http://tvstream.ath.cx/ åbner hele tiden når comp starter

Du gør følgende:

1. Gå i start
2. Tryk på Kør
3. Skriv msconfig
4. Gå i menuen start
5. Find det som omhandler Tvstream
6. Fjern krydset ud for elementet
7. Tryk OK
8. Genstart din pc
Og nu skulle det være væk når du starter din pc op fremover.
Ud over dette skal du gå i din installerede programmer oversigt,
og se om programmet ligger der for så skal du også slette det der.
Det gør du igennem dit kontrolpanel >> fjern eller tilføj programmer på din computer.

Venlig hilsen

svingeren
www. svingeren.dk

Der _kan_ jo også være andre Uønskede elemeneter ->

... for en go' ordens skyld; stik os/mig en HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

(Jooo - jeg har 'virus' på hjernen...)

------------------

og hvordan er det nu lige jeg bruger det?
hvad skal være lukket og hvad skal være åbent og kan det køres direkte fra skrivebordet eller skal det ind i en mappe på skrivebordet?
jeg er ikke en særlig stor haj til comp... :-D

1) Helst ind i en mappe du STENSIKKERT kan finde igen (derfor "skrivebordet" !)
2) Under 'kørsel' bør alle andre programmer - mail, messenger, Internet, ...) IKKE være igang...)

her er loggen:-)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:52, on 22-06-2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Ranfelt Pedersen\Desktop\HiJackThis.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Ranfelt Pedersen\Desktop\hijackthis\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKLM\..\Policies\Explorer\Run: [ati2sgav] "C:\Windows\system32\ati2sgav.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-21-902321283-3628065227-2548032459-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Liv Ranfelt Pedersen')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send billede til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send siden til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.danskebank.dk
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.dk/SnapfishActivia.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MLServ - formessengers.com - C:\Program Files\tetrainstallprint\mlserv.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 10812 bytes

men kan ikke finde noget i menuen start der omhandler tvstream? heller ikke når jeg søger kun en midlertidig internet fil

Klik på Start->Kør skriv Services.msc og klik OK.
Find Tjenesten
* MLServ - formessengers.com
stop den hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

------------------------------------------------------------------------

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe (Bruger du dette "Forældrekontrol ?)

O23 - Service: MLServ - formessengers.com - C:\Program Files\tetrainstallprint\mlserv.exe

Genstart normalt, kør en ny scanning med hijackthis, og kopier en frisk log herind til tjek.

------------------------------------------------------------------------

Registreringsdatabase oprydning ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Register]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.

har tuneup utilities der er der en regcleaner i
er den ikke fin?

men den der mlserv skal da startes igen når jeg er færdig med hijackthis ik?

larsen kan slet ikke finde noget som helst via din måde med tvstream? aner ikke hvorfor og hvordan den er kommet ind

Gennemfør [23/06-2008 06:55:16] alligevel !!!

hvorfor skal disse fjernes? (efterlyser forklaring)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe (Bruger du dette "Forældrekontrol ? ja den bruger jeg til en af de andre kontoer på denne comp)

O23 - Service: MLServ - formessengers.com - C:\Program Files\tetrainstallprint\mlserv.exe (denne bruger jeg jo)

Behøver ikke at være med i din opstart ->

SunJavaUpdateSched -> Checker løbende om der er ny Java version.
Adobe Reader Speed Launcher -> Forudindlæser AcrobatReader så den er (lidt) hurtigere om at starte op de få gange du skal bruge den. Men hvis du altid vil bruge ~30Mb af dine RAM til det så la' den være *S*

--------

WpcUmi.exe - så bare la' den være ...

--------

Mht: mlserv.exe - Hmmm... ->
http://www.spywareterminator.com/item/3803/MessengerLog.html
http://www.spy-emergency.com/research/M/MessengerLogPro.html

Skal _ikke_ forveksles med den almindelig Messenger

hmm er fuldstændig klar over at jeg har messengerlog pro 6 installeret da jeg selv har gjort dette og endda betalt rigeligt for at købe programmet... er det rigtigt det er den du mener der burde fjernes?:-)

hmm jeg fjerner det der sun og adobe:-) troede bare det ville blive helt fjernet fra comp'en

men vil det sige det vi fjerner fjerner vi kun fra at starte op med hijackthis?

kan ikke forstå hvordan man skulle kunne få messengerlog til at sende log filen til en anden computer over nettet... det har min version i hvert fald hvad jeg ved af:-)

du kan se programmerne på formessengers.com og bare rolig der er ikke noget der installere sig selv derinde:-)

(Den er tihvertifald blevet ædt/fjernet andre steder - derfor min mistænksomhed...)

