Langsom opstart og mulige problemer med ntuser.dat.log
Hej.Jeg har den seneste tid været vidne til, at min bærbar har utrolig svært ved at starte op. Oftest vil den første starte korrekt op efter at Windows har kørt en scandisc på comp.
Den bliver ved med at skrive, at 'size of ntuser.dat.log is invalid' (???)
Jeg har gennemført nogle scanninger og nedenfor er mine logfiler. Jeg håber, der er en, der kan hjælpe.
Malwarebytes' Anti-Malware 1.41
Database version: 2812
Windows 5.1.2600 Service Pack 3
16-09-2009 19:21:54
mbam-log-2009-09-16 (19-21-53).txt
Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 213262
Tid tilbagelagt: 53 minute(s), 1 second(s)
Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 3
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 1
Inficerede Mapper: 0
Inficerede Filer: 3
Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)
Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Nøgler:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{87fd33c2-7891-45d5-acd1-7935f9aea26b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Filer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Inficerede Mapper:
(Ingen mistænkelige filer fundet)
Inficerede Filer:
C:\System Volume Information\_restore{50DD0198-3E9F-4FD4-B3BF-ABA80369CE56}\RP470\A0181648.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
ComboFix 09-09-14.02 - Ejer 16-09-2009 19:49.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1033.18.1014.432 [GMT 2:00]
Kører fra: c:\documents and settings\Ejer\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Documents\DAEMON Tools Images\Desktop_.ini
c:\documents and settings\All Users\Documents\MCE Logs\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\IdentityCRL\Desktop_.ini
c:\documents and settings\All Users\Documents\microsoft\IdentityCRL\production\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Alanis Morissette\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Alanis Morissette\Everything - Single\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Deardorf Peterson Group\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Deardorf Peterson Group\Portal\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\King Sunny Ade & His African Beats\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\King Sunny Ade & His African Beats\Synchro Series\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Mark Knopfler\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Mark Knopfler\shangri-la\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\My Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Robert Randolph & the Family Band\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Robert Randolph & the Family Band\Unclassified\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Rosie Thomas\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Rosie Thomas\Only With Laughter Can You Win\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Music\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Playlists\000D4278\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sync Playlists\000D4297\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sync Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\The Shins\Chutes Too Narrow\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\The Shins\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Impressionism - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Landscapes - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Masterpieces - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Nature - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Travel - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Vintage - GalleryPlayer\Desktop_.ini
c:\documents and settings\All Users\Documents\My Videos\Desktop_.ini
c:\documents and settings\All Users\Documents\Recorded TV\Desktop_.ini
c:\documents and settings\All Users\Documents\Recorded TV\TempRec\Desktop_.ini
c:\documents and settings\All Users\Documents\Sys\Desktop_.ini
c:\windows\Installer\31dd51.msp
c:\windows\Installer\WMEncoder.msi
c:\windows\kb913800.exe
c:\windows\system32\drivers\Sonyhcp.dll
c:\windows\system32\nsprs.dll
.
((((((((((((((((((((((((((((( Filer skabt fra 2009-08-16 til 2009-09-16 )))))))))))))))))))))))))))))))))))
.
2009-09-16 16:25 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-16 16:25 . 2009-09-16 16:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-16 16:25 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-16 16:22 . 2009-09-16 16:22 -------- d-----w- c:\program files\CCleaner
2009-09-16 16:03 . 2009-09-16 16:03 -------- d-----w- C:\FOUND.008
2009-09-16 11:23 . 2009-09-16 11:23 -------- d-----w- c:\documents and settings\Ejer\Application Data\Error Fix
2009-09-16 11:23 . 2009-09-16 11:23 -------- d-----w- c:\program files\Error Fix
2009-09-16 11:07 . 2009-09-16 11:07 -------- d-----w- c:\program files\CONEXANT
2009-09-16 11:05 . 2009-09-16 11:05 -------- d-----w- C:\FOUND.007
2009-09-14 20:46 . 2009-09-14 20:46 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-09-14 20:46 . 2005-10-14 20:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2009-09-14 20:45 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-09-14 20:45 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2009-09-14 20:43 . 2005-03-14 11:39 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2009-09-14 20:43 . 2005-03-14 10:05 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2009-09-14 20:43 . 2005-03-14 10:05 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2009-09-14 20:43 . 2005-03-14 10:03 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2009-09-14 20:43 . 2005-03-08 09:55 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2009-09-14 20:43 . 2005-03-08 09:55 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2009-09-14 20:42 . 2009-09-14 20:47 103334 ----a-w- c:\windows\hpoins08.dat
