CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg

Log ind eller opret profil

Du kan også logge ind via nedenstående tjenester

johnekroll Nybegynder

20. december 2009 - 00:38 Der er 39 kommentarer

Svært inficeret ?!? XP SP3 ...

Har været lang omkring (bl.a. forsøgt mig med 'karise_larry's model uden held - cracher ofte...)
Dog har jeg lykkedes med diverse andre log-filer:
Håber en 'klog barmhjertig samaritaner' kan/vil give et kvalificeret bud på at komme videre. I givet fald tak på forhånd.

DDS (Ver_09-06-26.01) - NTFSx86
Run by jek at 0:07:01,57 on 20-12-2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.3071.2306 [GMT 1:00]

AV: VIRUSfighter *On-access scanning enabled* (Updated) {F16C9013-991A-461a-A680-841CCEE65E7D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\oodtray.exe
C:\Programmer\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Programmer\Logitech\QuickCam\Quickcam.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\LocalCooling\localcooling.exe
C:\Programmer\Spyware Cease\SpywareCease.exe
C:\Programmer\Fighters\SPYWAREfighter\SWPROTray.exe
C:\Programmer\Fighters\VIRUSfighter\VFPROTray.exe
C:\Programmer\Skype\Phone\Skype.exe
svchost.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
C:\Programmer\Fælles filer\Common Toolkit Suite\AVEngine\AVScanningService.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Logitech\SetPoint\SetPoint.exe
C:\Programmer\Fælles filer\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programmer\Bonjour\mDNSResponder.exe
C:\Programmer\Fælles filer\Common Toolkit Suite\FighterSuiteService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Programmer\Java\jre6\bin\jqs.exe
C:\Programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmer\Fælles filer\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Programmer\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Programmer\Skype\Plugin Manager\skypePM.exe
C:\Programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmer\Fælles filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqbam08.exe
C:\Programmer\Fælles filer\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Programmer\Windows Live\Toolbar\wltuser.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\jek\Skrivebord\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.dk/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://search.live.com/sphome.aspx
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local 127.0.0.1 127.0.0.1 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: H - No File
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\programmer\yahoo!\companion\installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\programmer\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\programmer\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programmer\fælles filer\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\programmer\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\programmer\spybot - search & destroy\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\programmer\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Hjælp til tilmelding til Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\programmer\fælles filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programmer\google\google toolbar\GoogleToolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programmer\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\programmer\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programmer\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\programmer\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programmer\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\programmer\yahoo!\companion\installs\cpn\yt.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\programmer\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\programmer\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programmer\google\google toolbar\GoogleToolbar.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [LDM] c:\programmer\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
uRun: [swg] c:\programmer\google\googletoolbarnotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
uRun: [SpybotSD TeaTimer] c:\programmer\spybot - search & destroy\TeaTimer.exe
uRun: [Steam] "c:\programmer\steam\Steam.exe" -silent
uRun: [Skype] "c:\programmer\skype\phone\Skype.exe" /nosplash /minimized
mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [OODefragTray] c:\windows\system32\oodtray.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
mRun: [Acrobat Assistant 8.0] "c:\programmer\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [<NO NAME>]
mRun: [Adobe_ID0EYTHM] c:\progra~1\fllesf~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [AppleSyncNotifier] c:\programmer\fælles filer\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [LogitechCommunicationsManager] "c:\programmer\fælles filer\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\programmer\logitech\quickcam\Quickcam.exe" /hide
mRun: [HP Software Update] c:\programmer\hp\hp software update\HPWuSchd2.exe
mRun: [XoftSpySE] "c:\programmer\xoftspyse6\XoftSpySE.exe" -NM -hidesplash
mRun: [SunJavaUpdateSched] "c:\programmer\java\jre6\bin\jusched.exe"
mRun: [iTunesHelper] "c:\programmer\itunes\iTunesHelper.exe"
mRun: [Adobe ARM] "c:\programmer\fælles filer\adobe\arm\1.0\AdobeARM.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RoxioEngineUtility] "c:\programmer\fælles filer\roxio shared\system\EngUtil.exe"
mRun: [RoxioDragToDisc] "c:\programmer\roxio\easy cd creator 6\dragtodisc\DrgToDsc.exe"
mRun: [RoxioAudioCentral] "c:\programmer\roxio\easy cd creator 6\audiocentral\RxMon.exe"
mRun: [MMTray] "c:\programmer\musicmatch\musicmatch jukebox\mm_tray.exe"
mRun: [mmtask] "c:\programmer\musicmatch\musicmatch jukebox\mmtask.exe"
mRun: [LocalCooling] "c:\programmer\localcooling\localcooling.exe" -s
mRun: [LiveMonitor] c:\programmer\msi\live update 3\LMonitor.exe
mRun: [SpywareCease.exe] c:\programmer\spyware cease\SpywareCease.exe
mRun: [SWPROguard] c:\programmer\fighters\spywarefighter\SWPROTray.exe
mRun: [QuickTime Task] "c:\programmer\quicktime\qttask.exe" -atboottime
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [VFPROguard] c:\programmer\fighters\virusfighter\VFPROTray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\jek\menuen~1\progra~1\start\magicd~1.lnk - c:\programmer\magicdisc\MagicDisc.exe
StartupFolder: c:\documents and settings\jek\menuen start\programmer\start\PowerReg Scheduler.exe
StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\adober~1.lnk - c:\programmer\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\hpdigi~1.lnk - c:\programmer\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\logite~2.lnk - c:\programmer\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\logite~1.lnk - c:\programmer\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\micros~1.lnk - c:\programmer\microsoft office\office10\OSA.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: &ieSpell Options - c:\programmer\iespell\iespell.dll/SPELLOPTION.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\programmer\iespell\iespell.dll/SPELLCHECK.HTM
IE: Convert link target to Adobe PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programmer\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\programmer\opanda\iexif 2.3\IExifMap.htm
IE: Lookup on Merriam Webster - file://c:\programmer\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\programmer\iespell\wikipedia.HTM
IE: View Exif/GPS/IPTC with IExif - c:\programmer\opanda\iexif 2.3\IExifCom.htm
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\programmer\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\programmer\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programmer\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\programmer\windows live\writer\WriterBrowserExtension.dll
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\programmer\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\programmer\hp\smart web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\programmer\spybot - search & destroy\SDHelper.dll
DPF: {00000161-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaud.cab
DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} - hxxp://downol.dr.dk/download/netradio/Rawflow.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E}
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {2DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B} - hxxp://www.activeworlds.com/products/ActiveWorldsDownload.cab
DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - hxxp://www.cult3d.com/download/cult.cab
DPF: {32564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv8dmo.cab
DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} - hxxp://www.turntool.com/ViewerInstall.exe
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} - hxxp://media.labs.live.com/all/ps/_code_/Photosynth.cab
DPF: {5D2CF9D0-113A-476B-986F-288B54571614} - hxxp://www.devalvr.com/instalacion/plugin/devalocx.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.geni.com/ImageUploader_5_5.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154122721296
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155714307578
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} - hxxp://www.parallelgraphics.com/bin/cortvrml.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9393AF10-1A0E-4F10-B32B-E57CB4543F49} - hxxp://launcher.room-3.com/room3_40/room3_40.cab
DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} - hxxp://kamerahuset.click.dk/click/_res/developer/ImageUploader3.cab
DPF: {A6EE3F8E-925E-11D4-892D-0000C0D84CF5} - hxxp://www.3dcompress.com/download/3DSee.cab
DPF: {B6905E70-4B33-11D3-A498-0008C7DB06E6} - hxxp://web1.web.shost.dk/AxaptaWebDeploy/AxWebDeploy.cab
DPF: {B6982537-59D6-4A4B-9AE8-B4EC9DB0E223} - hxxp://cadcon.niras.dk/visualiseringer/nw_ax.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F81FB289-0FB6-4FE0-A488-101447EE1ED3} - hxxp://research.microsoft.com/ivm/HDView/HDViewXP.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\programmer\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmer\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\fllesf~1\skype\SKYPE4~1.DLL
Notify: LBTWlgn - c:\programmer\fælles filer\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jek\applic~1\mozilla\firefox\profiles\6zun9jzv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.dk/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\documents and settings\jek\application data\mozilla\firefox\profiles\6zun9jzv.default\extensions\turntoolviewer@turntool.com\plugins\nptnt.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll
FF - plugin: c:\programmer\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\programmer\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\programmer\google\picasa3\npPicasa2.dll
FF - plugin: c:\programmer\google\picasa3\npPicasa3.dll
FF - plugin: c:\programmer\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programmer\microsoft research\hdview for firefox\nphdview.dll
FF - plugin: c:\programmer\microsoft\office live\npOLW.dll
FF - plugin: c:\programmer\mozilla firefox\plugins\npdbplug.dll
FF - plugin: c:\programmer\opera\program\plugins\npdivx32.dll
FF - plugin: c:\programmer\photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\programmer\virtools\3d life player\npvirtools.dll
FF - plugin: c:\programmer\virtual earth 3d\npVE3D.dll
FF - plugin: c:\programmer\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programmer\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2007-11-5 38448]
R1 sK9Ou0s;sK9Ou0s;c:\windows\system32\srosa2.sys [2009-12-14 7168]
R2 AV Engine Scanning Service;AV Engine Scanning Service;c:\programmer\fælles filer\common toolkit suite\avengine\AVScanningService.exe [2009-12-11 661888]
R2 Common Toolkit Service;Common Toolkit Service;c:\programmer\fælles filer\common toolkit suite\FighterSuiteService.exe [2009-12-11 676488]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-3-2 55152]
R2 SeaPort;SeaPort;c:\programmer\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R3 AVFSFilter;AVFSFilter;c:\windows\system32\drivers\avfsfilter.sys [2009-12-11 10264]
R3 RkHit;RkHit;c:\windows\system32\drivers\RKHit.sys [2009-12-15 34736]
R3 WEBNTACCESS;WEBNTACCESS;c:\windows\system32\Ntaccess.sys [2006-8-3 18359]
S2 gupdate;Tjenesten Google Update (gupdate);c:\programmer\google\update\GoogleUpdate.exe [2009-8-30 133104]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\programmer\viewpoint\common\viewpointservice.exe" --> c:\programmer\viewpoint\common\ViewpointService.exe [?]
S2 aawservice;Lavasoft Ad-Aware Service;c:\programmer\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
S3 fsssvc;Windows Live Family Safety;c:\programmer\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 PD100VID;Video Blaster WebCam 5 (WDM);c:\windows\system32\drivers\PD100Vid.sys [2006-12-4 374200]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys --> c:\windows\system32\drivers\rootrepeal.sys [?]
S3 XoftSpyService;XoftSpyService;c:\programmer\fælles filer\xoftspyse\6\xoftspyservice.exe [2009-8-28 582424]
S4 Wdhelteerrso;Wdhelteerrso; [x]