... Nu er det ikke alle (u)ønskede elementer som viser sig med en HiJackThis Log; hvis du har 'mod' på det så gennemfør proceduren herfra -> http://www.eksperten.dk/artikler/1123
PS: Brug stadig denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

oki men tilbage til mit spm som ikke er blevet løst endnu og som er grunden til jeg søger hjælp-....

jeg kan ikke få fjernet den der tvstream... jeg har ikke nogle prog der omhandler denne og heller ikke haft... men comp'en starter automatisk internet explorer op og åbner oventalte side hver gang jeg starter min comp... Why?
og hvordan får jeg dette fjernet

[25/06-2008 06:48:46] !!

prob 1 vista er ikke inkluderet i den vejledning
kan ikke opfylde alle betingelserne

der må være en anden vej

(Det virker alligevel - <Fromsej> har bare ikke fået opdateret Artiklen...)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:02, on 26-06-2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\wpcumi.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Ranfelt Pedersen\Desktop\hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKLM\..\Policies\Explorer\Run: [ati2sgav] "C:\Windows\system32\ati2sgav.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Send billede til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send siden til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: HP Klipsamling - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart markering - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.dk/SnapfishActivia.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MLServ - formessengers.com - C:\Program Files\tetrainstallprint\mlserv.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 10473 bytes

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/26/2008 at 09:57 PM

Application Version : 4.0.1154

Core Rules Database Version : 3491
Trace Rules Database Version: 1482

Scan type      : Complete Scan
Total Scan Time : 00:23:56

Memory items scanned      : 217
Memory threats detected  : 0
Registry items scanned    : 6240
Registry threats detected : 0
File items scanned        : 25293
File threats detected    : 32

Adware.Tracking Cookie
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\ranfelt_pedersen@serving-sys[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\ranfelt_pedersen@bs.serving-sys[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\ranfelt_pedersen@bankdata.112.2o7[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\ranfelt_pedersen@atdmt[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\ranfelt_pedersen@track.adform[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@bankdata.112.2o7[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@track.adform[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@tradedoubler[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@atdmt[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@advertising[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@2o7[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\liv_ranfelt_pedersen@adtech[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@matas.112.2o7[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@indexstats[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@tracking.summitmedia.co[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@advertising[2].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@ad1.emediate[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@doubleclick[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@2o7[1].txt
    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\liv_ranfelt_pedersen@stats.zmags[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@track.adform[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@advertising[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@clicktorrent[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@eas.apm.emediate[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@doubleclick[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@www.easycounter[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@e2.emediate[2].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@2o7[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@saxoomis.122.2o7[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@ad.yieldmanager[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@adtech[1].txt
    C:\Users\Ranfelt Pedersen\AppData\Roaming\Microsoft\Windows\Cookies\Low\ranfelt_pedersen@stat.postdanmark[1].txt

ComboFix 08-06-20.4 - Ranfelt Pedersen 2008-06-26 22:25:06.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.1.1030.18.2031 [GMT 2:00]
Running from: C:\Users\Ranfelt Pedersen\Desktop\hijackthis\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\AutoRun.inf
C:\Windows\system32\KBL.LOG

.
(((((((((((((((((((((((((  Files Created from 2008-05-26 to 2008-06-26  )))))))))))))))))))))))))))))))
.

