Anti-virus 360. :(

Hent og installér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Den bør du sige nej til.
Lad programmer foretage en oprydning.

Hent "Malwarebytes' Anti-Malware" her: http://www.besttechie.net/tools/mbam-setup.exe
Installer og start programmet, opdater, lav "fuld systemskanning" under fanebladet "skanner".
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind sammen med en log fra DDS som du finder her: http://www.techsupportforum.com/sectools/sUBs/dds

eller her: http://download.bleepingcomputer.com/sUBs/dds.scr

eller her: http://www.forospyware.com/sUBs/dds


Den laver to logs,(DDS.txt og Attach.txt) gem dem på skrivebordet og kopier indholdet af DDS.txt  herind.

OBS - DDS skal gemmes på på computeren og ikke køres fra nettet

Mht.: Vista - Højreklik på *.exe filen - Kør som Administrator.

Hvilken effekt vil det have?

Ccleaner laver en generel oprydning på din computer
Malwarbytes fjerner 'møget' og DDS.txt gør at jeg kan guide dig af med eventuelle rester.

Okay, det gør jeg lige så.

Hmm... Er det meningen at Malwarbytes skal lukke ned af sig selv?

Malwarbytes lukker hele tiden ned inden jeg når at få trykket, hvorfor?

Hvis du har fået installeret den, så find c:\Programmer\Malwarebytes' Anti-Malware med stifinder, og omdøb MBAM.EXE til nogetandet.exe

Så dobbeltklikker du på den og ser om den så vil.

Hej, undskyld jeg ikke lige har skrevet før nu, men jeg har været forhidret.
Du siger at jeg skal omdøbe MBAM.EXE til nogetandet.exe, men jeg jeg kan altså ikke finde noget inde i den mappe som hedder MBAM.EXE.
Har du nogen idé om hvorfor?

Nu tror jeg, at jeg fandt ud af det alligevel.

Hvordan virker DDS?

Jeg kan ikke rigtig finde ud at hvordan DDS virker..

Du klikker bare på den, vælger kør og gemmer de to filer den laver på dit skrivebord. Så kopierer du indholdet af DDS.txt her ind sammen med loggen fra malwarebytes.

Jeg har gemt den inde i en mappe, hvor alle de andre ting ligger.
Så klikker jeg på den og der kommer en pop-up hvor jeg kan vælge kør eller annuller, derefter åbner den og der kommer et vindue frem (ligner noget fra Windows 95) med noget tekst i, men der sker ikke noget.

Hej ;-)

Prøv og kør DDS igen - når det vindue med tekst kommer frem skal du ha´ tålmodighed.
Der kan godt gå 5 min inden de 2 logfiler kommer frem.

PS. Har du kørt "Malwarbytes" ?

Hej Arkil.

Okay det prøver jeg lige.
Ja, jeg har kørt Malwarbytes.

Her er Loggen fra DDS.

DDS (Ver_09-02-01.01) - NTFSx86 
Run by Nicklas at 15:00:48,22 on 17-03-2009
Internet Explorer: 7.0.6000.16809
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.45.1030.18.3070.1892 [GMT 1:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\vfsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Program Files\Acer\Acer Bio Protection\CompPtcVUI.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Windows\PLFSetI.exe
C:\Users\Nicklas\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\Windows\system32\agrsmsvc.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Windows\system32\rundll32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\p2phost.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Convesoft\Orion\Messenger.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Acer\Acer VCM\acp2HID.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Users\Nicklas\Desktop\Anti-virus\dds.scr
C:\Windows\system32\conime.exe

============== Pseudo HJT Report ===============

uStart Page = www.google.dk/
mStart Page = hxxp://da.intl.acer.yahoo.com
mDefault_Page_URL = hxxp://da.intl.acer.yahoo.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: NoExplorer - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
BHO: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Hjælp til tilmelding til Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [CollaborationHost] c:\windows\system32\p2phost.exe -s
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [eAudio] "c:\program files\acer\empowering technology\eaudio\eAudio.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [BkupTray] "c:\program files\newtech infosystems\nti backup now 5\BkupTray.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ZPdtWzdVitaKey MC3000] "c:\program files\acer\acer bio protection\PdtWzd.exe" show
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [eRecoveryService]
mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe"
mRun: [CLMLServer] "c:\program files\acer arcade deluxe\acer arcade deluxe\kernel\clml\CLMLSvc.exe"
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe"
mRun: [WarReg_PopUp] c:\program files\acer\wr_popup\WarReg_PopUp.exe
StartupFolder: c:\users\nicklas\appdata\roaming\micros~1\windows\startm~1\programs\startup\orion.lnk - c:\convesoft\orion\Messenger.exe
StartupFolder: c:\users\nicklas\appdata\roaming\micros~1\windows\startm~1\programs\startup\screen~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\bttray.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send billede til &Bluetooth-enhed... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send siden til &Bluetooth-enhed... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer\acer bio protection\PwdBank.exe
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: AWinNotifyVitaKey MC3000 - c:\program files\acer\acer bio protection\WinNotify.dll
LSA: Notification Packages = scecli c:\program files\acer\acer bio protection\PwdFilter