=============== Created Last 30 ================

2009-12-19 11:31 891,837 a------- C:\MGlogs.zip
2009-12-18 13:39 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{5163CD15-ECCB-48A1-8C5C-22A36002B9DB}
2009-12-17 23:32 <DIR> --d----- c:\programmer\ieSpell
2009-12-15 21:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\clp
2009-12-15 21:57 <DIR> --d----- c:\docume~1\jek\applic~1\Common Toolkit Suite
2009-12-15 21:56 <DIR> --d----- c:\programmer\Fighters
2009-12-15 21:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Common Toolkit Suite
2009-12-15 21:56 <DIR> --d----- c:\programmer\fælles filer\Common Toolkit Suite
2009-12-15 21:53 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7516B6E8-5C01-4895-B079-DFC32A4ADEE1}
2009-12-15 21:53 <DIR> --d----- c:\docume~1\jek\applic~1\Fighters
2009-12-15 21:12 <DIR> --d----- C:\MGtools
2009-12-15 12:08 42 a------- c:\windows\system32\scud.udf
2009-12-15 12:08 34,736 a------- c:\windows\system32\drivers\RKHit.sys
2009-12-15 12:08 <DIR> --d----- c:\programmer\Spyware Cease
2009-12-15 11:42 2,385,267 a------- C:\MGtools.exe
2009-12-15 11:26 <DIR> --d----- C:\Antivirus
2009-12-15 10:46 <DIR> --d----- c:\programmer\CCleaner
2009-12-14 01:23 <DIR> --d----- c:\programmer\Panorama Tools (PTGui edition)
2009-12-14 00:54 7,168 a------- c:\windows\system32\srosa2.sys
2009-12-14 00:46 <DIR> --d-h--- c:\docume~1\jek\applic~1\drivers
2009-12-13 00:11 <DIR> --d----- c:\docume~1\jek\applic~1\com.adobe.example.avatarAirApplication.199ED43C2CFEB351CD0244628B93195D7C58F98C.1
2009-12-11 13:34 10,264 a------- c:\windows\system32\drivers\avfsfilter.sys
2009-12-01 16:56 25 a------- c:\windows\popcinfot.dat
2009-12-01 16:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PopCap Games
2009-12-01 16:54 <DIR> --d----- c:\programmer\PopCap Games
2009-11-30 11:47 5,632 a------- c:\windows\system32\ptpusb.dll
2009-11-30 11:47 159,232 a------- c:\windows\system32\ptpusd.dll
2009-11-25 22:11 <DIR> --d----- c:\programmer\iPod