2008-06-26 22:14 . 2008-06-26 22:14    <DIR>    d--------    C:\Program Files\CCleaner
2008-06-26 21:24 . 2008-06-26 21:24    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\SUPERAntiSpyware.com
2008-06-26 21:24 . 2008-06-26 21:24    <DIR>    d--------    C:\Users\All Users\SUPERAntiSpyware.com
2008-06-26 21:24 . 2008-06-26 21:24    <DIR>    d--------    C:\ProgramData\SUPERAntiSpyware.com
2008-06-26 21:24 . 2008-06-26 21:24    <DIR>    d--------    C:\Program Files\SUPERAntiSpyware
2008-06-24 22:50 . 2008-06-24 22:50    <DIR>    d--------    C:\Users\All Users\WEBREG
2008-06-24 22:50 . 2008-06-24 22:50    <DIR>    d--------    C:\ProgramData\WEBREG
2008-06-24 22:48 . 2008-06-24 22:48    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\HPAppData
2008-06-24 22:46 . 2008-06-24 22:46    <DIR>    d--------    C:\Users\All Users\HP Product Assistant
2008-06-24 22:46 . 2008-06-24 22:46    <DIR>    d--------    C:\ProgramData\HP Product Assistant
2008-06-24 22:46 . 2008-06-24 22:46    <DIR>    d--------    C:\Program Files\Common Files\HP
2008-06-24 22:45 . 2008-06-24 22:45    <DIR>    d--------    C:\Program Files\Common Files\Hewlett-Packard
2008-06-24 22:39 . 2007-05-02 12:03    267,864    --a------    C:\Windows\System32\hpzids01.dll
2008-06-24 22:39 . 2007-05-02 12:03    267,864    --a------    C:\hpzids01.dll
2008-06-24 22:34 . 2008-06-24 22:48    164,278    --a------    C:\Windows\hpoins21.dat
2008-06-22 12:35 . 2008-06-22 12:35    <DIR>    d--h-----    C:\$AVG8.VAULT$
2008-06-22 01:45 . 2008-06-22 01:45    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\DivX
2008-06-22 01:42 . 2008-06-22 01:43    <DIR>    d--------    C:\Program Files\DivX
2008-06-22 01:42 . 2008-06-22 01:42    <DIR>    d--------    C:\Program Files\Common Files\PX Storage Engine
2008-06-20 00:09 . 2008-06-26 16:26    <DIR>    d--------    C:\Windows\System32\drivers\Avg
2008-06-20 00:09 . 2008-06-20 00:09    <DIR>    d--------    C:\Users\All Users\avg8
2008-06-20 00:09 . 2008-06-20 00:09    <DIR>    d--------    C:\ProgramData\avg8
2008-06-20 00:09 . 2008-06-20 00:09    <DIR>    d--------    C:\Program Files\AVG
2008-06-20 00:09 . 2008-06-20 00:09    96,520    --a------    C:\Windows\System32\drivers\avgldx86.sys
2008-06-20 00:09 . 2008-06-20 00:09    67,080    --a------    C:\Windows\System32\drivers\avgwfpx.sys
2008-06-20 00:09 . 2008-06-20 00:09    10,520    --a------    C:\Windows\System32\avgrsstx.dll
2008-06-20 00:03 . 2008-06-20 00:03    <DIR>    d--------    C:\Program Files\Microsoft Silverlight
2008-06-20 00:00 . 2008-06-20 00:01    0    --a------    C:\Program Files\Common Files\msupdate.exe
2008-06-19 22:46 . 2008-06-19 22:49    354,560    --a------    C:\Windows\System32\TuneUpDefragService.exe
2008-06-19 22:46 . 2008-04-04 14:51    28,416    --a------    C:\Windows\System32\uxtuneup.dll
2008-06-19 22:46 . 2008-04-04 14:51    16,640    --a------    C:\Windows\System32\authuitu.dll
2008-06-19 22:45 . 2008-06-19 22:45    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\TuneUp Software
2008-06-19 22:45 . 2008-06-19 22:45    <DIR>    d--------    C:\Users\All Users\TuneUp Software
2008-06-19 22:45 . 2008-06-19 22:45    <DIR>    d--------    C:\ProgramData\TuneUp Software
2008-06-19 22:45 . 2008-06-19 22:49    <DIR>    d--------    C:\Program Files\TuneUp Utilities 2008
2008-06-19 21:58 . 2008-06-19 21:58    <DIR>    d--------    C:\Windows\Sun
2008-06-19 21:14 . 2008-06-19 21:14    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\Snapfish
2008-06-19 21:08 . 2008-06-19 21:47    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\MessengerLog6
2008-06-19 21:06 . 2008-06-19 21:06    0    --ah-----    C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-19 21:01 . 2008-06-19 21:01    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\DAEMON Tools
2008-06-19 20:31 . 2008-06-19 20:31    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\Bluetooth Software
2008-06-19 20:31 . 2008-06-19 20:31    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Symantec
2008-06-19 20:31 . 2008-06-19 22:09    28,760    --a------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\nvModes.dat
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Videos
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Searches
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Saved Games
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Pictures
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Music
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Links
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Downloads
2008-06-19 20:30 . 2008-06-19 21:34    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Documents
2008-06-19 20:30 . 2008-06-19 21:34    <DIR>    dr-------    C:\Users\Liv Ranfelt Pedersen\Contacts
2008-06-19 20:30 . 2006-11-02 14:37    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\Media Center Programs
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen\AppData\Roaming\DigitalPersona
2008-06-19 20:30 . 2008-06-19 20:30    <DIR>    d--h-----    C:\Users\Liv Ranfelt Pedersen\AppData
2008-06-19 20:30 . 2008-06-20 02:14    <DIR>    d--------    C:\Users\Liv Ranfelt Pedersen
2008-06-19 18:57 . 2008-06-24 22:57    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\HP
2008-06-19 18:57 . 2008-06-19 21:14    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\CyberLink
2008-06-19 18:57 . 2008-06-24 22:49    <DIR>    d--------    C:\Users\All Users\HP
2008-06-19 18:57 . 2008-06-24 22:49    <DIR>    d--------    C:\ProgramData\HP
2008-06-19 18:55 . 2008-06-19 18:55    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\BlackBean
2008-06-19 18:51 . 2008-03-05 15:56    3,786,760    --a------    C:\Windows\System32\D3DX9_37.dll
2008-06-19 18:51 . 2008-03-05 15:56    1,420,824    --a------    C:\Windows\System32\D3DCompiler_37.dll
2008-06-19 18:51 . 2008-03-05 16:03    479,752    --a------    C:\Windows\System32\XAudio2_0.dll