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [2008-5-15 43184]
R3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\system32\drivers\AVerAF15.sys [2008-3-25 281984]
R3 itecir;ITECIR Infrared Receiver;c:\windows\system32\drivers\itecir.sys [2008-3-25 54784]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\L1E60x86.sys [2008-3-25 48128]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-3-25 80912]

=============== Created Last 30 ================

2009-03-15 20:45    15,504    a-------    c:\windows\system32\drivers\mbam.sys
2009-03-15 20:45    38,496    a-------    c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-15 20:42    4,096    a-------    c:\windows\system32\msdxm.ocx
2009-03-15 20:42    4,096    a-------    c:\windows\system32\dxmasf.dll
2009-03-15 20:42    8,147,968    a-------    c:\windows\system32\wmploc.DLL
2009-03-15 20:42    269,824    a-------    c:\windows\system32\schannel.dll
2009-03-15 20:42    2,028,032    a-------    c:\windows\system32\win32k.sys
2009-03-15 20:28    <DIR>    --d-----    c:\program files\Malwarebytes' Anti-Malware
2009-03-13 15:50    <DIR>    --d-----    c:\users\nicklas\appdata\roaming\Malwarebytes
2009-03-13 15:50    <DIR>    --d-----    c:\programdata\Malwarebytes
2009-03-13 15:50    <DIR>    --d-----    c:\progra~2\Malwarebytes
2009-03-13 14:46    <DIR>    --d-----    c:\program files\CCleaner
2009-03-13 14:35    197    a-------    c:\windows\system32\MRT.INI
2009-03-13 14:29    550    a-------    c:\windows\wininit.ini

==================== Find3M  ====================

2009-03-17 14:56    493,914    a-------    c:\windows\system32\perfh006.dat
2009-03-17 14:56    84,876    a-------    c:\windows\system32\perfc006.dat
2009-03-16 18:44    28,029    a-------    c:\programdata\nvModes.dat
2009-03-16 18:44    28,029    a-------    c:\progra~2\nvModes.dat
2009-01-15 05:16    826,368    a-------    c:\windows\system32\wininet.dll
2009-01-15 05:16    56,320    a-------    c:\windows\system32\iesetup.dll
2009-01-15 05:16    52,736    a-------    c:\windows\apppatch\iebrshim.dll
2009-01-15 05:15    26,624    a-------    c:\windows\system32\ieUnatt.exe
2008-12-29 15:16    174    a--sh---    c:\program files\desktop.ini
2008-06-13 02:13    86,016    a-------    c:\windows\inf\infstrng.dat
2008-06-13 02:13    51,200    a-------    c:\windows\inf\infpub.dat
2008-06-13 02:13    665,600    a-------    c:\windows\inf\drvindex.dat
2008-06-13 02:13    86,016    a-------    c:\windows\inf\infstor.dat
2006-11-21 05:46    300,302    a-------    c:\windows\inf\perflib\0406\perfi.dat
2006-11-21 05:46    300,302    a-------    c:\windows\inf\perflib\0406\perfh.dat
2006-11-21 05:46    36,364    a-------    c:\windows\inf\perflib\0406\perfd.dat
2006-11-21 05:46    36,364    a-------    c:\windows\inf\perflib\0406\perfc.dat
2006-11-02 10:20    287,440    a-------    c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20    287,440    a-------    c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20    30,674    a-------    c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20    30,674    a-------    c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 15:03:11,93 ===============

blev nød til at køre Malwarbytes to gange, så her kommer den ene.

Malwarebytes' Anti-Malware 1.34
Database version: 1852
Windows 6.0.6000

15-03-2009 21:52:24
mbam-log-2009-03-15 (21-52-24).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 111442
Tid tilbagelagt: 1 hour(s), 3 minute(s), 16 second(s)

Inficerede Hukommelses Processer: 1
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 2
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 1

Inficerede Hukommelses Processer:
C:\Program Files\A360\av360.exe (Rogue.AV360) -> Unloaded process successfully.

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e4afcc350909c91ee9f5df8bc3b629e0 (Rogue.AV360) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\Program Files\A360\av360.exe (Rogue.AV360) -> Quarantined and deleted successfully.

Den anden:

Malwarebytes' Anti-Malware 1.34
Database version: 1852
Windows 6.0.6000

16-03-2009 15:44:43
mbam-log-2009-03-16 (15-44-43).txt

Skan type: Fuldstændig skanning (C:\|D:\|F:\|)
Objekter skannet: 153549
Tid tilbagelagt: 1 hour(s), 15 minute(s), 54 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 4
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 3
Inficerede Mapper: 0
Inficerede Filer: 1

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\cs41275 (Malware.Trace) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\Program Files\Common Files\System\Uninstall\Uninstall A360.lnk (Rogue.av360) -> Quarantined and deleted successfully.

