Adware Virtumonde symptomer/renset

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/16/2008 at 10:45 PM

Application Version : 4.0.1154

Core Rules Database Version : 3599
Trace Rules Database Version: 1585

Scan type      : Complete Scan
Total Scan Time : 00:12:38

Memory items scanned      : 212
Memory threats detected  : 1
Registry items scanned    : 4853
Registry threats detected : 6
File items scanned        : 14806
File threats detected    : 2

Adware.Vundo Variant/Resident
    C:\WINDOWS\SYSTEM32\RQRHXPFE.DLL
    C:\WINDOWS\SYSTEM32\RQRHXPFE.DLL

Trojan.Vundo-Variant/Small-GEN
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDC1E410-C174-4E54-B787-8C2CEC55D030}
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}\InprocServer32
    HKCR\CLSID\{BDC1E410-C174-4E54-B787-8C2CEC55D030}\InprocServer32#ThreadingModel

Adware.Vundo Variant/Rel
    HKLM\SOFTWARE\Microsoft\FCOVM
    HKLM\SOFTWARE\Microsoft\RemoveRP

Adware.Tracking Cookie
    C:\Documents and Settings\Administrator\Cookies\administrator@statse.webtrendslive[1].txt

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:08:14, on 17-10-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\ACER\PSM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmer\Acer\Acer eMode Management\AspireService.exe
C:\Programmer\Acer\Acer eConsole\MediaSync.exe
C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\HookManager.exe
C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\Vundofix\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdconline.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AspireService] C:\Programmer\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Programmer\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [DT HWP] C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [cctray] "C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [VetStart] "C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe" -r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\DOCUME~1\jbz\LOKALE~1\Temp\SSUPDATE.EXE Software\SUPERAntiSpyware.com\SUPERAntiSpyware
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Programmer\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

--
End of file - 7544 bytes

ComboFix 08-10-16.01 - jbz 2008-10-17  0:16:34.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1030.18.1118 [GMT 2:00]
Running from: C:\Vundofix\ComboFix.exe
* Created a new restore point

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\efPXHRqr.ini
C:\WINDOWS\system32\efPXHRqr.ini2

.
(((((((((((((((((((((((((  Files Created from 2008-09-16 to 2008-10-16  )))))))))))))))))))))))))))))))
.

