Er der en som kan hjælpe med Hijack

Hent "Malwarebytes' Anti-Malware" her: http://www.besttechie.net/tools/mbam-setup.exe
Installer og start programmet, opdater, lav "fuld systemskanning" under fanebladet "skanner".
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind sammen med en log fra DDS som du finder her: http://download.bleepingcomputer.com/sUBs/dds.scr

eller her: http://www.forospyware.com/sUBs/dds


Den laver to logs,(DDS.txt og Attach.txt) gem dem på skrivebordet og kopier indholdet af DDS.txt  herind.

OBS - DDS skal gemmes på på computeren og ikke køres fra nettet

Malwarebytes' Anti-Malware 1.37
Database version: 2188
Windows 5.1.2600 Service Pack 3

28-05-2009 19:38:48
mbam-log-2009-05-28 (19-38-48).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 164470
Tid tilbagelagt: 36 minute(s), 57 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 7

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
c:\WINDOWS\system32\sysloc\sysloc.dll (Trojan.BHO) -> Quarantined and deleted successfully.
c:\WINDOWS\9g2234wesdf3dfgjf23 (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\f23567.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SYSDLL.exe (Trojan.Agent) -> Delete on reboot.
c:\WINDOWS\sonce122712.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\sonce123198.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\sonce122688.dat (Worm.KoobFace) -> Quarantined and deleted successfully.

DDS (Ver_09-05-14.01) - FAT32x86 
Run by jette at 19:42:44,14 on 28-05-2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1033.18.502.182 [GMT 2:00]

AV: BullGuard Antivirus *On-access scanning enabled* (Updated)  {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}
FW: BullGuard Firewall *enabled*  {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe -k BullGuard
C:\WINDOWS\System32\svchost.exe -k BullGuardFw
SVCHOST.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
SVCHOST.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jette\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://da.intl.acer.yahoo.com/
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
uRun: [BullGuard] "c:\program files\bullguard software\bullguard\bullguard.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\Monitor.exe
mRun: [BullGuard] "c:\program files\bullguard software\bullguard\bullguard.exe" -boot
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ePower_DMC] c:\acer\empowering technology\epower\ePower_DMC.exe
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunOnce: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: danid.dk
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} - hxxps://danid.dk/csp/authenticode/csp.exe
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {2D3A32E7-179E-423F-BF2D-E1F9E9678BB9} = 213.174.139.72,10.20.63.141
TCP: {58F4D272-58B8-4A18-83CA-70C9C585DC53} = 213.174.139.72,10.20.63.141
TCP: {B9888F38-A4A3-474D-9D70-9483288348DE} = 213.174.139.72,10.20.63.141
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: 1d0f11d5448 - c:\windows\system32\pifmgr32.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\windows\system32\pifmgr32.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R1 OsaFsLoc;OsaFsLoc;c:\windows\system32\drivers\OsaFsLoc.sys [2005-10-15 12106]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R1 VFILT;BullGuard Firewall Kernel Driver;c:\program files\bullguard software\bullguard\fwengine\Filtnt.sys [2006-10-27 125216]
R2 BdFileSpy;BullGuard File Monitor Driver;c:\windows\system32\drivers\BdFileSpy.sys [2007-1-29 50896]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-6-30 7296]
R2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-1-14 4010]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
R3 PROTECT.DLL;BullGuard Firewall Protection Plugin;c:\program files\bullguard software\bullguard\fwengine\Protect.dll [2006-10-27 16960]
R3 Reconn;BullGuard Email Monitor;c:\program files\bullguard software\bullguard\Reconn.sys [2006-10-27 16984]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 ADBLOCK.DLL;BullGuard Firewall Adware Plugin;\??\c:\program files\bullguard software\bullguard\fwengine\adblock.dll --> c:\program files\bullguard software\bullguard\fwengine\AdBlock.dll [?]
S3 HTMLFILT.DLL;BullGuard Firewall HTML Plugin;\??\c:\program files\bullguard software\bullguard\fwengine\htmlfilt.dll --> c:\program files\bullguard software\bullguard\fwengine\HtmlFilt.dll [?]
S3 HTTPFILT.DLL;BullGuard Firewall HTTP Plugin;\??\c:\program files\bullguard software\bullguard\fwengine\httpfilt.dll --> c:\program files\bullguard software\bullguard\fwengine\HttpFilt.dll [?]
S3 NdisFilt;OSA NdisFilter Protocol;c:\windows\system32\drivers\NdisFilt.sys [2005-9-13 4392]

