------    C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-06-11 13:53 . 2008-04-14 17:53    272,256    ---------    C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 13:53 . 2008-04-14 17:53    272,256    -----c---    C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-11 13:49 . 2008-06-11 13:49    <DIR>    d--------    C:\Programmer\Panda Security
2008-06-11 13:16 . 2008-06-11 13:16    <DIR>    d--------    C:\Program Files
2008-06-11 12:10 . 2008-06-11 14:16    160,256    --a------    C:\WINDOWS\system32\blackster.scr
2008-06-01 21:54 . 2008-06-01 21:54    11,776    --a------    C:\WINDOWS\system32\78.dat
2008-06-01 21:54 . 2008-06-01 21:54    6,656    --a------    C:\WINDOWS\system32\319.dat
2008-06-01 21:54 . 2008-06-01 21:54    139    --a------    C:\WINDOWS\system32\21.dat
2008-05-25 11:59 . 2007-03-12 16:42    3,495,784    --a------    C:\WINDOWS\system32\d3dx9_33.dll
2008-05-20 01:03 . 2008-05-20 01:03    55,336    --a------    C:\acadminidump.dmp

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 11:02    4,608    ----a-w    C:\Documents and Settings\Thomas\ftp34.dll
2008-06-12 11:01    ---------    d-----w    C:\Programmer\Steam
2008-06-12 10:42    ---------    d-----w    C:\Programmer\SUPERAntiSpyware
2008-06-12 01:11    ---------    d-----w    C:\Programmer\Java
2008-06-11 20:14    ---------    d-----w    C:\Programmer\TVUPlayer
2008-06-11 19:04    ---------    d-----w    C:\Documents and Settings\Thomas\Application Data\AVG7
2008-06-11 11:33    ---------    d-----w    C:\Programmer\SpywareBlaster
2008-06-11 10:49    5,594    ----a-w    C:\WINDOWS\system32\tmp.reg
2008-06-11 09:41    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-09 23:35    47,602    ----a-w    C:\Documents and Settings\Thomas\Application Data\wklnhst.dat
2008-06-09 15:45    ---------    d---a-w    C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-09 15:45    ---------    d-----w    C:\Programmer\Poker Tracker V2
2008-06-08 20:26    ---------    d-----w    C:\Programmer\PokerStars
2008-06-05 13:22    ---------    d-----w    C:\Programmer\Poker Grapher
2008-05-30 16:29    ---------    d-----w    C:\Programmer\LimeWire
2008-05-25 21:23    ---------    d-----w    C:\Programmer\Full Tilt Poker
2008-05-18 15:09    ---------    d--h--w    C:\Programmer\InstallShield Installation Information
2008-05-18 15:07    ---------    d-----w    C:\Programmer\Google
2008-05-08 12:28    202,752    ----a-w    C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16    1,291,776    ----a-w    C:\WINDOWS\system32\quartz.dll
2008-05-03 05:37    ---------    d-----w    C:\Programmer\Safari
2008-05-03 05:36    ---------    d-----w    C:\Programmer\Apple Software Update
2008-04-23 07:20    826,368    ----a-w    C:\WINDOWS\system32\wininet.dll
2008-04-18 19:41    ---------    d-----w    C:\Documents and Settings\Thomas\Application Data\LimeWire
2008-04-18 16:28    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Absolutist
2008-04-13 13:51    ---------    d-----w    C:\Programmer\KeyScrambler
2008-03-20 08:09    1,845,248    ----a-w    C:\WINDOWS\system32\win32k.sys
2007-04-16 15:54    22,016    ----a-w    C:\Documents and Settings\Thomas\svchost.exe
2006-05-04 11:30    79,936    ----a-w    C:\Documents and Settings\Thomas\Application Data\GDIPFONTCACHEV1.DAT
2005-10-30 10:57    8    --sh--r    C:\WINDOWS\system32\C182B8F083.sys
2005-10-30 10:57    4,704    --sha-w    C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Programmer\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-06-12 02:48 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Programmer\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-06-12 02:48 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"K-Net Utility"="C:\Programmer\KNet Utility\KNet Utility.exe" [2004-12-07 14:56 495678]
"msnmsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 02:52 68856]
"DAEMON Tools"="C:\Programmer\DAEMON Tools\daemon.exe" [2007-09-18 16:16 171464]
"Steam"="C:\Programmer\Steam\Steam.exe" [2008-03-28 02:13 1271032]
"WMPNSCFG"="C:\Programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 11:30 204288]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" [2007-04-16 17:54 22016]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 14:00 15360]
"winlogon"="C:\Documents and Settings\Thomas\svchost.exe" [2007-04-16 17:54 22016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-18 16:20 14820864 C:\WINDOWS\RTHDCPL.EXE]
"CmUCRRun"="C:\WINDOWS\system32\CmUCReye.exe" [2005-08-04 20:55 237568]
"CHotkey"="mHotkey.exe" [2004-06-04 06:07 549376 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2003-07-22 07:28 5577216 C:\WINDOWS\CNYHKey.exe]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-27 14:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-27 14:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-27 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-27 14:00 455168]
"RemoteControl"="C:\Programmer\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-27 14:00 33280 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-06-29 01:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"openvpn-gui"="C:\Programmer\OpenVPN\bin\openvpn-gui.exe" [2005-03-29 22:26 98816]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"MaxtorOneTouch"="C:\Programmer\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-27 16:04 712704]
"GrooveMonitor"="C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016]
"PWRISOVM.EXE"="C:\Programmer\PowerISO\PWRISOVM.EXE" [2006-11-06 10:27 200704]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-24 22:11 579584]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-27 14:00 33280 C:\WINDOWS\system32\rundll32.exe]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" [2007-04-16 17:54 22016]
"AntivirusRegistration"="C:\Programmer\CA\Etrust Antivirus\Register.exe" [2005-08-22 23:05 258048]
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"winlogon"="C:\Documents and Settings\Thomas\svchost.exe" [2007-04-16 17:54 22016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-27 14:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-28 02:04 219136]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" [2007-04-16 17:54 22016]
"winlogon"="C:\Documents and Settings\LocalService\svchost.exe" [ ]