==================== Find3M ====================

2009-12-19 23:24 120 a------- C:\drmHeader.bin
2009-12-13 00:14 1,310,901 a------- c:\programmer\avatar.air
2009-12-12 01:48 459,228 a------- c:\windows\system32\perfh006.dat
2009-12-12 01:48 83,478 a------- c:\windows\system32\perfc006.dat
2009-11-14 01:47 856,064 a------- c:\windows\system32\divx_xx0c.dll
2009-11-14 01:47 856,064 a------- c:\windows\system32\divx_xx07.dll
2009-11-14 01:47 847,872 a------- c:\windows\system32\divx_xx0a.dll
2009-11-14 01:47 843,776 a------- c:\windows\system32\divx_xx16.dll
2009-11-14 01:47 839,680 a------- c:\windows\system32\divx_xx11.dll
2009-11-14 01:47 696,320 a------- c:\windows\system32\DivX.dll
2009-10-29 08:43 916,480 a------- c:\windows\system32\wininet.dll
2009-10-21 06:39 75,776 a------- c:\windows\system32\strmfilt.dll
2009-10-21 06:39 25,088 a------- c:\windows\system32\httpapi.dll
2009-10-13 11:34 270,848 a------- c:\windows\system32\oakley.dll
2009-10-12 14:40 150,016 a------- c:\windows\system32\rastls.dll
2009-10-12 14:40 79,872 a------- c:\windows\system32\raschap.dll
2009-10-11 04:17 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-13 10:31 106,864 a------- c:\docume~1\jek\applic~1\GDIPFONTCACHEV1.DAT
2009-06-30 16:53 0 a------- c:\documents and settings\jek\temp.dat
2009-06-26 15:30 0 a------- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT
2009-06-23 23:06 0 a------- c:\docume~1\alluse~1\applic~1\PKP_DLbx.DAT
2009-06-15 19:24 665 a------- c:\programmer\NewProject.pqp
2009-06-07 22:19 64 a------- c:\programmer\c5user.sys
2009-06-02 14:02 2,698,018 a------- c:\programmer\c5data.DAT
2008-12-11 14:13 167 a------- c:\documents and settings\jek\udownload.dat
2008-12-02 00:00 12,006 a------- c:\programmer\usr0002.tbl
2008-11-23 19:30 16,544 a------- c:\programmer\c5util.usr
2008-11-23 17:09 8,192 a------- c:\programmer\c5modalt.is
2008-11-23 17:09 522,240 a------- c:\programmer\c5sysali.is
2008-11-23 17:09 299,008 a------- c:\programmer\c5sysalc.is
2008-11-23 17:09 8,192 a------- c:\programmer\c5modalt.uk
2008-11-23 17:09 8,192 a------- c:\programmer\c5modalt.de
2008-11-23 17:09 526,336 a------- c:\programmer\c5sysali.uk
2008-11-23 17:09 299,008 a------- c:\programmer\c5sysalc.uk
2008-11-23 17:09 120,832 a------- c:\programmer\c5sysali.de
2008-11-23 17:09 112,640 a------- c:\programmer\c5sysalc.de
2008-11-21 14:44 24,736 a------- c:\programmer\C5menu.dat
2008-11-20 23:55 516,087 a------- c:\programmer\c5direct.sys
2008-11-20 23:55 165 a------- c:\programmer\c5codes.sys
2008-11-20 23:52 8,192 a------- c:\programmer\c5modalt.dk
2008-11-20 23:52 530,432 a------- c:\programmer\c5sysali.dk
2008-11-20 23:52 299,008 a------- c:\programmer\c5sysalc.dk
2008-11-20 23:52 4,804 a------- c:\programmer\c5txtidx.dk
2008-11-20 23:48 711 a------- c:\programmer\Installation.ini
2008-03-21 12:36 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2007-10-31 17:29 31,014,328 a------- c:\programmer\c5util.sys