=============== Created Last 30 ================

2009-05-28 19:42    61,440    a-------    c:\windows\system32\drivers\ajpbwwba.sys
2009-05-28 12:57    <DIR>    --d-----    c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-05-28 12:57    <DIR>    --d-----    c:\program files\SUPERAntiSpyware
2009-05-28 12:57    <DIR>    --d-----    c:\docume~1\jette\applic~1\SUPERAntiSpyware.com
2009-05-28 12:48    <DIR>    --d-----    c:\windows\pss
2009-05-28 12:38    <DIR>    --d-----    c:\program files\CCleaner
2009-05-28 12:22    <DIR>    --d-----    c:\docume~1\jette\applic~1\Malwarebytes
2009-05-28 12:22    19,096    a-------    c:\windows\system32\drivers\mbam.sys
2009-05-28 12:22    40,160    a-------    c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 12:22    <DIR>    --d-----    c:\program files\Malwarebytes' Anti-Malware
2009-05-28 12:22    <DIR>    --d-----    c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-25 19:33    <DIR>    --dsh---    C:\FOUND.004
2009-05-25 19:20    17,408    a-------    c:\windows\system32\SYSDLL.exe
2009-05-25 19:20    <DIR>    --d-----    c:\windows\system32\sysloc
2009-05-08 10:48    <DIR>    --d-----    c:\documents and settings\jette\cbt
2009-05-05 17:17    <DIR>    --d-----    c:\docume~1\jette\applic~1\Cryptomathic
2009-05-05 17:15    <DIR>    --d-h---    c:\docume~1\alluse~1\applic~1\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}
2009-05-05 17:15    <DIR>    --d-----    c:\program files\DanID

==================== Find3M  ====================

2009-03-21 16:06    989,696    --------    c:\windows\system32\dllcache\kernel32.dll
2009-03-09 05:19    410,984    a-------    c:\windows\system32\deploytk.dll
2009-03-06 16:22    284,160    a-------    c:\windows\system32\pdh.dll
2009-03-06 16:22    284,160    --------    c:\windows\system32\dllcache\pdh.dll
2009-03-03 02:18    826,368    a-------    c:\windows\system32\wininet.dll
2009-03-03 02:18    826,368    a-------    c:\windows\system32\dllcache\wininet.dll
2009-02-28 06:54    636,072    a-------    c:\windows\system32\dllcache\iexplore.exe
2008-10-23 18:28    32,768    a--sh---    c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102320081024\index.dat

============= FINISH: 19:43:44,17 ===============

Hent http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Du skal ikke bruge den lige nu men hvis du mister forbindelsen til internettet, så start den, klik på "do a system skan only" og sæt flueben ved disse

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

luk alle andre vinduer og klik "fix checked"

------------------------------

Er det her noget du/i selv har lavet?

TCP: {2D3A32E7-179E-423F-BF2D-E1F9E9678BB9} = 213.174.139.72,10.20.63.141
TCP: {58F4D272-58B8-4A18-83CA-70C9C585DC53} = 213.174.139.72,10.20.63.141
TCP: {B9888F38-A4A3-474D-9D70-9483288348DE} = 213.174.139.72,10.20.63.141

------------------------------

Hent og gem Combofix på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe



Højreklik på skrivebordet og vælg ny->tekstdokument og kopier  indholdet mellem  linierne ind og gem filen som CFScript.txt

Du skal sikre dig at den ikke kommer til at hedde CFScript.txt.txt


--------------

Killall::


Snapshot::

-------------


Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif


Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\ Combofix txt

Indholdet af denne fil må du gerne lægge herind.

Du skrev flg:
.................
Killall::


Snapshot::

..................

Skal jeg bruge det til noget?

Jeg gik ud fra at det som skulle kopieres ind i filen var:

.......................

TCP: {2D3A32E7-179E-423F-BF2D-E1F9E9678BB9} = 213.174.139.72,10.20.63.141
TCP: {58F4D272-58B8-4A18-83CA-70C9C585DC53} = 213.174.139.72,10.20.63.141
TCP: {B9888F38-A4A3-474D-9D70-9483288348DE} = 213.174.139.72,10.20.63.141
......................