--Hent Combofix, og gem den på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Luk alle andre vinduer ned.

Kør så Combofix.exe, og følg anvisningerne. (Vistabrugere skal klikke med højre-musetast på filen og vælge (Kør som administrator)

Vigtigt-> Deaktiver dit antivirus/antispyware program. Da det/de kan "forstyrre" og konflikte med Combofix, eller fjerne vigtige Combofix filer, hvilket kan få computeren til fryse.

Du må ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\ Combofix txt

Hvis logfilen ikke åbnes så finder du den her c:\combofix.txt
Indholdet af denne fil må du gerne lægge herind.

Vær tålmodig og vent til Combofix ruden lukker ned.

Hvilken effekt vil det have?

At vi kan se noget vi ikke kan se nu. Det er helt tydeligt at antivirus 360 ikke bliver udslettet med den information vi har lige nu.

Hvad mener du, F-arn?

Hvis du ikke lægger den logfil fra Combofix herind kommer vi ikke videre.

Nåeh okay.

Kan i så ikke lige give mig en detaljeret beskrivelse af hvad skal gøre. Altså en guide.

- Hvad vil det sige at min computer kan "fryse"?

Det du skal gøre står her >17. marts 2009 kl. 16:48:07< > Husk at deaktiver din anti-virusprogram.
Nu kender jeg ikke Mcafee men det kan være Vshield og VirusScan du skal deaktivere.

1.    Højreklik på ikonet M ved systemuret.
2.    Klik for at vælge det program, du vil deaktivere, og klik derefter på Disable.
3.    Klik Ja for at bekræfte dit valg.

Serveren M skifter muligvis til sort, indtil programmet er genaktiveret

Så skal klikke med højre-musetast på filen Combofix.exe og vælge (Kør som administrator)

Sig "nej" til at  installer "Genoprettelseskonsol" når den spørger > Svar ja til andet den spørger om.

PS: At Computeren" Frøser" > Computeren låser  sig fast.

Hmm... Når jeg trykker på det link det at downloade combofix, åbner den det der vindue med "kør", "Gem" og "Anuller". Hvis jeg så klikker på Kør lukker den bare vinduet ned og det sker ikke mere, det samme sker ved Gem. Hvorfor?

- Hvis min computer "fryser" vil det så sige, at den går fuldstændig i stå, så man ikke kan gøre noget mere, også selvom man genstarter?

Det kan være den infektion der blokerer for Combofix.
Prøv om du kan hente Combofix på denne måde > Læs nu linket godt igennem så du gør det rigtigt.
Du gemmer den på skrivebordet > Husk at højreklik på Combo-fix > Kør som administrator.

http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=186&PN=1

Okay, det prøver jeg lige så.

- Hvis min computer "fryser" vil det så sige, at den går fuldstændig i stå, så man ikke kan gøre noget mere, også selvom man genstarter?

Det vil sige den går i stå og ikke svarer, en genstart løser for det meste det problem.
Jeg skriver igen > Du skal ha´ tålmodighed.
Når du klikker "Kør som administrator" kan der gå lang tid inden der sker noget - der kan godt gå 20 min inden Combofix er kør færdig og lukker vinduet ned.
PS. Klik ikke på vinduet når værktøjet kører.

Er det den her log?



ComboFix 09-03-19.02 - Nicklas 2009-03-22 11:59:05.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.1.1030.18.3070.2055 [GMT 1:00]
Kører fra: c:\users\Nicklas\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *enabled*
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Acer\Acer Bio Protection\PwdFilter.dll
.
---- Forrige Kørsel -------
.
c:\program files\Acer\Acer Bio Protection\PwdFilter.dll
c:\program files\Common Files\System\Uninstall
c:\users\Nicklas\AppData\Roaming\.#
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@1342990.###
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@13429C0.###
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@13429F0.###

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-02-22 til 2009-03-22  )))))))))))))))))))))))))))))))))))
.