2009-09-14 20:42 . 2006-01-25 03:47 4445 ------w- c:\windows\hpomdl08.dat
2009-09-14 20:42 . 2005-10-28 01:24 21568 ----a-w- c:\windows\system32\drivers\HPZius12.sys
2009-09-14 20:42 . 2005-10-28 01:24 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
2009-09-14 20:42 . 2005-10-28 01:24 49664 ----a-w- c:\windows\system32\drivers\HPZid412.sys
2009-09-14 20:42 . 2005-10-28 23:11 614400 ----a-w- c:\windows\system32\hpotscl2.dll
2009-09-14 20:42 . 2005-10-28 23:11 602112 ----a-w- c:\windows\system32\hpowiax2.dll
2009-09-14 20:42 . 2005-10-28 23:11 254026 ----a-w- c:\windows\system32\hpovst09.dll
2009-09-14 20:42 . 2005-10-28 01:23 77824 ----a-w- c:\windows\system32\hpzids01.dll
2009-09-14 20:42 . 2005-10-28 01:23 282624 ----a-w- c:\windows\system32\HPZc3212.dll
2009-09-14 20:42 . 2005-09-09 23:28 98304 ----a-w- c:\windows\system32\hpzjsn01.dll
2009-09-14 09:58 . 2009-09-14 09:58 -------- d-----w- c:\windows\tracing
2009-09-14 09:57 . 2009-09-14 09:57 -------- d-----w- c:\program files\Alfa & Ariss
2009-09-14 09:56 . 2009-09-14 09:56 -------- d-----w- c:\program files\SecureW2
2009-09-10 08:47 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-08-30 20:53 . 2009-08-30 20:53 -------- d-----w- c:\program files\iPod
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-16 17:23 . 2006-09-22 12:27 12 ----a-w- c:\windows\bthservsdp.dat
2009-09-14 19:14 . 2007-01-26 22:38 48000 ----a-w- c:\documents and settings\Ejer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-17 19:41 . 2008-12-16 06:19 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-17 19:41 . 2008-12-16 06:19 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-17 19:41 . 2008-12-16 06:19 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-05 09:01 . 2004-08-10 18:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-10 18:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 08:08 . 2004-08-10 18:00 286720 ------w- c:\windows\system32\wmpdxm.dll
2009-06-29 16:12 . 2006-01-09 18:02 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-10 18:00 78336 ------w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-10 18:00 17408 ------w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2004-08-10 18:00 730112 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-10 18:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-10 18:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-10 18:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-10 18:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-10 18:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-10 18:00 92928 ------w- c:\windows\system32\drivers\ksecdd.sys
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056]
"ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]
"Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-28 16248320]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 19:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"d:\\games\\CS\\Half-Life\\hl.exe"=
"d:\\games\\CS\\Half-Life\\hlds.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [16-12-2008 08:19 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [16-12-2008 08:19 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [17-08-2009 21:40 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [17-08-2009 21:40 297752]
--- Andre Services/Drivers i Hukommelsen ---
*NewlyCreated* - INT15.SYS
.
Indhold af mappen 'Planlagte Opgaver'
2009-06-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.msn.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send til &Bluetooth-enhed... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
DPF: {76805459-88F6-4BB1-8EC1-1A4DDC777CFD} - hxxp://logon.kmd.dk/program/zskwsax.CAB
DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
FF - ProfilePath - c:\documents and settings\Ejer\Application Data\Mozilla\Firefox\Profiles\c9d0ukue.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.pol.dk/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-16 19:59
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_USERS\S-1-5-21-859959600-1878911719-981072944-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Gennemført tid: 2009-09-16 20:00
ComboFix-quarantined-files.txt 2009-09-16 18:00
ComboFix2.txt 2008-07-09 09:02
Pre-Kørsel: 8.456.896.512 bytes free
Post-Kørsel: 8.738.013.184 byte ledig
227 --- E O F --- 2009-09-10 09:37
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:04:56, on 16-09-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\admtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth-enhed... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {76805459-88F6-4BB1-8EC1-1A4DDC777CFD} (KMDWebSign.zskwsax) - http://logon.kmd.dk/program/zskwsax.CAB
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - https://asp.photoprintit.de/microsite/10023/defaults/activex/ips/IPSUploader4.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://tbn0.google.com/images?q=tbn:ihsxua1_D5MaTM:http://d.hatena.ne.jp/images/diary/j/joho1960/2006-09-28.jpg
O24 - Desktop Component 1: (no name) - http://tbn0.google.com/images?q=tbn:WRzUGMDsr5vhcM:http://www.gluttonsess.com/blog/Crrrreepy_small.jpg
O24 - Desktop Component 2: (no name) - http://tbn0.google.com/images?q=tbn:O25eJiSzr8PtOM:http://www.gabriellereillyweekly.com/gabrielle_reilly/fitness/fitness_health_diet_gabrielle_reilly/jay_cutler2.jpg
O24 - Desktop Component 3: (no name) - http://tbn0.google.com/images?q=tbn:Z4ZOhHBtoxn5dM:http://thumb2.webshots.net/s/thumb3/6/0/39/111160039DQecpL_th.jpg
O24 - Desktop Component 4: (no name) - http://tbn0.google.com/images?q=tbn:EBDLKccW5-r4xM:http://thumb2.webshots.net/s/thumb1/5/93/1/111159301XIPuaQ_th.jpg
O24 - Desktop Component 5: (no name) - http://tbn0.google.com/images?q=tbn:vC1ykzEtvgtCmM:http://www.legendsofamerica.com/photos-ghosts/HairyGuy.jpg
--
End of file - 8289 bytes