Det der skal kopieres ind er:

Killall::

Snapshot::

Jeg spørger om det her er noget du/i kender til:
213.174.139.72,10.20.63.141

Det er normalt noget der sættes via proxyserver i lanforbindelse

Nej jeg kender det ikke, men maskinen kunne ikke logge på nettet og da jeg prøvede at kigge i Forbindelser i Indstillinger i IE under LAN var der hakket af i Proxy da jeg fjernede fluebenet kunne pcen godt komme på nettet. Jeg ved ikke om det er noget Spyware/Malware/virus som har lavet denne ændring

ComboFix 09-05-26.05 - jette 28-05-2009 21:37.1 - FAT32x86
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1033.18.502.309 [GMT 2:00]
Kører fra: c:\documents and settings\jette\Desktop\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\jette\Desktop\CFScript.txt
AV: BullGuard Antivirus *On-access scanning disabled* (Outdated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}
FW: BullGuard Firewall *disabled* {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\jette\Application Data\02000000d1495186C.manifest
c:\documents and settings\jette\Application Data\02000000d1495186O.manifest
c:\documents and settings\jette\Application Data\02000000d1495186P.manifest
c:\documents and settings\jette\Application Data\02000000d1495186S.manifest
C:\xcrashdump.dat

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-04-28 til 2009-05-28  )))))))))))))))))))))))))))))))))))
.

2009-05-28 16:59 . 2009-05-28 16:59    3371383    ----a-w    c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-28 10:58 . 2009-05-28 19:41    117760    ----a-w    c:\documents and settings\jette\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\program files\SUPERAntiSpyware
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\documents and settings\jette\Application Data\SUPERAntiSpyware.com
2009-05-28 10:38 . 2009-05-28 10:38    --------    d-----w    c:\program files\CCleaner
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\jette\Application Data\Malwarebytes
2009-05-28 10:22 . 2009-05-26 11:19    19096    ----a-w    c:\windows\system32\drivers\mbam.sys
2009-05-28 10:22 . 2009-05-26 11:20    40160    ----a-w    c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\program files\Malwarebytes' Anti-Malware
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-25 17:33 . 2009-05-25 17:33    --------    d-sh--w    C:\FOUND.004
2009-05-25 17:20 . 2009-05-25 17:20    --------    d-----w    c:\windows\system32\sysloc
2009-05-08 08:48 . 2009-05-08 08:48    --------    d-----w    c:\documents and settings\jette\cbt
2009-05-05 15:17 . 2009-05-05 15:17    --------    d-----w    c:\documents and settings\jette\Application Data\Cryptomathic
2009-05-05 15:15 . 2009-05-05 15:15    --------    d--h--w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}
2009-05-05 15:15 . 2009-01-30 11:45    3011128    ----a-w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}\csp.exe
2009-05-05 15:15 . 2009-05-05 15:15    --------    d-----w    c:\program files\DanID

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 19:39 . 2006-09-22 12:27    12    ----a-w    c:\windows\bthservsdp.dat
2009-03-31 16:15 . 2009-03-31 16:15    152576    ----a-w    c:\documents and settings\jette\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 14:22 . 2009-03-31 14:22    --------    d-----w    c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-03-09 03:19 . 2009-02-23 07:59    410984    ----a-w    c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-10 18:00    284160    ----a-w    c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-01-09 18:02    826368    ----a-w    c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-28 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05    356352    ----a-w    c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Hurtig start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Hurtig start.lnk
backup=c:\windows\pss\HP Image Zone Hurtig start.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23-03-2009 14:07 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23-03-2009 14:07 72944]
R1 VFILT;BullGuard Firewall Kernel Driver;c:\program files\BullGuard Software\BullGuard\fwengine\Filtnt.sys [27-10-2006 11:00 125216]
R2 BdFileSpy;BullGuard File Monitor Driver;c:\windows\system32\drivers\BdFileSpy.sys [29-01-2007 21:43 50896]
R2 BsFileScan;BullGuard File Scan Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R2 BsFwall;BullGuard Firewall Service;c:\windows\System32\svchost.exe -k BullGuardFw [10-08-2004 20:00 14336]
R2 BsMailProxy;BullGuard Email Monitoring Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R3 PROTECT.DLL;BullGuard Firewall Protection Plugin;c:\program files\BullGuard Software\BullGuard\fwengine\Protect.dll [27-10-2006 11:00 16960]
R3 Reconn;BullGuard Email Monitor;c:\program files\BullGuard Software\BullGuard\Reconn.sys [27-10-2006 11:01 16984]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23-03-2009 14:07 7408]
S2 gupdate1c98dcaaed718e7;Tjenesten Google Update (gupdate1c98dcaaed718e7);c:\program files\Google\Update\GoogleUpdate.exe [13-02-2009 12:03 133104]
S3 ADBLOCK.DLL;BullGuard Firewall Adware Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll [?]
S3 BGRaSvc;BGRaSvc;c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe [19-03-2008 10:39 79176]
S3 HTMLFILT.DLL;BullGuard Firewall HTML Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll [?]
S3 HTTPFILT.DLL;BullGuard Firewall HTTP Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll [?]