2008-06-19 18:51 . 2008-02-05 23:07    462,864    --a------    C:\Windows\System32\d3dx10_37.dll
2008-06-19 18:51 . 2007-10-22 03:39    267,272    --a------    C:\Windows\System32\xactengine2_10.dll
2008-06-19 18:51 . 2008-03-05 16:03    238,088    --a------    C:\Windows\System32\xactengine3_0.dll
2008-06-19 18:51 . 2008-03-05 16:00    25,608    --a------    C:\Windows\System32\X3DAudio1_3.dll
2008-06-19 18:41 . 2008-06-19 18:41    <DIR>    d--------    C:\Program Files\BlackBeanGames
2008-06-19 18:40 . 2008-04-08 11:50    206,191    --a------    C:\Windows\System32\ati2sgav.exe
2008-06-18 22:59 . 2008-06-18 22:59    <DIR>    d--------    C:\Team17
2008-06-18 22:27 . 2008-06-18 22:27    <DIR>    d--------    C:\Program Files\DAEMON Tools Lite
2008-06-18 22:21 . 2008-06-18 22:21    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\DAEMON Tools
2008-06-18 20:25 . 2008-06-18 20:42    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\DAEMON Tools Pro
2008-06-18 20:15 . 2008-06-18 22:21    717,296    --a------    C:\Windows\System32\drivers\sptd.sys
2008-06-18 19:58 . 2008-06-22 12:35    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\uTorrent
2008-06-18 19:58 . 2008-06-18 19:58    <DIR>    d--------    C:\Program Files\uTorrent
2008-06-18 19:34 . 2008-06-18 19:34    <DIR>    d--------    C:\PerfLogs
2008-06-18 18:48 . 2008-06-18 18:48    <DIR>    d--------    C:\Program Files\Common Files\LightScribe
2008-06-18 18:46 . 2008-06-18 18:46    <DIR>    d--------    C:\Users\All Users\LightScribe
2008-06-18 18:46 . 2008-06-18 18:46    <DIR>    d--------    C:\ProgramData\LightScribe
2008-06-18 18:34 . 2008-01-19 09:38    4,595,712    --a------    C:\Windows\System32\AuthFWSnapin.dll
2008-06-18 18:33 . 2008-01-19 09:33    8,139,264    --a------    C:\Windows\System32\ssBranded.scr
2008-06-18 18:29 . 2008-01-19 09:33    2,515,968    --a------    C:\Windows\System32\accessibilitycpl.dll
2008-06-18 16:50 . 2008-06-19 18:44    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\MessengerLog6
2008-06-18 16:50 . 2008-06-18 16:50    <DIR>    d--h-----    C:\Program Files\tetrainstallprint
2008-06-18 00:57 . 2008-06-18 00:56    720,896    --a------    C:\Windows\iun6002.exe
2008-06-17 23:04 . 2008-06-17 23:04    <DIR>    d--------    C:\Program Files\Pure Networks
2008-06-17 23:03 . 2008-06-17 23:03    <DIR>    d----c---    C:\Windows\System32\DRVSTORE
2008-06-17 23:03 . 2008-06-17 23:03    <DIR>    d--------    C:\Program Files\Common Files\Pure Networks Shared
2008-06-17 23:03 . 2008-05-16 06:10    26,424    --a------    C:\Windows\System32\drivers\purendis.sys
2008-06-17 23:03 . 2008-05-16 06:10    24,888    --a------    C:\Windows\System32\drivers\pnarp.sys
2008-06-17 23:02 . 2008-06-17 23:03    <DIR>    d--------    C:\Users\All Users\Pure Networks
2008-06-17 23:02 . 2008-06-17 23:03    <DIR>    d--------    C:\ProgramData\Pure Networks
2008-06-17 22:15 . 2008-06-17 22:15    <DIR>    d--------    C:\Program Files\Common Files\Adobe
2008-06-17 22:05 . 2008-06-17 22:05    <DIR>    d--------    C:\Users\All Users\e-Safekey
2008-06-17 22:05 . 2008-06-17 22:05    <DIR>    d--------    C:\ProgramData\e-Safekey
2008-06-17 22:00 . 2008-06-17 22:00    <DIR>    d--------    C:\Users\Ranfelt Pedersen\AppData\Roaming\Cryptomathic
2008-06-17 21:59 . 2008-06-17 21:59    <DIR>    d--------    C:\Program Files\TDC
2008-06-17 21:59 . 2008-06-26 21:23    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2008-06-17 20:05 . 2008-06-17 20:09    <DIR>    d--------    C:\Program Files\Windows Live
2008-06-17 20:05 . 2008-06-17 20:09    <DIR>    d--hsc---    C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-17 20:04 . 2008-06-17 20:04    <DIR>    d--------    C:\Users\All Users\WLInstaller
2008-06-17 20:04 . 2008-06-17 20:04    <DIR>    d--------    C:\ProgramData\WLInstaller
2008-06-17 19:32 . 2008-06-25 20:48    94,500    --a------    C:\Users\Ranfelt Pedersen\AppData\Roaming\nvModes.dat
2008-06-17 18:15 . 2008-06-17 18:15    220,160    --a------    C:\Windows\System32\drivers\bthport.sys
2008-06-17 18:15 . 2008-06-17 18:15    181,760    --a------    C:\Windows\System32\fsquirt.exe
2008-06-17 18:15 . 2008-06-17 18:15    29,184    --a------    C:\Windows\System32\drivers\BTHUSB.SYS
2008-06-17 18:15 . 2008-06-17 18:15    19,456    --a------    C:\Windows\System32\drivers\bthenum.sys
2008-06-17 18:14 . 2008-06-17 18:14    988,216    --a------    C:\Windows\System32\winload.exe
2008-06-17 18:14 . 2008-06-17 18:14    927,288    --a------    C:\Windows\System32\winresume.exe
2008-06-17 18:14 . 2008-06-17 18:14    615,992    --a------    C:\Windows\System32\ci.dll
2008-06-17 18:14 . 2008-06-17 18:14    378,368    --a------    C:\Windows\System32\srcore.dll
2008-06-17 18:14 . 2008-06-17 18:14    318,464    --a------    C:\Windows\System32\rstrui.exe
2008-06-17 18:14 . 2008-06-17 18:14    46,592    --a------    C:\Windows\System32\setbcdlocale.dll
2008-06-17 18:14 . 2008-06-17 18:14    40,960    --a------    C:\Windows\System32\srclient.dll
2008-06-17 18:14 . 2008-06-17 18:14    19,000    --a------    C:\Windows\System32\kd1394.dll
2008-06-17 18:14 . 2008-06-17 18:14    14,848    --a------    C:\Windows\System32\srdelayed.exe
2008-06-17 18:14 . 2008-06-17 18:14    6,656    --a------    C:\Windows\System32\kbd106n.dll
2008-06-17 18:13 . 2008-06-17 18:13    2,032,128    --a------    C:\Windows\System32\win32k.sys
2008-06-17 18:13 . 2008-06-17 18:13    295,936    --a------    C:\Windows\System32\gdi32.dll
2008-06-17 18:12 . 2008-06-17 18:12    4,240,384    --a------    C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-17 18:12 . 2008-06-17 18:12    1,695,744    --a------    C:\Windows\System32\gameux.dll
2008-06-17 18:12 . 2008-06-17 18:12    113,664    --a------    C:\Windows\System32\drivers\rmcast.sys
2008-06-17 18:12 . 2008-06-17 18:12    14,848    --a------    C:\Windows\System32\wshrm.dll