2007-10-31 16:56 20,732,511 a------- c:\programmer\c5data.DMO
2007-10-31 08:56 800,685 a------- c:\programmer\c5sysald.is
2007-10-30 20:30 814,807 a------- c:\programmer\c5sysald.dk
2007-10-30 20:22 812,506 a------- c:\programmer\c5sysald.uk
2007-10-30 12:01 67,590 a------- c:\programmer\C5menu.dev
2007-10-29 17:34 34,033 a------- c:\programmer\zipcode_dk.csv
2007-10-28 16:04 48,761 a------- c:\programmer\wizardis.sys
2007-10-28 16:02 48,377 a------- c:\programmer\wizarddk.sys
2007-10-28 15:28 48,761 a------- c:\programmer\wizarduk.sys
2007-10-27 13:17 56,634 a------- c:\programmer\Wizard.bmp
2007-10-26 16:47 444,486 ac------ c:\programmer\C5.bmp
2007-10-25 16:39 570,930 a------- c:\programmer\Exp4200.sys
2007-10-22 22:17 307,986 a------- c:\programmer\M_dat.bmp
2007-10-22 08:02 224,857 a------- c:\programmer\c5txtdat.uk
2007-10-22 06:24 233,389 a------- c:\programmer\c5txtdat.dk
2007-10-19 10:58 15,537 a------- c:\programmer\c5sysald.de
2007-10-16 09:54 227,296 a------- c:\programmer\c5txtdat.is
2007-09-26 09:53 491,297 a------- c:\programmer\DynC5Lon.kom
2007-09-26 09:53 49,195 a------- c:\programmer\DynC5LonSt.kom
2007-08-21 06:05 37,393 a------- c:\programmer\ParmHelp.chm
2007-08-13 17:20 19,086 a------- c:\programmer\Sqlsrvr_C5.xal
2007-08-13 17:19 16,896 a------- c:\programmer\c5menu.mss
2007-08-13 17:19 16,448 a------- c:\programmer\c5menu.dba
2007-08-13 17:18 7,920 a------- c:\programmer\usr0001.tbl
2007-08-13 17:18 7,920 a------- c:\programmer\usr0000.tbl
2007-08-13 17:18 3,798 a------- c:\programmer\Warning.BMP
2007-08-13 17:18 1,596 a------- c:\programmer\TTWIN.DAT
2007-08-13 17:18 1,596 a------- c:\programmer\TTDOS.DAT
2007-08-13 17:18 25,751 a------- c:\programmer\PROLOG.PS
2007-08-13 17:18 20,988 a------- c:\programmer\PARSER.TBL
2007-08-13 17:18 655 a------- c:\programmer\PTOH.AWK
2007-08-13 17:18 163 a------- c:\programmer\TRAILER.PS
2007-08-13 17:18 10,462 ac------ c:\programmer\C5.ico
2007-08-13 17:18 33 a------- c:\programmer\c5.ini
2006-07-04 14:07 4,841 a------- c:\programmer\zipcode_is.csv
2005-03-31 09:22 17,067 a------- c:\programmer\html.xsl
2004-11-04 14:14 2,560 a------- c:\programmer\Wn8x10.tbl
2004-11-04 14:14 32,744 a------- c:\programmer\zipcode_uk.csv
2004-11-04 14:12 9,311 a------- c:\programmer\Header.ps
2004-11-04 14:12 5,104 a------- c:\programmer\F800256.win
2004-11-04 14:12 5,104 a------- c:\programmer\F640256.win
2004-11-04 14:12 5,104 a------- c:\programmer\F1024256.win
2004-11-04 14:12 5,052 a------- c:\programmer\F80016.win
2004-11-04 14:12 5,052 a------- c:\programmer\F64016.win
2004-11-04 14:12 5,052 a------- c:\programmer\F102416.win
2004-11-04 14:10 146 a------- c:\programmer\c5sort.SYS
2004-11-04 14:10 146 a------- c:\programmer\c5sort.dk
2003-05-22 20:12 2,441,216 a------- c:\programmer\cutftp32.exe
2002-03-14 07:32 146 a------- c:\programmer\c5sort.uk
2002-03-14 07:32 146 a------- c:\programmer\c5sort.is