2009-03-22 11:43 . 2009-03-22 11:43    374,230,057    --a------    c:\windows\MEMORY.DMP
2009-03-22 10:58 . 2009-03-22 10:58    <DIR>    d--------    c:\program files\Convesoft
2009-03-21 14:49 . 2008-12-05 05:29    1,244,672    --a------    c:\windows\System32\mcmde.dll
2009-03-21 14:49 . 2008-12-05 05:29    428,032    --a------    c:\windows\System32\EncDec.dll
2009-03-21 14:49 . 2008-12-05 05:29    292,352    --a------    c:\windows\System32\psisdecd.dll
2009-03-21 14:49 . 2008-12-05 05:29    217,088    --a------    c:\windows\System32\psisrndr.ax
2009-03-21 14:49 . 2008-12-05 05:29    177,152    --a------    c:\windows\System32\mpg2splt.ax
2009-03-21 14:49 . 2008-12-05 05:29    80,896    --a------    c:\windows\System32\MSNP.ax
2009-03-21 14:49 . 2008-12-05 05:29    68,608    --a------    c:\windows\System32\Mpeg2Data.ax
2009-03-21 14:49 . 2008-12-05 05:29    57,856    --a------    c:\windows\System32\MSDvbNP.ax
2009-03-15 20:45 . 2009-02-11 10:19    38,496    --a------    c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-15 20:45 . 2009-02-11 10:19    15,504    --a------    c:\windows\System32\drivers\mbam.sys
2009-03-15 20:42 . 2008-12-16 05:00    8,147,968    --a------    c:\windows\System32\wmploc.DLL
2009-03-15 20:42 . 2009-02-09 02:59    2,028,032    --a------    c:\windows\System32\win32k.sys
2009-03-15 20:42 . 2008-11-27 05:42    269,824    --a------    c:\windows\System32\schannel.dll
2009-03-15 20:42 . 2008-12-16 06:53    4,096    --a------    c:\windows\System32\msdxm.ocx
2009-03-15 20:42 . 2008-12-16 06:53    4,096    --a------    c:\windows\System32\dxmasf.dll
2009-03-15 20:28 . 2009-03-15 20:47    <DIR>    d--------    c:\program files\Malwarebytes' Anti-Malware
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\users\Nicklas\AppData\Roaming\Malwarebytes
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\users\All Users\Malwarebytes
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\programdata\Malwarebytes
2009-03-13 14:46 . 2009-03-13 14:46    <DIR>    d--------    c:\program files\CCleaner
2009-03-13 14:35 . 2009-03-16 13:58    197    --a------    c:\windows\System32\MRT.INI
2009-03-13 14:29 . 2009-03-16 16:03    550    --a------    c:\windows\wininit.ini

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-22 09:52    ---------    d-----w    c:\program files\McAfee
2009-03-21 14:38    ---------    d-----w    c:\program files\Yahoo!
2009-03-21 14:15    ---------    d-----w    c:\program files\Norton Security Scan
2009-03-16 17:44    28,029    ----a-w    c:\users\All Users\nvModes.dat
2009-03-16 17:44    28,029    ----a-w    c:\programdata\nvModes.dat
2009-03-16 13:05    ---------    d-----w    c:\program files\Windows Mail
2009-03-16 12:41    ---------    d-----w    c:\program files\Google
2009-03-13 15:49    ---------    d-----w    c:\users\Nicklas\AppData\Roaming\DNA
2009-03-13 14:42    ---------    d-----w    c:\program files\MP3 Remix
2009-02-08 22:53    ---------    d-----w    c:\program files\Enigma Software Group
2009-01-15 04:16    52,736    ----a-w    c:\windows\AppPatch\iebrshim.dll
2008-12-29 14:16    174    --sha-w    c:\program files\desktop.ini
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 23:38    121392    --a------    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-25 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-15 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"CollaborationHost"="c:\windows\system32\p2phost.exe" [2006-11-02 191488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-03-11 397312]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-02-25 34040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-07 13527584]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-07 92704]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-03 178712]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-05-15 3642368]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-03-13 805384]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-03-05 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-03-05 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-03-04 167936]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-11 c:\windows\RtHDVCpl.exe]

c:\users\Nicklas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Orion.lnk - c:\program files\Convesoft\Orion\Messenger.exe [2008-04-16 4685824]
Screen Clipper and Launcher til OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-05-14 1216512]
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-04-24 723760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-05-15 02:06 3024384 c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FB11BD18-940E-4472-974E-0E473EEC0D73}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{FC1FF12D-61BC-4F8E-A313-D1408F21DFE3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5FB4B6A5-0F0B-4E9E-AE7D-E1AF36915FB8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DCC781FD-6BA6-48C8-8C1E-7E7EE3006FB6}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{984E0D41-AA0A-47CB-8D65-529BFBACB661}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{6EAAD0EE-FE85-4349-A718-21C1F23F2F00}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{A7A42ED4-F055-4A7C-8126-213AA3467856}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{4D5F0A28-9DF6-481D-B1E9-7793136F1A37}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{5F744AEB-7E4D-4E78-A322-C6977FA70AC2}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{BEA38217-1E95-4FAB-A6C8-D05A2D6EF148}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{CCDE6F3D-C94C-421C-9417-C60D143DAB13}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B079ABBC-1A8C-48B1-A11B-0E5542DADB4C}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{D55C2A05-D9F3-4BD2-9EEB-5FE286C73614}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"{E9FABC21-E496-4E1D-BF11-61F6C68DCE49}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{1FBDC894-5FA2-4733-A499-BAA45A5E4B6E}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{B0C9FBDB-A022-4500-AA24-20A18613B493}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9803695B-78CF-4310-B71C-74AFC0157FD8}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{7698AA8E-EAA9-4B76-A816-767859B7B511}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\System32\drivers\AlfaFF.sys [2008-05-15 43184]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-05-14 122368]
R3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\System32\drivers\AVerAF15.sys [2008-03-25 281984]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [2008-03-25 54784]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\System32\drivers\L1E60x86.sys [2008-03-25 48128]
S3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-03-25 80912]

