Her er log'en fra CC cleaner
Malwarebytes' Anti-Malware 1.35
Database version: 1929
Windows 5.1.2600 Service Pack 3
01-04-2009 20:04:37
mbam-log-2009-04-01 (20-04-37).txt
Skan type: Fuldstændig skanning (C:\|)
Objekter skannet: 195758
Tid tilbagelagt: 1 hour(s), 20 minute(s), 18 second(s)
Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 6
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 1
Inficerede Filer: 78
Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)
Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Nøgler:
HKEY_CLASSES_ROOT\iehlprobj.iehlprobj.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ce7c3ce2-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ce7c3cef-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ce7c3cf0-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ce7c3cf0-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce7c3cf0-4b15-11d1-abed-709549c10000} (Trojan.BHO) -> Quarantined and deleted successfully.
Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)
Inficerede Mapper:
C:\Programmer\RelevantKnowledge (Spyware.Marketscore) -> Quarantined and deleted successfully.
Inficerede Filer:
C:\Program Files\NetSoftware\IEHelper.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Casper Fischer\Dokumenter\Nero\Nero 6.6.0.3 Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Programmer\DVDFab 5\universal.dvdfab.platinum.5-patch.2.2.exe (Rogue.Patch) -> Quarantined and deleted successfully.
C:\Programmer\RelevantKnowledge\rloci.bin (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Programmer\RelevantKnowledge\rlservice.exe (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Programmer\RelevantKnowledge\sporder.dll (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddeml32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\ddccccd.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\ddeutd.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\ddr7xm.dl (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\ddcyx.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dbghelpa.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dbi102.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\destrub.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\deviceemulator.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DBGENG32.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DBGHELP32.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DBMSRPCN32.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DCIMAN3232.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DCIMAN323232.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DDRAWEX32.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\DESKMON32.DLL (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dcmhlp.exe (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\devicesec.exe (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\dbi121.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\dchwbclq.exe (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcAtTmn.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dcac1_r.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Delete on reboot.
C:\WINDOWS\system32\dellog32.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\deb3\tewdrives22.exe (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\devmg.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\DcadsSocial-uninstall.exe (Adware.RightOnAds) -> Delete on reboot.
C:\WINDOWS\system32\delFSF.bat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\ddcca.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\delobevu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddifsgso.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddaya.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\deljqcxf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defowija.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\DDCCABC.DLL (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\DDCCAXU.DLL (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dehafunu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dbwivf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dejlkg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcywvv.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defanuvo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dekuwisu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcawtt.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddccbax.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dehehoji.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcbcax.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dbtuke.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defariha.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dejufedu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defupabo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dehitogu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defarewo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\deskmono.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcbyyw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\defisebe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ddcbcbb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dbldrv.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\dbxdrv.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\dbgExp32.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\default.htm (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\ddllup.dll (Trojan.Zlob) -> Delete on reboot.
C:\WINDOWS\system32\dcggain.dll (Trojan.Zlob) -> Delete on reboot.
C:\WINDOWS\system32\dcstream.dll (Malware.Trace) -> Delete on reboot.
C:\WINDOWS\system32\ddabx.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\DEBUG.DLL (Rootkit.Haxdor) -> Delete on reboot.
C:\WINDOWS\system32\deflib.sys (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dbnetlib32.dll (Worm.P2P) -> Delete on reboot.
C:\WINDOWS\system32\dbnmpntw32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dekoleha.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dconook32.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dctool32.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dcads-remove.exe (Adware.Adrotator) -> Delete on reboot.
Og her er fra HiJackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:09, on 01-04-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmer\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Programmer\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programmer\AVG\AVG8\avgcsrvx.exe
C:\Programmer\Fælles filer\InstallShield\UpdateService\issch.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Fælles filer\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Steam\Steam.exe
C:\Programmer\ErrorFix\ErrorFix.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Windows Desktop Search\WindowsSearch.exe
C:\Programmer\OpenOffice.org 3\program\soffice.exe
C:\Programmer\OpenOffice.org 3\program\soffice.bin
C:\Program Files\NetSoftware\NetSoftware.exe
C:\Programmer\Fælles filer\Nero\Lib\NMIndexingService.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Opera\opera.exe
C:\Programmer\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Documents and Settings\Casper Fischer\Skrivebord\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmer\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programmer\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmer\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FLLESF~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmer\Fælles filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NetSoftware] "C:\Program Files\NetSoftware\Starter.exe" /path="C:\Program Files\NetSoftware"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programmer\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Programmer\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Blog det - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmer\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog det i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmer\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -
http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmer\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmer\Fælles filer\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 7744 bytes