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-24 20:48    ---------    d-----w    C:\Program Files\Hewlett-Packard
2008-06-24 20:44    ---------    d-----w    C:\ProgramData\Hewlett-Packard
2008-06-19 20:34    ---------    d-----w    C:\Program Files\Common Files\Symantec Shared
2008-06-19 19:19    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-06-18 17:47    174    --sha-w    C:\Program Files\desktop.ini
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Sidebar
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Photo Gallery
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Mail
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Journal
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Defender
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Collaboration
2008-06-18 17:36    ---------    d-----w    C:\Program Files\Windows Calendar
2008-06-17 16:12    540,672    ----a-w    C:\Windows\AppPatch\AcLayers.dll
2008-06-17 16:12    458,752    ----a-w    C:\Windows\AppPatch\AcSpecfc.dll
2008-06-17 16:12    2,560    ----a-w    C:\Windows\AppPatch\AcRes.dll
2008-06-17 16:12    2,153,984    ----a-w    C:\Windows\AppPatch\AcGenral.dll
2008-06-17 16:12    173,056    ----a-w    C:\Windows\AppPatch\AcXtrnal.dll
2008-06-17 15:58    805    ----a-w    C:\Windows\system32\drivers\SYMEVENT.INF
2008-06-17 15:58    10,671    ----a-w    C:\Windows\system32\drivers\SYMEVENT.CAT
2008-06-17 15:52    ---------    d-----w    C:\Program Files\Java
2008-06-03 10:17    ---------    d-----w    C:\Program Files\CyberLink
2008-06-03 10:04    319,456    ----a-w    C:\Windows\DIFxAPI.dll
2008-06-03 10:04    315,392    ----a-w    C:\Windows\HideWin.exe
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-30 00:41 222128]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 10:29 102400]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 15:27 4702208 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 08:02 174616]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-10-01 04:34 181544]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 23:31 202032]
"OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 22:54 554320]
"DpAgent"="C:\Program Files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 20:12 671744]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 18:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 01:53 311296]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 19:31 1033512]
"nmctxth"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 06:11 648504]
"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-06-20 00:01 451896]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 22:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 22:05 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 22:05 81920]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-20 00:09 1177368]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 16:32 222504]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"ati2sgav"= "C:\Windows\system32\ati2sgav.exe"