--- Andre Services/Drivers i Hukommelsen ---

*Deregistered* - {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}
*Deregistered* - tcpipreg
*Deregistered* - tdx
*Deregistered* - TermDD
*Deregistered* - tunmp
*Deregistered* - tunnel
*Deregistered* - UBHelper
*Deregistered* - umbus
*Deregistered* - VgaSave
*Deregistered* - volmgr
*Deregistered* - volmgrx
*Deregistered* - volsnap
*Deregistered* - Wanarpv6
*Deregistered* - Wdf01000

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    REG_MULTI_SZ      BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed5ceef6-446c-11dd-b334-00a0d1a3e8fc}]
\shell\AutoRun\command - e:\wd_windows_tools\WDEULA.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edcf3012-b3cd-11dd-a8f9-001de08f3321}]
\shell\AutoRun\command - wd_windows_tools\setup.exe
.
Indhold af mappen 'Planlagte Opgaver'

2008-03-25 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2009-02-08 c:\windows\Tasks\Norton Security Scan for Nicklas.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2009-03-22 c:\windows\Tasks\User_Feed_Synchronization-{D9B30BB4-63C0-47D4-A444-A174F9308500}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 10:45]
.
- - - - TOMME GENVEJE FJERNET - - - -

HKLM-Run-eRecoveryService - (no file)


.
------- Yderligere scanning -------
.
uStart Page = www.google.dk/
mStart Page = hxxp://da.intl.acer.yahoo.com
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send billede til &Bluetooth-enhed... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send siden til &Bluetooth-enhed... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-22 12:06:12
Windows 6.0.6000  NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 


c:\users\Nicklas\AppData\Local\Temp\catchme.dll 53248 bytes executable

scanning gennemført med succes
skjulte filer: 1

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'Explorer.exe'(4692)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\btmmhook.dll
c:\windows\System32\SysHook.dll
c:\windows\system32\btncopy.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\vfsFPService.exe
c:\windows\System32\rundll32.exe
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\McAfee\SiteAdvisor\McSACore.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\windows\System32\rundll32.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Acer\Acer VCM\RS_Service.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Launch Manager\LManager.exe
c:\users\Nicklas\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\Acer\Acer Bio Protection\PwdBank.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
c:\windows\ehome\ehsched.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\program files\Acer\Acer VCM\acp2HID.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Gennemført tid: 2009-03-22 12:12:42 - maskinen blev genstartet [Nicklas]
ComboFix-quarantined-files.txt  2009-03-22 11:12:16

Pre-Kørsel: 104,460,894,208 byte ledig
Post-Kørsel: 104,344,743,936 byte ledig

274    --- E O F ---    2009-03-22 09:57:39

Drop fildeling >> http://spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

Åbn et Notesblokvindue, kopiér indholdet med fed skrift ind i dokumentet, og gem indholdet samme sted, som Combofix ligger med navnet CFScript.txt Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".


Killall::
Snapshot::
File::
c:\windows\Tasks\Norton Security Scan for Nicklas.job
Folder::
c:\program files\DNA
c:\program files\BitTorrent
c:\users\Nicklas\AppData\Roaming\DNA
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9803695B-78CF-4310-B71C-74AFC0157FD8}"=-
"{7698AA8E-EAA9-4B76-A816-767859B7B511}"=-



Tag så fat i den nye fil med musen, og før den hen over ikonet for Combofix, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Kopier den logfil  herind.

Sådan.. så skulle det være gjordt.

ComboFix 09-03-19.02 - Nicklas 2009-03-23 14:13:44.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.1.1030.18.3070.1875 [GMT 1:00]
Kører fra: c:\users\Nicklas\Desktop\Combo-Fix.exe
Kommandoer benyttet :: c:\users\Nicklas\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*
* Dannede nyt systemgendannelsespunkt

FILE ::
c:\windows\Tasks\Norton Security Scan for Nicklas.job
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\BitTorrent
c:\program files\BitTorrent\bittorrent.exe
c:\program files\BitTorrent\BitTorrentIE.2.dll
c:\program files\BitTorrent\uninst.exe
c:\program files\DNA
c:\program files\DNA\btdna.exe
c:\program files\DNA\DNAcpl.cpl
c:\program files\DNA\plugins\npbtdna.dll
c:\windows\Tasks\Norton Security Scan for Nicklas.job
.
---- Forrige Kørsel -------
.
c:\program files\Acer\Acer Bio Protection\PwdFilter.dll
c:\program files\Common Files\System\Uninstall
c:\users\Nicklas\AppData\Roaming\.#
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@1342990.###
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@13429C0.###
c:\users\Nicklas\AppData\Roaming\.#\MBX@1930@13429F0.###

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-02-23 til 2009-03-23  )))))))))))))))))))))))))))))))))))
.

