antivirusprogramxp08 virus-malware? styreprogram windows XP

... må jeg/vi se denne HiJackThis Log ?

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

selvfølgelig jeg går over til naboen nu.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:57, on 16-08-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\NORMAN\npm\bin\nvoy.exe
C:\WINDOWS\Explorer.EXE
C:\NORMAN\npf\bin\npfsvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\NORMAN\npf\bin\npfuser.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\NORMAN\npm\Bin\Zanda.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\NORMAN\npm\bin\NJEEVES.EXE
C:\NORMAN\npc\bin\npcsvc32.exe
C:\NORMAN\npc\bin\nuaa.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\lphcgj0j0ej55.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\system32\pphcgj0j0ej55.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe
F:\spywarefri\Spywarefri\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.tdconline.dk/msie_google.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://goggle.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programmer\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programmer\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\AddOn\AcrobatReader\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [BXODNACX] c:\windows\system32\bxodnacx.exe /install
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NPCTray] C:\NORMAN\npc\bin\npc_tray.exe /LOAD
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [lphcgj0j0ej55] C:\WINDOWS\system32\lphcgj0j0ej55.exe
O4 - HKLM\..\Run: [SMrhclj0j0ej55] C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [A00F559BD9.exe] C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F559BD9.exe
O4 - HKCU\..\Run: [A00F4CE52.exe] C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F4CE52.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: HP Klipsamling - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart markering - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\norman\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: c:\norman\npc\bin\nlf.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.20.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} - http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_pack_XP.cab
O20 - Winlogon Notify: __c0059880 - C:\WINDOWS\system32\__c0059880.dat
O23 - Service: Norman NJeeves - Unknown owner - C:\NORMAN\npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\NORMAN\npm\Bin\Zanda.exe
O23 - Service: Norman Parental Control (NPC) - Norman ASA - C:\NORMAN\npc\bin\npcsvc32.exe
O23 - Service: Norman Personal Firewall Service (NPFSvc32) - Norman ASA - C:\NORMAN\npf\bin\npfsvc32.exe
O23 - Service: Norman User Activity Agent (NUAA) - Norman ASA - C:\NORMAN\npc\bin\nuaa.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Unknown owner - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE (file missing)
O23 - Service: Norman V.O.Y. (NVOY) - Norman ASA - C:\NORMAN\npm\bin\nvoy.exe
O23 - Service: SmartLinkService (SLService) -  - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6237 bytes

normanprogrammet er ikke i brug mere hvorfor 023 og 010 filerne bør kunne slettes.
C:\WINDOWS\System32\khooker.exe kunne jeg have en mistanke til.

Læs alle punkterne inden du gør noget.
Gem evt. denne vejledning som en tekstfil på skrivebordet vha. Notepad.

(1)
Hent AFT-cleaner her: http://www.geekstogo.com/forum/index.php?autocom=downloads&showfile=21
Start programmet og vælg "select all" og derefter "empty all".
Hvis du har Firefox skal du først vælge det i menuen og derefter "select all" og "empty all".

(2)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op) og Fix følgende linjer med HijackThis:
O4 - HKLM\..\Run: [BXODNACX] c:\windows\system32\bxodnacx.exe /install
O4 - HKLM\..\Run: [lphcgj0j0ej55] C:\WINDOWS\system32\lphcgj0j0ej55.exe
O4 - HKLM\..\Run: [SMrhclj0j0ej55] C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe
O4 - HKCU\..\Run: [A00F559BD9.exe] C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F559BD9.exe
O4 - HKCU\..\Run: [A00F4CE52.exe] C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F4CE52.exe
O20 - Winlogon Notify: __c0059880 - C:\WINDOWS\system32\__c0059880.dat

(3)
Åbn "denne computer", i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper", sæt prik i "Vis skjulte filer og mapper". Husk at trykke på knappen "Anvend på alle mapper" i stedet for "ok".

søg efter og slet følgende fil(er):
c:\windows\system32\bxodnacx.exe
C:\WINDOWS\system32\lphcgj0j0ej55.exe
C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F559BD9.exe
C:\DOCUME~1\LARSNI~1\LOKALE~1\Temp\_A00F4CE52.exe
C:\WINDOWS\system32\__c0059880.dat
... og følgende mappe:
C:\Programmer\rhclj0j0ej55\

(4)
Genstart computeren normalt. Lav en ny log med HijackThis og send den herind.

NB: khooker.exe skal ikke fjernes.