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\Windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 11:39 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2008-06-09 10:16 2363392 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{55F5EADE-378B-4F78-BA0A-E484B5B8B7BA}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{ED110132-EF21-48F6-A651-F7737E4B6577}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{CC6190C9-B215-4070-B093-27AF72A52823}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{90A764E7-3A04-4CF1-8D8A-47C30BAFD006}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{145983C8-3FED-4064-AA3E-194B4E6F74F8}"= TCP:67:DHCP Discovery Service
"{5DFBC9F2-582A-4FAE-A867-DB94BCD3356F}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{E403A2B3-6F71-409A-BA2A-B3A0D5FB1D0D}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{933E6457-5060-410B-B004-3189BB1FB8F2}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{4D1DFA7E-66A2-4241-8AD1-99083BDE7D10}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{D676EB87-E5BB-4A42-BD59-C0B950848799}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{58C345FB-7F89-4D00-A994-96414D0823CF}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe
"{6A9F3EA1-5226-4C68-8EB3-DC9D7EEA8B4D}"= Disabled:UDP:F:\setup\HPZnui01.exe:hpznui01.exe
"{6A991A78-E19B-420E-BD36-9A9F4A2D7415}"= Disabled:TCP:F:\setup\HPZnui01.exe:hpznui01.exe
"{144A2CC9-8369-406A-8A4C-A59B1DEEDA4D}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{72714D86-A53B-4887-A04B-B353483DD88A}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{C4DFCF8F-DABE-457B-BAFE-0B8445153906}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{252C2F93-FB09-4B19-B6FB-EDFA7C1398D0}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{2AB244AA-BF87-42E2-A003-1EE95F04D96A}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{8B4E7C43-F8DE-4236-B1FF-98F556D1499B}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{57F36E4D-A19D-4F42-BADF-9595294848DA}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{3C12802A-9D04-4F0D-A223-142252AB4067}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{53B1889F-4EFB-4186-8F55-DAFBE4B9338F}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{BEBF23B0-1586-4C9C-9DB9-8CDDD9AF7041}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{C1AD5999-FAD9-464C-A23C-CAACAE618014}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{B083A9D2-8C74-405C-88C5-991422095226}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{B5BFF2AB-F0B7-47C1-B8EA-A38A23DD8141}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{F61B87EA-2823-4104-8137-5B0952C89685}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{68A4713D-C455-4646-BF83-B93DF869726D}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{F2B8E919-29DC-49E0-B32E-30AC3A28ECBD}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{A58D9B4B-B934-4A77-85CD-06DD84D6359B}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{79AAB3FF-F769-41EC-9F00-B785C76C1858}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{BBD1F890-74E7-4EB2-9BC6-57D7855C1658}"= Disabled:UDP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{50E98136-AE1F-4540-A451-59345F24733F}"= Disabled:TCP:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{D2ABFE4B-5756-46B8-B6EC-BDD5F0E45DCD}"= UDP:C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:Pure Networks Platform Service
"{BFFC8A7B-5814-4D8B-BF4A-0E66E13661E4}"= TCP:C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:Pure Networks Platform Service