2009-03-22 11:43 . 2009-03-22 11:43    374,230,057    --a------    c:\windows\MEMORY.DMP
2009-03-22 10:58 . 2009-03-22 10:58    <DIR>    d--------    c:\program files\Convesoft
2009-03-21 14:49 . 2008-12-05 05:29    1,244,672    --a------    c:\windows\System32\mcmde.dll
2009-03-21 14:49 . 2008-12-05 05:29    428,032    --a------    c:\windows\System32\EncDec.dll
2009-03-21 14:49 . 2008-12-05 05:29    292,352    --a------    c:\windows\System32\psisdecd.dll
2009-03-21 14:49 . 2008-12-05 05:29    217,088    --a------    c:\windows\System32\psisrndr.ax
2009-03-21 14:49 . 2008-12-05 05:29    177,152    --a------    c:\windows\System32\mpg2splt.ax
2009-03-21 14:49 . 2008-12-05 05:29    80,896    --a------    c:\windows\System32\MSNP.ax
2009-03-21 14:49 . 2008-12-05 05:29    68,608    --a------    c:\windows\System32\Mpeg2Data.ax
2009-03-21 14:49 . 2008-12-05 05:29    57,856    --a------    c:\windows\System32\MSDvbNP.ax
2009-03-15 20:45 . 2009-02-11 10:19    38,496    --a------    c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-15 20:45 . 2009-02-11 10:19    15,504    --a------    c:\windows\System32\drivers\mbam.sys
2009-03-15 20:42 . 2008-12-16 05:00    8,147,968    --a------    c:\windows\System32\wmploc.DLL
2009-03-15 20:42 . 2009-02-09 02:59    2,028,032    --a------    c:\windows\System32\win32k.sys
2009-03-15 20:42 . 2008-11-27 05:42    269,824    --a------    c:\windows\System32\schannel.dll
2009-03-15 20:42 . 2008-12-16 06:53    4,096    --a------    c:\windows\System32\msdxm.ocx
2009-03-15 20:42 . 2008-12-16 06:53    4,096    --a------    c:\windows\System32\dxmasf.dll
2009-03-15 20:28 . 2009-03-15 20:47    <DIR>    d--------    c:\program files\Malwarebytes' Anti-Malware
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\users\Nicklas\AppData\Roaming\Malwarebytes
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\users\All Users\Malwarebytes
2009-03-13 15:50 . 2009-03-13 15:50    <DIR>    d--------    c:\programdata\Malwarebytes
2009-03-13 14:46 . 2009-03-13 14:46    <DIR>    d--------    c:\program files\CCleaner
2009-03-13 14:35 . 2009-03-16 13:58    197    --a------    c:\windows\System32\MRT.INI
2009-03-13 14:29 . 2009-03-16 16:03    550    --a------    c:\windows\wininit.ini

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-22 09:52    ---------    d-----w    c:\program files\McAfee
2009-03-21 14:38    ---------    d-----w    c:\program files\Yahoo!
2009-03-21 14:15    ---------    d-----w    c:\program files\Norton Security Scan
2009-03-16 17:44    28,029    ----a-w    c:\users\All Users\nvModes.dat
2009-03-16 17:44    28,029    ----a-w    c:\programdata\nvModes.dat
2009-03-16 13:05    ---------    d-----w    c:\program files\Windows Mail
2009-03-16 12:41    ---------    d-----w    c:\program files\Google
2009-03-13 14:42    ---------    d-----w    c:\program files\MP3 Remix
2009-02-08 22:53    ---------    d-----w    c:\program files\Enigma Software Group
2009-01-15 04:16    52,736    ----a-w    c:\windows\AppPatch\iebrshim.dll
2008-12-29 14:16    174    --sha-w    c:\program files\desktop.ini
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 23:38    121392    --a------    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-25 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-15 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"CollaborationHost"="c:\windows\system32\p2phost.exe" [2006-11-02 191488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-03-11 397312]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-02-25 34040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-07 13527584]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-07 92704]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-03 178712]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-05-15 3642368]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-03-13 805384]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-03-05 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-03-05 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-03-04 167936]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-11 c:\windows\RtHDVCpl.exe]
"eRecoveryService"="" [BU]