--- Andre Services/Drivers i Hukommelsen ---

*NewlyCreated* - SASDIFSV
*NewlyCreated* - UBHELPER

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard    REG_MULTI_SZ      BgMainSvc BsFileScan BsMailProxy
BullGuardFw    REG_MULTI_SZ      BsFwall
.
Indhold af mappen 'Planlagte Opgaver'

2009-05-28 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36]

2009-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-13 15:17]

2009-05-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 10:03]
.
- - - - TOMME GENVEJE FJERNET - - - -

Notify-1d0f11d5448 - c:\windows\System32\pifmgr32.dll
SafeBoot-procexp90.Sys


.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://da.intl.acer.yahoo.com/
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: danid.dk
TCP: {2D3A32E7-179E-423F-BF2D-E1F9E9678BB9} = 213.174.139.72,10.20.63.141
TCP: {58F4D272-58B8-4A18-83CA-70C9C585DC53} = 213.174.139.72,10.20.63.141
TCP: {B9888F38-A4A3-474D-9D70-9483288348DE} = 213.174.139.72,10.20.63.141
DPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} - hxxps://danid.dk/csp/authenticode/csp.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 21:40
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3112)
c:\program files\BullGuard Software\BullGuard\antispam\PluginHook.dll
c:\program files\BullGuard Software\BullGuard\res\dk\PluginHookRes.dll
c:\acer\Empowering Technology\ePower\SysHook.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\program files\LAVASOFT\AD-AWARE\AAWSERVICE.EXE
c:\acer\EMPOWERING TECHNOLOGY\ADMSERV.EXE
c:\program files\BULLGUARD SOFTWARE\BULLGUARD\BULLGUARDUPDATE.EXE
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\SYSTEM32\HPZIPM12.EXE
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Gennemført tid: 2009-05-28 21:44 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2009-05-28 19:44

Pre-Kørsel: 11.744.854.016 bytes free
Post-Kørsel: 11.876.237.312 byte ledig

187    --- E O F ---    2009-05-13 09:05

Nu kan pcen ikke gå på nettet mere, jeg har prøvet en ipconfig/all og den siger OK for IP-adresse, Windows forsøger også med en opdatering men kan ikke gennemfører den.

Højreklik på skrivebordet og vælg ny->tekstdokument og kopier  indholdet mellem  linierne ind og gem filen som CFScript.txt

Du skal sikre dig at den ikke kommer til at hedde CFScript.txt.txt


--------------

Killall::

DDS::
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
TCP: {2D3A32E7-179E-423F-BF2D-E1F9E9678BB9} = 213.174.139.72,10.20.63.141
TCP: {58F4D272-58B8-4A18-83CA-70C9C585DC53} = 213.174.139.72,10.20.63.141
TCP: {B9888F38-A4A3-474D-9D70-9483288348DE} = 213.174.139.72,10.20.63.141

-------------

Da Combofix kan konflikte med din antivirus er det vigtigt at du deaktiverer den.

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif


Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\ Combofix txt

Indholdet af denne fil må du gerne lægge herind.


---------------------------------------

Derefter starter du HiJackThis som jeg linkede til tidligere klikker på "Do a systemscan scan and save a logfile"  kopier loggens tekst og sender den herind.

Fortæl så hvordan det går.