... og jeg/vi vil også gerne se en log fra malware antimalware.bytes

Malwarebytes' Anti-Malware 1.24
Database version: 1058
Windows 5.1.2600 Service Pack 2

11:00:32 17-08-2008
mbam-log-8-17-2008 (11-00-32).txt

Skan type: Fuldstændig skanning (C:\|)
Objekter skannet: 82043
Tid tilbagelagt: 39 minute(s), 51 second(s)

Inficerede Hukommelses Processer: 3
Inficerede Hukommelses Moduler: 5
Inficerede Registeringsdatabase Nøgler: 15
Inficerede Registeringsdatabase Værdier: 7
Inficerede Registeringsdatabase Filer: 2
Inficerede Mapper: 38
Inficerede Filer: 77

Inficerede Hukommelses Processer:
C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe (Rogue.Multiple) -> Unloaded process successfully.
C:\WINDOWS\system32\lphcgj0j0ej55.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\system32\pphcgj0j0ej55.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Inficerede Hukommelses Moduler:
C:\Programmer\rhclj0j0ej55\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Programmer\rhclj0j0ej55\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
C:\Programmer\rhclj0j0ej55\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.
C:\WINDOWS\system32\__c0059880.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\blphcgj0j0ej55.scr (Trojan.FakeAlert) -> Delete on reboot.

Inficerede Registeringsdatabase Nøgler:
HKEY_CLASSES_ROOT\CLSID\{2abe804b-4d3a-41bf-a172-304627874b45} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2f668a6d-2ec7-4e3a-a485-819e210738d6} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pe2detect.pe2detect (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/system32/ia.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{486e48b5-abf2-42bb-a327-2679df3fb822} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{486e48b5-abf2-42bb-a327-2679df3fb822} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pe2detect.pe2detect.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{901166a5-f137-4b27-bc4c-ca611debdced} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{83f0d6aa-cd15-46b5-aa4e-bdb506b4ae53} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{94742e3f-d9a1-4780-9a87-2ffa43655da2} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{94742e3f-d9a1-4780-9a87-2ffa43655da2} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhclj0j0ej55 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhclj0j0ej55 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0059880 (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\System32\ia.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhclj0j0ej55 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcgj0j0ej55 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Filer:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Inficerede Mapper:
C:\Programmer\Instant Access (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\img (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\ncc_v3_deepthroat (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\ncc_v3_deepthroat\fullpage (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\img (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\img (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\ncc_v3_deepthroat (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\ncc_v3_deepthroat\fullpage (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\rhclj0j0ej55\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Inficerede Filer:
C:\WINDOWS\system32\ia.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\inv_frame.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\mainframe.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\img\banner.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_E5CZk1oQE2UrNlmCwdIAkwb\img\ncc.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\button1.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\button2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\button3.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\button4.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\index_01.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\index_02.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\index_03.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\index_06.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\img\ncc.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_FnhShKEBNlKzZZgsHSAJMG\ncc_v3_deepthroat\fullpage\index.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\inv_frame.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\mainframe.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\img\banner.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_mXVQh5oQE2UrNlmCwdIAkwb\img\ncc.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\inv_frame.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\mainframe.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\img\banner.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_WCYzACoQE2UrNlmCwdIAkwb\img\ncc.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\button1.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\button2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\button3.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\button4.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\index_01.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\index_02.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\index_03.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\index_06.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\img\ncc.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\Instant Access\Dialer\HTM_YIEgSJoQE2UrNlmCwdIAkwb\ncc_v3_deepthroat\fullpage\index.php (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\rhclj0j0ej55.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Programmer\rhclj0j0ej55\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c0059880.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\__c0071984.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphcgj0j0ej55.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcgj0j0ej55.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcgj0j0ej55.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pphcgj0j0ej55.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\egdhtml_pack.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\ia.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Lokale indstillinger\Temp\_A00F559BD9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Lokale indstillinger\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Lokale indstillinger\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Lokale indstillinger\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lars Nicolai Jensen\Lokale indstillinger\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:03, on 17-08-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Documents and Settings\Lars Nicolai Jensen\Skrivebord\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.tdconline.dk/msie_google.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://goggle.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programmer\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programmer\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\AddOn\AcrobatReader\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: HP Klipsamling - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart markering - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.20.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: SmartLinkService (SLService) -  - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 4611 bytes

Bruger - eller har brugt - du noget indenfor Symantec/Norton ?

Disse bør så også 'fixes' ->
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')

du kører jo med nydelig AVG8 - fint...

---------

Hvordan kører PC'en så nu ?

Husk M$ ServicePack3 til XP -> http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=da + efterfølgende WindowsUpdate http://update.microsoft.com/windowsupdate/v6/default.aspx?ln=da . Du mangler vist en del!!!

Jeps, det var vist det. Der er ikke mere virus/spyware.

Enig - men husk
"...Husk M$ ServicePack3 til XP -> http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=da + efterfølgende WindowsUpdate http://update.microsoft.com/windowsupdate/v6/default.aspx?ln=da . Du mangler vist en del!!!..."

norton har været brugt. pc kører perfekt. husker opdatering sp3 m.m. tak til alle for god, hurtig kompetent behandling. fixer de sidste symantec.