2008-10-16 23:11 . 2008-10-16 23:13    1,393    --a------    C:\WINDOWS\imsins.BAK
2008-10-16 22:22 . 2008-10-16 23:54    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2008-10-16 22:22 . 2008-10-16 22:22    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\SUPERAntiSpyware.com
2008-10-16 22:22 . 2008-10-16 22:22    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-10-16 22:14 . 2008-10-16 22:14    <DIR>    d--------    C:\Programmer\CCleaner
2008-10-16 21:45 . 2008-10-16 21:45    <DIR>    d--------    C:\VundoFix Backups
2008-10-16 21:44 . 2008-10-17 00:13    <DIR>    d--------    C:\Vundofix
2008-10-16 18:42 . 2008-10-16 20:09    <DIR>    d--------    C:\Documents and Settings\Administrator\.housecall6.6
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--------    C:\Documents and Settings\Administrator\Skrivebord
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Skabeloner
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Printere
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    dr-------    C:\Documents and Settings\Administrator\Menuen Start
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Lokale indstillinger
2008-10-16 13:38 . 2005-03-24 23:42    <DIR>    dr-------    C:\Documents and Settings\Administrator\Foretrukne
2008-10-16 13:38 . 2005-03-24 23:42    <DIR>    dr-------    C:\Documents and Settings\Administrator\Dokumenter
2008-10-16 13:38 . 2005-03-24 23:45    <DIR>    d--------    C:\Documents and Settings\Administrator\Application Data\Symantec
2008-10-16 13:38 . 2005-03-24 23:33    <DIR>    d--h-----    C:\Documents and Settings\Administrator\Andre computere
2008-10-16 13:38 . 2008-10-16 18:42    <DIR>    d--------    C:\Documents and Settings\Administrator
2008-10-16 02:31 . 2008-10-16 02:31    31,232    --a------    C:\WINDOWS\system32\rqRHxuvV.dll.vir
2008-10-15 15:08 . 2008-08-14 15:25    2,191,744    ---------    C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,147,840    ---------    C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,068,608    ---------    C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 15:08 . 2008-08-14 15:25    2,026,496    ---------    C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 15:08 . 2008-09-15 17:27    1,846,400    ---------    C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 15:08 . 2008-09-08 12:41    333,824    ---------    C:\WINDOWS\system32\dllcache\srv.sys
2008-10-06 01:36 . 2008-10-06 11:03    <DIR>    d--------    C:\Documents and Settings\jbz\.housecall6.6
2008-10-05 21:58 . 2008-08-14 20:59    1,923,024    --a------    C:\Jørn på spejderlejr.jpg
2008-10-01 09:29 . 2008-08-08 14:47    227,840    --a------    C:\WINDOWS\system32\bzFlRdr.dll
2008-10-01 09:29 . 2008-09-05 06:29    193,024    --a------    C:\WINDOWS\system32\bzpdf.dll
2008-10-01 09:29 . 2008-09-26 20:44    126,976    --a------    C:\WINDOWS\system32\bzpdfc.dll
2008-10-01 09:29 . 2008-07-10 00:19    103,424    --a------    C:\WINDOWS\system32\bzDCT.dll
2008-10-01 09:28 . 2008-10-01 09:28    <DIR>    d--------    C:\Programmer\Bullzip
2008-09-24 13:33 . 2008-10-17 00:13    <DIR>    d--------    C:\WINDOWS\CAVTemp
2008-09-24 13:22 . 2008-09-24 13:22    <DIR>    d--------    C:\Programmer\CA
2008-09-24 13:22 . 2008-09-24 13:22    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\CA
2008-09-24 13:22 . 2008-09-24 13:33    880,560    --a------    C:\WINDOWS\system32\drivers\vetefile.sys
2008-09-24 13:22 . 2008-09-24 13:33    108,368    --a------    C:\WINDOWS\system32\drivers\veteboot.sys
2008-09-24 13:22 . 2008-01-11 21:30    99,592    --a------    C:\WINDOWS\system32\isafeif.dll
2008-09-24 13:22 . 2008-09-24 13:33    91,376    --a------    C:\WINDOWS\system32\isafprod.dll
2008-09-24 13:22 . 2008-01-11 21:30    83,256    --a------    C:\WINDOWS\system32\vetredir.dll
2008-09-24 13:22 . 2008-09-24 13:33    32,240    --a------    C:\WINDOWS\system32\drivers\vetmonnt.sys
2008-09-24 13:22 . 2008-09-24 13:33    26,352    --a------    C:\WINDOWS\system32\drivers\vet-filt.sys
2008-09-24 13:22 . 2008-09-24 13:33    21,488    --a------    C:\WINDOWS\system32\drivers\vetfddnt.sys
2008-09-24 13:22 . 2008-09-24 13:33    21,104    --a------    C:\WINDOWS\system32\drivers\vet-rec.sys
2008-09-23 10:57 . 2008-09-23 10:57    44,504    --a------    C:\Documents and Settings\jbz\Application Data\GDIPFONTCACHEV1.DAT
2008-09-23 10:41 . 2008-09-23 10:41    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\Canon
2008-09-23 10:17 . 2008-04-13 20:47    25,856    --a------    C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-23 10:17 . 2008-04-13 20:47    25,856    --a------    C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-23 10:17 . 2008-04-13 20:45    15,104    --a------    C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-23 10:17 . 2008-04-13 20:45    15,104    --a------    C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-23 10:08 . 2008-09-23 10:09    <DIR>    d--h-----    C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-09-23 10:06 . 2006-04-30 21:00    161,792    --a------    C:\WINDOWS\system32\CNMLM87.DLL
2008-09-23 10:05 . 2008-09-23 10:05    <DIR>    d--h-----    C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-09-23 10:05 . 2008-09-23 10:05    <DIR>    d--h-----    C:\Programmer\CanonBJ
2008-09-23 10:05 . 2006-04-13 09:23    1,134,592    --a------    C:\WINDOWS\system32\CNCC600.DLL
2008-09-23 10:05 . 2006-05-29 01:39    135,168    --a------    C:\WINDOWS\system32\CNCL600.DLL
2008-09-23 10:05 . 2006-02-17 07:44    106,496    --a------    C:\WINDOWS\system32\cnco600.dll
2008-09-23 10:05 . 2006-04-13 09:23    57,344    --a------    C:\WINDOWS\system32\CNCI600.DLL
2008-09-21 21:50 . 2008-10-04 08:18    <DIR>    d--------    C:\Documents and Settings\jbz\Application Data\DivX
2008-09-21 21:48 . 2008-09-21 21:48    <DIR>    d--------    C:\Programmer\DivX