ComboFix 09-05-26.05 - jette 28-05-2009 23:55.1 - FAT32x86
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1033.18.502.167 [GMT 2:00]
Kører fra: c:\documents and settings\jette\Desktop\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\jette\Desktop\CFScript.txt.txt
AV: BullGuard Antivirus *On-access scanning disabled* (Outdated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}
FW: BullGuard Firewall *disabled* {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

(((((((((((((((((((((((((((((  Filer skabt fra 2009-04-28 til 2009-05-28  )))))))))))))))))))))))))))))))))))
.

2009-05-28 21:32 . 2009-05-28 21:32    --------    d-----w    c:\program files\Lavasoft
2009-05-28 21:32 . 2009-05-28 21:32    --------    d-----w    c:\program files\EnglishOtto
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\program files\SUPERAntiSpyware
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\documents and settings\jette\Application Data\SUPERAntiSpyware.com
2009-05-28 10:38 . 2009-05-28 10:38    --------    d-----w    c:\program files\CCleaner
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\jette\Application Data\Malwarebytes
2009-05-28 10:22 . 2009-03-26 14:49    15504    ----a-w    c:\windows\system32\drivers\mbam.sys
2009-05-28 10:22 . 2009-03-26 14:49    38496    ----a-w    c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\program files\Malwarebytes' Anti-Malware
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-25 17:33 . 2009-05-25 17:33    --------    d-sh--w    C:\FOUND.004
2009-05-25 17:20 . 2009-05-25 17:20    --------    d-----w    c:\windows\system32\sysloc
2009-05-08 08:48 . 2009-05-08 08:48    --------    d-----w    c:\documents and settings\jette\cbt
2009-05-05 15:17 . 2009-05-05 15:17    --------    d-----w    c:\documents and settings\jette\Application Data\Cryptomathic
2009-05-05 15:15 . 2009-05-05 15:15    --------    d--h--w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}
2009-05-05 15:15 . 2009-01-30 11:45    3011128    ----a-w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}\csp.exe
2009-05-05 15:15 . 2009-05-05 15:15    --------    d-----w    c:\program files\DanID

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 21:57 . 2006-09-22 12:27    12    ----a-w    c:\windows\bthservsdp.dat
2009-03-31 16:15 . 2009-03-31 16:15    152576    ----a-w    c:\documents and settings\jette\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 14:22 . 2009-03-31 14:22    --------    d-----w    c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-03-09 03:19 . 2009-02-23 07:59    410984    ----a-w    c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-10 18:00    284160    ----a-w    c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-01-09 18:02    826368    ----a-w    c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\1d0f11d5448]
c:\windows\System32\pifmgr32.dll [BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Hurtig start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Hurtig start.lnk
backup=c:\windows\pss\HP Image Zone Hurtig start.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 VFILT;BullGuard Firewall Kernel Driver;c:\program files\BullGuard Software\BullGuard\fwengine\Filtnt.sys [27-10-2006 11:00 125216]
R2 BdFileSpy;BullGuard File Monitor Driver;c:\windows\system32\drivers\BdFileSpy.sys [29-01-2007 21:43 50896]
R2 BsFileScan;BullGuard File Scan Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R2 BsFwall;BullGuard Firewall Service;c:\windows\System32\svchost.exe -k BullGuardFw [10-08-2004 20:00 14336]
R2 BsMailProxy;BullGuard Email Monitoring Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R3 PROTECT.DLL;BullGuard Firewall Protection Plugin;c:\program files\BullGuard Software\BullGuard\fwengine\Protect.dll [27-10-2006 11:00 16960]
R3 Reconn;BullGuard Email Monitor;c:\program files\BullGuard Software\BullGuard\Reconn.sys [27-10-2006 11:01 16984]
S2 gupdate1c98dcaaed718e7;Tjenesten Google Update (gupdate1c98dcaaed718e7);c:\program files\Google\Update\GoogleUpdate.exe [13-02-2009 12:03 133104]
S3 ADBLOCK.DLL;BullGuard Firewall Adware Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll [?]
S3 BGRaSvc;BGRaSvc;c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe [19-03-2008 10:39 79176]
S3 HTMLFILT.DLL;BullGuard Firewall HTML Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll [?]
S3 HTTPFILT.DLL;BullGuard Firewall HTTP Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard    REG_MULTI_SZ      BgMainSvc BsFileScan BsMailProxy
BullGuardFw    REG_MULTI_SZ      BsFwall
.
Indhold af mappen 'Planlagte Opgaver'

2009-05-28 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36]