============= FINISH: 0:07:53,60 ===============

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/12/15 22:59
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xBA779000 Size: 188032 File Visible: - Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000 Size: 2154496 File Visible: - Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xB4A5A000 Size: 138496 File Visible: - Signed: -
Status: -

Name: aic78xx.sys
Image Path: aic78xx.sys
Address: 0xBA908000 Size: 56960 File Visible: - Signed: -
Status: -

Name: AmdK8.sys
Image Path: C:\WINDOWS\System32\DRIVERS\AmdK8.sys
Address: 0xBAAC8000 Size: 57344 File Visible: - Signed: -
Status: -

Name: amon.sys
Image Path: C:\WINDOWS\system32\drivers\amon.sys
Address: 0xA5E92000 Size: 499232 File Visible: - Signed: -
Status: -

Name: Aspi32.SYS
Image Path: C:\WINDOWS\System32\Drivers\Aspi32.SYS
Address: 0xA6289000 Size: 15936 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xBA6F8000 Size: 96512 File Visible: - Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys
Address: 0xBAF83000 Size: 3072 File Visible: - Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xBAE0C000 Size: 4224 File Visible: - Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xBACB8000 Size: 12288 File Visible: - Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xA825C000 Size: 63744 File Visible: - Signed: -
Status: -

Name: Cdr4_xp.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS
Address: 0xBAEFB000 Size: 2432 File Visible: - Signed: -
Status: -

Name: Cdralw2k.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS
Address: 0xBAEFD000 Size: 2560 File Visible: - Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys
Address: 0xBA9C8000 Size: 62976 File Visible: - Signed: -
Status: -

Name: cdudf_xp.SYS
Image Path: C:\WINDOWS\System32\Drivers\cdudf_xp.SYS
Address: 0xB4BB7000 Size: 249344 File Visible: - Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\system32\drivers\CLASSPNP.SYS
Address: 0xBA8E8000 Size: 53248 File Visible: - Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xBA918000 Size: 36352 File Visible: - Signed: -
Status: -

Name: dmio.sys
Image Path: dmio.sys
Address: 0xBA723000 Size: 153600 File Visible: - Signed: -
Status: -

Name: dmload.sys
Image Path: dmload.sys
Address: 0xBADAC000 Size: 5888 File Visible: - Signed: -
Status: -

Name: dump_CLASSPNP.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_CLASSPNP.SYS
Address: 0xA9287000 Size: 53248 File Visible: No Signed: -
Status: -

Name: dump_nvraid.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_nvraid.sys
Address: 0xA8164000 Size: 77824 File Visible: No Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xA898D000 Size: 12288 File Visible: - Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C4000 Size: 73728 File Visible: - Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xBAF49000 Size: 4096 File Visible: - Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys
Address: 0xBABE8000 Size: 27392 File Visible: - Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xA828C000 Size: 44544 File Visible: - Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xBA692000 Size: 129792 File Visible: - Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xBAE08000 Size: 7936 File Visible: - Signed: -
Status: -