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-06-20 00:09]
R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-20 00:09]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 19:30]
S3 btwaudio;Bluetooth-audioenhed;C:\Windows\system32\drivers\btwaudio.sys [2007-09-18 15:12]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-09-18 15:12]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-09-18 15:12]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    REG_MULTI_SZ      BthServ
HPZ12    REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
HPService    REG_MULTI_SZ      HPSLPSVC
hpdevmgmt    REG_MULTI_SZ      hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68e0091d-3d74-11dd-abf0-00218606e701}]
\shell\AutoRun\command - G:\autorun.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-06-26 20:29:01 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 22:29:16
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\tetrainstallprint\MLServ.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Windows\System32\conime.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-06-26 22:35:54 - machine was rebooted
ComboFix-quarantined-files.txt  2008-06-26 20:35:39

Pre-Run: 170,557,083,648 byte ledig
Post-Run: 171,937,247,232 byte ledig

331    --- E O F ---    2008-06-26 14:29:05

hallo nogen der er søde og kigge log igennen?

(Undskyld forsinkelsen - ligner ikke mig *S* )

Afinstaller
* µTorrent

http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

via
[Start][Indstilninger][Kontrolpanel][Tilføj/fjern programmer]

Genstart for at fuldføre afinstalationen...

---------------------------------------

Prøv at opstarte UDEN internetforbindelse overhovedet (Stikket UD!) ...

det fair nok selvom der er tusindevis lovlige filer derinde hvilket jeg synes er nemmest at finde der....
hmm starte op uden internet forbindelse? hvilket formål så kan jeg jo ikke skrive herinde:-)

lige meget med forsinkelsen hehe man har tid når man har tid;-)

HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatility\{0EDC6C20-A31C-11DB-8AB9-0800200C9A66}  Found Adware.RogueSuspect

HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatility\{3AAC4C68-AFC8-11DB-80EF-8AF955D89593}  Found Adware.RogueSuspect

Har min avg free antivirus fundet hvad er dette?