2009-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-13 15:17]

2009-05-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 10:03]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://da.intl.acer.yahoo.com/
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: danid.dk
DPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} - hxxps://danid.dk/csp/authenticode/csp.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 23:58
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'explorer.exe'(2644)
c:\program files\BullGuard Software\BullGuard\antispam\PluginHook.dll
c:\program files\BullGuard Software\BullGuard\res\dk\PluginHookRes.dll
c:\acer\Empowering Technology\ePower\SysHook.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\program files\LAVASOFT\AD-AWARE\AAWSERVICE.EXE
c:\acer\EMPOWERING TECHNOLOGY\ADMSERV.EXE
c:\program files\BULLGUARD SOFTWARE\BULLGUARD\BULLGUARDUPDATE.EXE
c:\windows\EHOME\EHRECVR.EXE
c:\windows\EHOME\EHSCHED.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE
c:\windows\SYSTEM32\HPZIPM12.EXE
c:\windows\EHOME\MCRDSVC.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Gennemført tid: 2009-05-28  0:01 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2009-05-28 22:01
ComboFix2.txt  2009-05-28 19:44

Pre-Kørsel: 11.752.194.048 bytes free
Post-Kørsel: 11.739.529.216 byte ledig

160    --- E O F ---    2009-05-13 09:05

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:03:47, on 29-05-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\jette\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://da.intl.acer.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" -boot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} (Util Class) - https://danid.dk/csp/authenticode/csp.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: 1d0f11d5448 - C:\WINDOWS\System32\pifmgr32.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: BGRaSvc - BullGuard - C:\Program Files\BullGuard Software\BullGuard\support\bgrasvc.exe
O23 - Service: Tjenesten Google Update (gupdate1c98dcaaed718e7) (gupdate1c98dcaaed718e7) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6098 bytes

Jeps - Nu kan den godt gå på nettet igen - Hvad skyldes det???

Ideen med hele denne process var selvfælgelig i første omgang at få pcen renset, men det var også ideen at kunne lave en sikkerhedskopi af systemet.
Så er mit spørgsmål nu, om jeg kan lave denne sikkerhedskopi nu??

Nej jeg vil ikke råde dig til at sikkerhedskopiere lige nu

Slet den combofix du har og hent en ny.

Højreklik på skrivebordet og vælg ny->tekstdokument og kopier  indholdet mellem  linierne ind og gem filen som CFScript.txt

Du skal sikre dig at den ikke kommer til at hedde CFScript.txt.txt


--------------

Killall::

Snapshot::

File::
c:\windows\System32\pifmgr32.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\1d0f11d5448]

DDS::
AppInit_DLLs: c:\windows\system32\pifmgr32.dll

-------------

Da Combofix kan konflikte med din antivirus er det vigtigt at du deaktiverer den.

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif


Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\ Combofix txt

Indholdet af denne fil må du gerne lægge herind.

ComboFix 09-05-28.07 - jette 29-05-2009 19:24.2 - FAT32x86
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1033.18.502.231 [GMT 2:00]
Kører fra: c:\documents and settings\jette\Desktop\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\jette\Desktop\CFScript.txt.txt
AV: BullGuard Antivirus *On-access scanning disabled* (Outdated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}
FW: BullGuard Firewall *disabled* {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!

FILE ::
"c:\windows\System32\pifmgr32.dll"
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\sysloc
c:\windows\system32\sysloc\sysloc.dll

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-04-28 til 2009-05-29  )))))))))))))))))))))))))))))))))))
.