C:\Documents and Settings\Administrator\Menuen Start\Programmer\Start\
userinit.exe [2007-04-16 17:54:25 22016]

C:\Documents and Settings\Thomas1\Menuen Start\Programmer\Start\
userinit.exe [2007-04-16 17:54:25 22016]

C:\Documents and Settings\Thomas\Menuen Start\Programmer\Start\
userinit.exe [2007-04-16 17:54:25 22016]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Programmer\F‘lles filer\Autodesk Shared\acstart17.exe [2006-03-05 05:43:54 11000]
hp psc 2000 Series.lnk - C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 01:37:10 323646]
hpoddt01.exe.lnk - C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 02:06:58 28672]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\drivers\\services.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"matlabserver"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%ProgramFiles%\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\mIRC\\mirc.exe"=
"C:\\Programmer\\DC++\\DCPlusPlus.exe"=
"C:\\Programmer\\Microsoft Games\\Age of Empires III\\age3.exe"=
"C:\\Programmer\\OpenVPN\\bin\\openvpn.exe"=
"C:\\Programmer\\Maple 10\\jre\\bin\\maple.exe"=
"C:\\Programmer\\Maple 10\\jre\\bin\\java.exe"=
"C:\\Games\\Sports Interactive\\Football Manager 2006\\fm.exe"=
"C:\\Programmer\\Kazaa Lite K++\\KazaaLite.kpp"=
"C:\\Programmer\\BearShare\\BearShare.exe"=
"C:\\Programmer\\Xfire\\Xfire.exe"=
"C:\\Programmer\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Games\\Steam\\SteamApps\\raketmanden\\counter-strike source\\hl2.exe"=
"C:\\Games\\zsneswv1.337r1.06\\ZSNESW.EXE"=
"C:\\Programmer\\PPMate\\PPMate\\ppmate.exe"=
"C:\\Programmer\\TVAnts\\Tvants.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Programmer\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Programmer\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Programmer\\SopCast\\SopCast.exe"=
"C:\\Documents and Settings\\Thomas\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"C:\\Programmer\\Maple 11\\jre\\bin\\maple.exe"=
"C:\\Programmer\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Programmer\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Programmer\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Programmer\\LimeWire\\LimeWire.exe"=
"C:\\Programmer\\Microsoft Office\\Office12\\EXCEL.EXE"=
"C:\\Programmer\\Microsoft Office\\Office12\\WINWORD.EXE"=
"C:\\Programmer\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Programmer\\Steam\\SteamApps\\raketmanden\\counter-strike source\\hl2.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programmer\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"6667:TCP"= 6667:TCP:ut

R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-27 14:00]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-10-17 15:52]
R3 CMISTOR;CMIUCR.SYS CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS [2005-08-04 01:30]
R3 KeyScrambler;KeyScrambler;C:\WINDOWS\system32\drivers\keyscrambler.sys [2008-03-22 23:37]
R3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2004-06-24 03:54]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 16:22:13 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programmer\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-06-09 16:12:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
"2006-04-30 22:22:44 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1138490444.job"
- C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-06-12 07:24:25 C:\WINDOWS\Tasks\WebReg 20080612092425.job"
- C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exeQ/TaskName 20080612092425 /N
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 12:59:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programmer\CA\Etrust Antivirus\InoRpc.exe
C:\Programmer\CA\Etrust Antivirus\InoRT.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\Programmer\Spyware Terminator\sp_rsser.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programmer\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Documents and Settings\Thomas\Menuen Start\Programmer\Start\userinit.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-06-12 13:09:23 - machine was rebooted
ComboFix-quarantined-files.txt  2008-06-12 11:09:13

Pre-Run: 2,606,104,576 byte ledig
Post-Run: 2,671,906,816 byte ledig

274    --- E O F ---    2008-06-11 12:10:45


__________________________________________________________

Jeg kan ikke rigtigt få installeret SUPERantiSpyware, da den beder mig om at afinstallere en ældre version, hvilket ikke findes på min computer.

Håber I kan hjælpe