c:\users\Nicklas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Orion.lnk - c:\program files\Convesoft\Orion\Messenger.exe [2008-04-16 4685824]
Screen Clipper and Launcher til OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-05-14 1216512]
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-04-24 723760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-05-15 02:06 3024384 c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FB11BD18-940E-4472-974E-0E473EEC0D73}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{FC1FF12D-61BC-4F8E-A313-D1408F21DFE3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5FB4B6A5-0F0B-4E9E-AE7D-E1AF36915FB8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DCC781FD-6BA6-48C8-8C1E-7E7EE3006FB6}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{984E0D41-AA0A-47CB-8D65-529BFBACB661}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{6EAAD0EE-FE85-4349-A718-21C1F23F2F00}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{A7A42ED4-F055-4A7C-8126-213AA3467856}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{4D5F0A28-9DF6-481D-B1E9-7793136F1A37}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{5F744AEB-7E4D-4E78-A322-C6977FA70AC2}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{BEA38217-1E95-4FAB-A6C8-D05A2D6EF148}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{CCDE6F3D-C94C-421C-9417-C60D143DAB13}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B079ABBC-1A8C-48B1-A11B-0E5542DADB4C}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{D55C2A05-D9F3-4BD2-9EEB-5FE286C73614}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"{E9FABC21-E496-4E1D-BF11-61F6C68DCE49}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{1FBDC894-5FA2-4733-A499-BAA45A5E4B6E}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{B0C9FBDB-A022-4500-AA24-20A18613B493}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
"c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\System32\drivers\AlfaFF.sys [2008-05-15 43184]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-05-14 122368]
R3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\System32\drivers\AVerAF15.sys [2008-03-25 281984]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [2008-03-25 54784]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\System32\drivers\L1E60x86.sys [2008-03-25 48128]
S3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-03-25 80912]

--- Andre Services/Drivers i Hukommelsen ---

*Deregistered* - {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}
*Deregistered* - tcpipreg
*Deregistered* - tdx
*Deregistered* - TermDD
*Deregistered* - tunmp
*Deregistered* - tunnel
*Deregistered* - UBHelper
*Deregistered* - umbus
*Deregistered* - VgaSave
*Deregistered* - volmgr
*Deregistered* - volmgrx
*Deregistered* - volsnap
*Deregistered* - Wanarpv6
*Deregistered* - Wdf01000

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    REG_MULTI_SZ      BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed5ceef6-446c-11dd-b334-00a0d1a3e8fc}]
\shell\AutoRun\command - e:\wd_windows_tools\WDEULA.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edcf3012-b3cd-11dd-a8f9-001de08f3321}]
\shell\AutoRun\command - wd_windows_tools\setup.exe
.
Indhold af mappen 'Planlagte Opgaver'

2008-03-25 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2009-03-23 c:\windows\Tasks\User_Feed_Synchronization-{D9B30BB4-63C0-47D4-A444-A174F9308500}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 10:45]
.
.
------- Yderligere scanning -------
.
uStart Page = www.google.dk/
mStart Page = hxxp://da.intl.acer.yahoo.com
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send billede til &Bluetooth-enhed... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send siden til &Bluetooth-enhed... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-23 14:22:48
Windows 6.0.6000  NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'Explorer.exe'(5880)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\btmmhook.dll
c:\windows\System32\SysHook.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\vfsFPService.exe
c:\windows\System32\rundll32.exe
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\McAfee\SiteAdvisor\McSACore.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\windows\System32\rundll32.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Acer\Acer VCM\RS_Service.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\conime.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\windows\System32\rundll32.exe
c:\program files\Launch Manager\LManager.exe
c:\users\Nicklas\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Acer\Acer Bio Protection\PwdBank.exe
c:\windows\ehome\ehmsas.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Acer\Acer VCM\acp2HID.exe
c:\program files\McAfee\MSC\mcuimgr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Gennemført tid: 2009-03-23 14:28:41 - maskinen blev genstartet [Nicklas]
ComboFix-quarantined-files.txt  2009-03-23 13:28:26
ComboFix2.txt  2009-03-22 11:12:46

Pre-Kørsel: 103,344,652,288 byte ledig
Post-Kørsel: 104,248,201,216 byte ledig

278    --- E O F ---    2009-03-22 09:57:39





Men hvordan "dropper" jeg fildeling??

Men hvordan ser det ellers ud, er min computer ren?


Men hvordan "dropper" jeg fildeling??

Din log er ren, slet mappen med fed skrift.

c:\program files\Norton Security Scan

Jeg vil gerne se en log fra HijackThis.

1. Hent nyeste version af HijackThis ned til skrivebordet.

2. Dobbeltklik på installationsfilen, og følg installationsvejledningen.

3. Dobbeltklik på det nye HijackThis ikon på skrivebordet.

4. På menuen der kommer op, klikker du på: Do a systemscan and save a logfile.

5. Efter et kort øjeblik åbner en logfil i notesblok, kopier teksten herind.

6. Hvis du ikke selv vælger at gemme loggen på skrivebordet, bliver den automatisk gemt på destinationen: C:/Programmer/hijackthis.log hvor du senere kan finde den.

http://sptlarsenserious.googlepages.com/HJT-sfx.exe

PS.: "Drop fildeling" > Det vil sige du ikke skal bruge fildelingsprogrammer.

Husk at kør filerne som administrator.

arkil@ Ovenstående link kan meget nemt "trigge" McAfee

Hvad er fildelingsprogrammer?

Trigge?

Jeg troede du havde læst  det link her > >22. marts 2009 kl. 16:23:02<

Kommer der en log fra HijackThis ?