2009-05-28 21:32 . 2009-05-28 21:32    --------    d-----w    c:\program files\Lavasoft
2009-05-28 21:32 . 2009-05-28 21:32    --------    d-----w    c:\program files\EnglishOtto
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\program files\SUPERAntiSpyware
2009-05-28 10:57 . 2009-05-28 10:57    --------    d-----w    c:\documents and settings\jette\Application Data\SUPERAntiSpyware.com
2009-05-28 10:38 . 2009-05-28 10:38    --------    d-----w    c:\program files\CCleaner
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\jette\Application Data\Malwarebytes
2009-05-28 10:22 . 2009-03-26 14:49    15504    ----a-w    c:\windows\system32\drivers\mbam.sys
2009-05-28 10:22 . 2009-03-26 14:49    38496    ----a-w    c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\program files\Malwarebytes' Anti-Malware
2009-05-28 10:22 . 2009-05-28 10:22    --------    d-----w    c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-25 17:33 . 2009-05-25 17:33    --------    d-sh--w    C:\FOUND.004
2009-05-08 08:48 . 2009-05-08 08:48    --------    d-----w    c:\documents and settings\jette\cbt
2009-05-05 15:17 . 2009-05-05 15:17    --------    d-----w    c:\documents and settings\jette\Application Data\Cryptomathic
2009-05-05 15:15 . 2009-05-05 15:15    --------    d--h--w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}
2009-05-05 15:15 . 2009-01-30 11:45    3011128    ----a-w    c:\documents and settings\All Users\Application Data\{D166A25B-41F0-45EA-B10E-DE7D7B5C3455}\csp.exe
2009-05-05 15:15 . 2009-05-05 15:15    --------    d-----w    c:\program files\DanID

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-29 17:26 . 2006-09-22 12:27    12    ----a-w    c:\windows\bthservsdp.dat
2009-03-31 16:15 . 2009-03-31 16:15    152576    ----a-w    c:\documents and settings\jette\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 14:22 . 2009-03-31 14:22    --------    d-----w    c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-03-09 03:19 . 2009-02-23 07:59    410984    ----a-w    c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2004-08-10 18:00    284160    ----a-w    c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-01-09 18:02    826368    ----a-w    c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-11 308552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Hurtig start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Hurtig start.lnk
backup=c:\windows\pss\HP Image Zone Hurtig start.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 VFILT;BullGuard Firewall Kernel Driver;c:\program files\BullGuard Software\BullGuard\fwengine\Filtnt.sys [27-10-2006 11:00 125216]
R2 BdFileSpy;BullGuard File Monitor Driver;c:\windows\system32\drivers\BdFileSpy.sys [29-01-2007 21:43 50896]
R2 BsFileScan;BullGuard File Scan Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R2 BsFwall;BullGuard Firewall Service;c:\windows\System32\svchost.exe -k BullGuardFw [10-08-2004 20:00 14336]
R2 BsMailProxy;BullGuard Email Monitoring Service;c:\windows\System32\svchost.exe -k BullGuard [10-08-2004 20:00 14336]
R3 PROTECT.DLL;BullGuard Firewall Protection Plugin;c:\program files\BullGuard Software\BullGuard\fwengine\Protect.dll [27-10-2006 11:00 16960]
R3 Reconn;BullGuard Email Monitor;c:\program files\BullGuard Software\BullGuard\Reconn.sys [27-10-2006 11:01 16984]
S2 gupdate1c98dcaaed718e7;Tjenesten Google Update (gupdate1c98dcaaed718e7);c:\program files\Google\Update\GoogleUpdate.exe [13-02-2009 12:03 133104]
S3 ADBLOCK.DLL;BullGuard Firewall Adware Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\AdBlock.dll [?]
S3 BGRaSvc;BGRaSvc;c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe [19-03-2008 10:39 79176]
S3 HTMLFILT.DLL;BullGuard Firewall HTML Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll [?]
S3 HTTPFILT.DLL;BullGuard Firewall HTTP Plugin;\??\c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll --> c:\program files\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard    REG_MULTI_SZ      BgMainSvc BsFileScan BsMailProxy
BullGuardFw    REG_MULTI_SZ      BsFwall
.
Indhold af mappen 'Planlagte Opgaver'

2009-05-29 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 15:36]

2009-05-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-13 15:17]

2009-05-29 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 10:03]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://da.intl.acer.yahoo.com/
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: danid.dk
DPF: {9DF01F00-08E7-4DBE-9070-94841463B3FE} - hxxps://danid.dk/csp/authenticode/csp.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-29 19:28
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'explorer.exe'(2856)
c:\program files\BullGuard Software\BullGuard\antispam\PluginHook.dll
c:\program files\BullGuard Software\BullGuard\res\dk\PluginHookRes.dll
c:\acer\Empowering Technology\ePower\SysHook.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\program files\LAVASOFT\AD-AWARE\AAWSERVICE.EXE
c:\acer\EMPOWERING TECHNOLOGY\ADMSERV.EXE
c:\program files\BULLGUARD SOFTWARE\BULLGUARD\BULLGUARDUPDATE.EXE
c:\windows\EHOME\EHRECVR.EXE
c:\windows\EHOME\EHSCHED.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE
c:\windows\SYSTEM32\HPZIPM12.EXE
c:\windows\EHOME\MCRDSVC.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Gennemført tid: 2009-05-29 19:30 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2009-05-29 17:30
ComboFix3.txt  2009-05-28 19:44
ComboFix2.txt  2009-05-28 22:01