Name: fssfltr_tdi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
Address: 0xBAAE8000 Size: 48128 File Visible: - Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xBA749000 Size: 125312 File Visible: - Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys
Address: 0xBAC50000 Size: 21120 File Visible: - Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806E5000 Size: 134400 File Visible: - Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS
Address: 0xAEA91000 Size: 36864 File Visible: - Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS
Address: 0xBAB98000 Size: 28672 File Visible: - Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys
Address: 0xAF7D8000 Size: 10368 File Visible: - Signed: -
Status: -

Name: hotcore3.sys
Image Path: hotcore3.sys
Address: 0xBAB38000 Size: 17152 File Visible: - Signed: -
Status: -

Name: HPZid412.sys
Image Path: C:\WINDOWS\system32\DRIVERS\HPZid412.sys
Address: 0xA82AC000 Size: 49920 File Visible: - Signed: -
Status: -

Name: HPZipr12.sys
Image Path: C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
Address: 0xAA188000 Size: 16224 File Visible: - Signed: -
Status: -

Name: HPZius12.sys
Image Path: C:\WINDOWS\system32\DRIVERS\HPZius12.sys
Address: 0xAED09000 Size: 21568 File Visible: - Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys
Address: 0xA4AA5000 Size: 265728 File Visible: - Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys
Address: 0xB4B25000 Size: 75264 File Visible: - Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xBA8A8000 Size: 37504 File Visible: - Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys
Address: 0xBAC08000 Size: 24832 File Visible: - Signed: -
Status: -

Name: kbdhid.sys
Image Path: C:\WINDOWS\system32\DRIVERS\kbdhid.sys
Address: 0xAA19C000 Size: 14720 File Visible: - Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xBADA8000 Size: 8192 File Visible: - Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ks.sys
Address: 0xB9694000 Size: 143360 File Visible: - Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xBA669000 Size: 92928 File Visible: - Signed: -
Status: -

Name: LHidFilt.Sys
Image Path: C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
Address: 0xAECF9000 Size: 28672 File Visible: - Signed: -
Status: -

Name: LMouFilt.Sys
Image Path: C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
Address: 0xAECF1000 Size: 30208 File Visible: - Signed: -
Status: -

Name: LUsbFilt.Sys
Image Path: C:\WINDOWS\System32\Drivers\LUsbFilt.Sys
Address: 0xAEEAD000 Size: 22272 File Visible: - Signed: -
Status: -

Name: LVPr2Mon.sys
Image Path: C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
Address: 0xA8846000 Size: 18944 File Visible: - Signed: -
Status: -

Name: LVUSBSta.sys
Image Path: C:\WINDOWS\system32\drivers\LVUSBSta.sys
Address: 0xAE682000 Size: 35072 File Visible: - Signed: -
Status: -

Name: mcdbus.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mcdbus.sys
Address: 0xB96B7000 Size: 92544 File Visible: - Signed: -
Status: -

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xBAE2C000 Size: 4224 File Visible: - Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys
Address: 0xBAC10000 Size: 23296 File Visible: - Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys
Address: 0xAF35E000 Size: 12160 File Visible: - Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xBA8D8000 Size: 42368 File Visible: - Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys
Address: 0xA5FFC000 Size: 180608 File Visible: - Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
Address: 0xA8177000 Size: 455296 File Visible: - Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xBABB0000 Size: 19072 File Visible: - Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys
Address: 0xBA988000 Size: 35072 File Visible: - Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xBA595000 Size: 105344 File Visible: - Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xBA5AF000 Size: 182656 File Visible: - Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys
Address: 0xBAD9C000 Size: 10112 File Visible: - Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys
Address: 0xB970F000 Size: 91520 File Visible: - Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xBA9B8000 Size: 40576 File Visible: - Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys
Address: 0xB8AC8000 Size: 34688 File Visible: - Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys
Address: 0xB4AA4000 Size: 162816 File Visible: - Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xBABB8000 Size: 30848 File Visible: - Signed: -
Status: -

Name: NTACCESS.SYS
Image Path: C:\WINDOWS\system32\NTACCESS.SYS
Address: 0xA82FC000 Size: 18304 File Visible: - Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xBA5DC000 Size: 574976 File Visible: - Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\WINDOWS\system32\ntkrnlpa.exe
Address: 0x804D7000 Size: 2154496 File Visible: - Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xBAF05000 Size: 2944 File Visible: - Signed: -
Status: -