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-16 20:21    ---------    d-----w    C:\Programmer\Fælles filer\Wise Installation Wizard
2008-10-09 21:11    ---------    d-----w    C:\Documents and Settings\jbz\Application Data\AdobeUM
2008-10-03 17:12    6,066,176    ----a-w    C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 15:27    1,846,400    ----a-w    C:\WINDOWS\system32\win32k.sys
2008-09-08 10:41    333,824    ----a-w    C:\WINDOWS\system32\drivers\srv.sys
2008-09-03 15:09    ---------    d-----w    C:\Programmer\Cribbage
2008-08-27 09:27    3,593,216    ----a-w    C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38    13,824    ----a-w    C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 08:36    70,656    ----a-w    C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-23 05:56    635,848    ----a-w    C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54    161,792    ----a-w    C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-21 16:04    ---------    d-----w    C:\Programmer\Microsoft CAPICOM 2.1.0.2
2008-08-21 07:35    ---------    d-sh--w    C:\Programmer\Fælles filer\WindowsLiveInstaller
2008-08-21 07:35    ---------    d-----w    C:\Programmer\Windows Live
2008-08-21 07:35    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-14 13:25    2,147,840    ----a-w    C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:25    2,026,496    ----a-w    C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 10:04    138,496    ----a-w    C:\WINDOWS\system32\dllcache\afd.sys
2008-07-25 08:36    524,288    ----a-w    C:\WINDOWS\system32\DivXsm.exe
2008-07-23 16:50    3,596,288    ----a-w    C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 16:50    129,784    ----a-w    C:\WINDOWS\system32\pxafs.dll
2008-07-23 16:50    120,056    ----a-w    C:\WINDOWS\system32\pxcpyi64.exe
2008-07-23 16:50    118,520    ----a-w    C:\WINDOWS\system32\pxinsi64.exe
2008-07-23 16:48    200,704    ----a-w    C:\WINDOWS\system32\ssldivx.dll
2008-07-23 16:48    1,044,480    ----a-w    C:\WINDOWS\system32\libdivx.dll
2008-07-23 16:46    12,288    ----a-w    C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-18 20:10    94,920    ----a-w    C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10    94,920    ----a-w    C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10    53,448    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10    53,448    ----a-w    C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10    45,768    ----a-w    C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10    36,552    ----a-w    C:\WINDOWS\system32\wups.dll
2008-07-18 20:10    36,552    ----a-w    C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09    563,912    ----a-w    C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09    563,912    ----a-w    C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09    325,832    ----a-w    C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09    325,832    ----a-w    C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09    205,000    ----a-w    C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09    205,000    ----a-w    C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09    1,811,656    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09    1,811,656    ----a-w    C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 20:07    270,880    ----a-w    C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07    210,976    ----a-w    C:\WINDOWS\system32\muweb.dll
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"RemoteControl"="C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"MPS"="C:\ACER\PSM.EXE" [2004-03-04 372736]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-27 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-27 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AspireService"="C:\Programmer\Acer\Acer eMode Management\AspireService.exe" [2005-06-21 110592]
"MediaSync"="C:\Programmer\Acer\Acer eConsole\MediaSync.exe" [2005-06-21 425984]
"DT HWP"="C:\Programmer\Portrait Displays\HP Display Assistant\DTHtml.exe" [2007-03-27 278016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"cctray"="C:\Programmer\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-10-10 247024]
"CAVRID"="C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-09-24 234736]
"VetStart"="C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe" [2008-09-24 255216]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-12 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-01-14 C:\WINDOWS\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Speed Launch.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=

R0 m5287;m5287;C:\WINDOWS\system32\drivers\m5287.sys [2004-12-15 76544]
S3 int15.sys;int15.sys;C:\Programmer\acer\erecovery\int15.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96598859-9cbc-11d9-9184-806d6172696f}]
\Shell\AutoRun\command - I:\Autorun.exe HowToUse\HowToUse.html
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-eRecoveryService - (no file)
HKLM-Run-eRecoveryService - (no file)
ShellExecuteHooks-{9AD7FC7F-1FE1-4414-9AC5-EC51457528E4} - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://tdconline.dk/
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://global.acer.com/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe

O16 -: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
C:\WINDOWS\Downloaded Program Files\e-Safekey.inf
C:\WINDOWS\Downloaded Program Files\e-Safekey.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-17 00:29:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmer\acer\Acer eConsole\MediaServerService.exe
C:\Programmer\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\DTSRVC.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Fælles filer\Portrait Displays\Shared\HookManager.exe
C:\Programmer\CA\CA Internet Security Suite\ccprovsp.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-10-17  0:32:17 - machine was rebooted
ComboFix-quarantined-files.txt  2008-10-16 22:31:44

Pre-Run: 84.547.883.008 byte ledig
Post-Run: 84,642,189,312 byte ledig

211    --- E O F ---    2008-10-16 21:14:09

Der er ikke mere skidt i dine logfiler, så det ser ud til at du har gjort dit arbejde godt :-)

TAK for det! Man bliver s'gu helt forpustet af sådan en omgang, men selvfø'ligt også lidt klogere på hvad og hvor man kan hente hjælp. Eksperten.dk styrer!

Husk at acceptere svar :)

Selvklart - skulle bare lige finde ud af hvordan. Tak for hjælp!!!

Takker for point :-)