Bør også slettes så vidt muligt!!!

forstod ikke lige hvad jeg skulle gøre med hensyn til at opstarte UDEN internet forbindelse

... uden at have NETVÆRKSSTIKKET tilsluttet...

jamen hvad vil det hjælpe? skal jeg lave en log eller havd skal jeg gøre uden internettet

Lige en hurtig: Det er bare for at se om omtalte ¤#$%¤# (Bandeord!) så IKKE vil dukke op ? Eller hvad ?

hvis du mener tvstream så gør den.. den kan bare ikke finde siden frem men internet explorer åbner og forsøger at gå til siden

????

Skulle lige sove ud *S*

Fik lige et tip eller to ->

[IE][Funktioner][InternetIndstillinger][Fanen Programmer][Administerer tilføjelsesprogrammer...]
Se om der er et eller andent "objekt" som ser mistænkeligt ud og Deaktiver (Slet hvis du må) det...

http://www.malwarebytes.org/
http://www.malwaresupport.com/mbam/program/mbam-setup.exe
Download [Malwarebytes' Anti-Malware] programmet; lad den blive opdateret. Gennemfør en komplet scanning...

der er intet i tilføjelsesprogrammer....
var der ikke noget i mine logs?:-)

... ikke noget som lige trigger mig...

Malwarebytes' Anti-Malware 1.19Database version: 901Windows 6.0.6001 Service Pack 112:15:16 29-06-2008mbam-log-6-29-2008 (12-15-16).txtSkan type: Fuldstændig skanning (C:\|D:\|E:\|G:\|)Objekter skannet: 158820Tid tilbagelagt: 39 minute(s), 23 second(s) Inficerede Hukommelses Processer: 0 Inficerede Hukommelses Moduler: 0 Inficerede Registeringsdatabase Nøgler: 0Inficerede Registeringsdatabase Værdier: 0Inficerede Registeringsdatabase Filer: 0Inficerede Mapper: 0Inficerede Filer: 0 Inficerede Hukommelses Processer:(Ingen mistænkelige filer fundet) Inficerede Hukommelses Moduler:(Ingen mistænkelige filer fundet) Inficerede Registeringsdatabase Nøgler:(Ingen mistænkelige filer fundet)Inficerede Registeringsdatabase Værdier:(Ingen mistænkelige filer fundet)Inficerede Registeringsdatabase Filer:(Ingen mistænkelige filer fundet)Inficerede Mapper:(Ingen mistænkelige filer fundet)Inficerede Filer:(Ingen mistænkelige filer fundet)

Malwarebytes' Anti-Malware 1.19
Database version: 901
Windows 6.0.6001 Service Pack 1

12:15:16 29-06-2008
mbam-log-6-29-2008 (12-15-16).txt

Skan type: Fuldstændig skanning (C:\|D:\|E:\|G:\|)
Objekter skannet: 158820
Tid tilbagelagt: 39 minute(s), 23 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
(Ingen mistænkelige filer fundet)

den sidste her er lidt nemmmere og læse...
men den fandt ingenting:-(

For en gangs skyld *S* vil jeg så henvise til
http://www.spywarefri.dk/forum/
Opret spm. der og henvis til denne tråd.
Også i denne tråd læg link til den oprettede tråd ved http://www.spywarefri.dk/forum/ ...

jeg følger henvisningen og har oprettet dette spm på spywarefri.dk

http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=48839

kom med et svar karise larry:-)

Ping...
Det var et [svar]...

(Jeg har fuldt lidt med på http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=48839 . Det blev jo noget langhåret; og med selveste [Ejvindh] med på vognen !!!)

ja det gjorde... og lidt nøjern med alt det blå skærm og comp der ikke ville starte osv

men vi blev vel alle lidt klogere:-) og en erfaring rigere så nu ved vi da hvad vi også skal kigge efter:-)