Den kommer her:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13, on 2009-03-24
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16809)
Boot mode: Normal

Running processes:
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Windows\PLFSetI.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\p2phost.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Convesoft\Orion\Messenger.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\Users\Nicklas\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer\Acer VCM\acp2HID.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Internet Explorer\ieuser.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://da.intl.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
O4 - Startup: Orion.lnk = C:\Program Files\Convesoft\Orion\Messenger.exe
O4 - Startup: Screen Clipper and Launcher til OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Acer VCM.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send billede til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send siden til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe

--
End of file - 10875 bytes

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Vi skal ikke se flere logs.

Hvis din PC kører som den skal er det tid til oprydning.

Tryk på windows tast + R. Skriv Combofix /u  (Enter) det vil fjerne Combofix, husk mellemrum efter Combofix.

Når det er gjort skal du rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=4&PN=1) - vent et par minutter - aktiver systemgendannelse. Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Systemgendannelse og lav et systemgendannelsespunkt, så du har det at vende tilbage til, hvis noget går galt.

God fornøjelse

Er det meningen at nederståendene stadig skal være der?
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Jeg kan heller ikke få den til at fjerne Combofix. Jeg trykker på det der windows flag imellem Fn og Alt. Så åbner den vinduet "Kør" så skriver jeg "Combofix /u" og trykker enter, men så åbner den bare et vindue hvor der står: "Windows kan ikke finde Combofix. Kontroller at du skrev nevnet korrekt, og forsøg derefter igen."

Det var nok fordi vi omdøbte den, prøv og skriv Combo-fix /u

Hjalp det?

Prøver jeg lige...

Skulle jeg helt afinstalere Norton Security Scan?

Ja, du har jo McAfee som anti-virusprogram.
Hvis du ikke kan fix de 2 linje så fred være med dem > Det er kun kosmetisk - de betyder intet for din PC.
Det er den sikkerhed der er i "Vista" - du kan fjerne dem ved at fix dem fra fejlsikret tilstand.

Den kan heller ikke finde Combofix når jeg skriver Combo-fix /u..

Prøv og omdøb den fil på skrivebordet til ComboFix.exe > Skriv så i kør > ComboFix /u
Husk mellemrum efter Combofix > Nu skal det lykkes?

Nej stadig ikke.. :/

Jeg har aldrig været udsat for  dette her.
Så slet den manuelt > Slet de mapper med fed skrift > C:\Windows\erdnt > C:\Qoobox
Slet filen Combofix på skrivebordet.

Genstart og rens så med Ccleaner > Kør både "Rens" og "Register".

Undskyld, mit fraværd.
Det prøver jeg lige så.

Så er de slettet, men mapperne Combo-fix og Combofix.exe ligger stadig på mit C drev. Altså mapperne med installations filerne.

Jeg har set du har oprettet  en ny tråd for  at få Combofix Afinstalleret.
Gør dette >

Start > Alle programmer > Accessories (tilbehør) > Højreklik på "Command Prompt" > Kør som administrator.

Skriv ved "Prompt" dette og tast Enter efter hver linje.

cd\
rd combo-fix /s
rd combofix /s

Det vil slette de mapper hvis du gør det rigtigt.

Du må undskylde, jeg skrev forkert.
Du skal skrive dette og tast  Enter efter hver linje.

cd\
rd c:\combo-fix /s
rd c:\combofix /s

Okay, det prøver jeg lige så.

Så skriver den bare: "Den angivne fil blev ikke fundet."

Men mappen der hed "Combo-fix" forsvandt da jeg skrev
cd\
rd combo-fix /s

Ahaa, nu fandt jeg ud af det, det var fordi jeg skulle skrive Combofix.exe.

Nu har du vist ikke flere problemer med den Combofix i den her omgang?

Det tror/håber jeg heller ikke.. (:

Jeg har lige oprettet et manuelt systemgendannelses punkt, ved at: åbne systemgendannelse > åbnede systembeskyttelse > trykkede på opret > Derefter oprettede den et punk. Er det nok, eller skal jeg også gøre dette :

Når det er gjort skal du rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=4&PN=1) - vent et par minutter - aktiver systemgendannelse. Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Systemgendannelse og lav et systemgendannelsespunkt, så du har det at vende tilbage til, hvis noget går galt.

I så fald, hvordan får jeg deaktivere jeg systemgendannelse?

Hmm.. Jeg genstartede lige min computer, hvorefter jeg lagde mærke til, at det gendannelsespunkt jeg oprettede lige før, ikke længere er der. hvorfor ikke ?

??

Se om det kan hjælpe dig.

http://windowshelp.microsoft.com/Windows/da-DK/help/517d3b8e-3379-46c1-b479-05b30d6fb3f01030.mspx

Prøver lige. :)

Tusinde tak, arkil. (: Jeg er så taknemlig over du har brugt din tid, på at hjælpe mig med mit problem. Tusinde Mange Mange tak :)
- Du kan evt. lige oprette et svar her: " http://www.eksperten.dk/spm/869584#reply_7356409 ", hvis det er..