Pre-Kørsel: 11.738.120.192 bytes free
Post-Kørsel: 11.730.485.248 byte ledig

165    --- E O F ---    2009-05-13 09:05

Det ser bedre ud. Jeg vil gerne ha' dig til at opdatere malwarebytes og supeantispyware og køre en systemskan med dem. DVS. Fuld system skan eller hvad det nu hedder. jeg vil gerne se log's fra begge.

Malwarebytes' Anti-Malware 1.37
Database version: 2201
Windows 5.1.2600 Service Pack 3

31-05-2009 20:24:17
mbam-log-2009-05-31 (20-24-17).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 150446
Tid tilbagelagt: 15 minute(s), 42 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 3

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
c:\system volume information\_restore{50dd0198-3e9f-4fd4-b3bf-aba80369ce56}\RP92\A0056198.dll (Adware.BHO) -> Quarantined and deleted successfully.
c:\system volume information\_restore{50dd0198-3e9f-4fd4-b3bf-aba80369ce56}\RP94\A0056644.dll (Adware.BHO) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\system32\sysloc\sysloc.dll.vir (Adware.BHO) -> Quarantined and deleted successfully.

Jeg modtog en fejl da jeg skulle afslutte Superantispyware efter at den havde fundet nogle Cokies samt en Trojaner.
Fejlen lød således:
Microsft Visual C - Runtime Library
Runtime error
Program i C:\Program Files\SUPERAntiSpyware.exe

R6025
-pure virtual function call

Herefter lukkede Superantispyware. Så jeg kunne ikke fjerne det som den havde fundet.

Jeg kørte en ny Fuld scanning og den blev gennemført.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/01/2009 at 09:53 AM

Application Version : 4.26.1004

Core Rules Database Version : 3917
Trace Rules Database Version: 1861

Scan type      : Complete Scan
Total Scan Time : 00:24:05

Memory items scanned      : 526
Memory threats detected  : 0
Registry items scanned    : 5676
Registry threats detected : 0
File items scanned        : 23960
File threats detected    : 4

Adware.Tracking Cookie
    C:\Documents and Settings\jette\Cookies\jette@apmebf[1].txt
    C:\Documents and Settings\jette\Cookies\jette@doubleclick[1].txt
    C:\Documents and Settings\jette\Cookies\jette@adtech[1].txt
    C:\Documents and Settings\jette\Cookies\jette@mediaplex[1].txt

Sidste scanning fandt kun nogle cookies, så jeg må gå ud fra at pc er renset

Jeg er enig. Hvordan kører computeren?

Den kører fint

Jeg vil gerne anbefale at du/i efter sikkerheds-kopiering skifter til ntfs istedet for fat32. Desuden ser det herfra ud som om BullGuard er blevet beskadiget så jeg tror det vil være klogt med en afinstallation og efterfølgende geninstallation. Husk ingen internet forbindelse undervejs.

Umiddelbart kører BullGuard fint nok. Jeg foretog ikke en geninstallation af WindowsXP da jeg syntes pc'en kørte fint efter oprydningen, Jeg fik dog lavet en sikkerhedskopi af WindowsXP, dog havde jeg et problem med at pc'en ikke ville logge på en trådløst router (Netgear) men den ville godt logge på min trådløse router (Linksys) så jeg prøvede at resette Netgear uden at det hjalp, så jeg gik ud fra at routeren var defekt og har bedt om at få den ombyttet. (Jeg slog også både Antivirus og Firewall fra i BullGuard)

Nu var det ikke en geninstallation af Windows XP jeg foreslog men dette:
http://support.microsoft.com/kb/307881/da

Hvis BullGuard kører godt nok så lad være, herfra kunne den bare godt se beskadiget ud. Men det kan også være dens selvforsvar der får combofix til at vise det på den måde.

Ja ok du foreslog at jeg ændrede fra FAT32 til NTFS.
Det må jeg se at få gjort.
Jeg takker mange gange for hjælpen :-)