Name: nv4_disp.dll
Image Path: C:\WINDOWS\System32\nv4_disp.dll
Address: 0xBF9D6000 Size: 4530176 File Visible: - Signed: -
Status: -

Name: nv4_mini.sys
Image Path: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
Address: 0xB974E000 Size: 3994624 File Visible: - Signed: -
Status: -

Name: nvata.sys
Image Path: nvata.sys
Address: 0xBA6B2000 Size: 93568 File Visible: - Signed: -
Status: -

Name: nvatabus.sys
Image Path: nvatabus.sys
Address: 0xBA6C9000 Size: 93568 File Visible: - Signed: -
Status: -

Name: NVENETFD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\NVENETFD.sys
Address: 0xBAA08000 Size: 33536 File Visible: - Signed: -
Status: -

Name: nvnetbus.sys
Image Path: C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
Address: 0xBAD8C000 Size: 12928 File Visible: - Signed: -
Status: -

Name: NVNRM.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\NVNRM.SYS
Address: 0xB9B51000 Size: 262144 File Visible: - Signed: -
Status: -

Name: nvraid.sys
Image Path: nvraid.sys
Address: 0xBA710000 Size: 77056 File Visible: - Signed: -
Status: -

Name: NVSNPU.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\NVSNPU.SYS
Address: 0xB9B1E000 Size: 208896 File Visible: - Signed: -
Status: -

Name: parport.sys
Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys
Address: 0xB9726000 Size: 80256 File Visible: - Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xBAB30000 Size: 19712 File Visible: - Signed: -
Status: -

Name: ParVdm.SYS
Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS
Address: 0xBAE2A000 Size: 6912 File Visible: - Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xBA768000 Size: 68096 File Visible: - Signed: -
Status: -

Name: pciide.sys
Image Path: pciide.sys
Address: 0xBAE70000 Size: 3328 File Visible: - Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Address: 0xBAB28000 Size: 28672 File Visible: - Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000 Size: 2154496 File Visible: - Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys
Address: 0xB96FE000 Size: 69120 File Visible: - Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys
Address: 0xBABF8000 Size: 17792 File Visible: - Signed: -
Status: -

Name: pwd_2k.SYS
Image Path: C:\WINDOWS\System32\Drivers\pwd_2k.SYS
Address: 0xB8A6B000 Size: 116512 File Visible: - Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xBA928000 Size: 36320 File Visible: - Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys
Address: 0xB8B30000 Size: 8832 File Visible: - Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
Address: 0xBA8B8000 Size: 51328 File Visible: - Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys
Address: 0xBA8C8000 Size: 41472 File Visible: - Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys
Address: 0xBA978000 Size: 48384 File Visible: - Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys
Address: 0xBAC00000 Size: 16512 File Visible: - Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000 Size: 2154496 File Visible: - Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys
Address: 0xA81E7000 Size: 175744 File Visible: - Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xBAE2E000 Size: 4224 File Visible: - Signed: -
Status: -

Name: rdpdr.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdpdr.sys
Address: 0xB96CE000 Size: 196224 File Visible: - Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys
Address: 0xBA9D8000 Size: 58112 File Visible: - Signed: -
Status: -

Name: RKHit.sys
Image Path: C:\WINDOWS\system32\drivers\RKHit.sys
Address: 0xB4C34000 Size: 29312 File Visible: - Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA57B6000 Size: 49152 File Visible: No Signed: -
Status: -

Name: sbp2port.sys
Image Path: sbp2port.sys
Address: 0xBA938000 Size: 43904 File Visible: - Signed: -
Status: -

Name: SCSIPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\SCSIPORT.SYS
Address: 0xBA6E0000 Size: 98304 File Visible: - Signed: -
Status: -

Name: serenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys
Address: 0xBAD90000 Size: 15744 File Visible: - Signed: -
Status: -

Name: serial.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys
Address: 0xBAAD8000 Size: 64768 File Visible: - Signed: -
Status: -

Name: sr.sys
Image Path: sr.sys
Address: 0xBA680000 Size: 73344 File Visible: - Signed: -
Status: -

Name: srosa2.sys
Image Path: C:\WINDOWS\system32\srosa2.sys
Address: 0xA8C0E000 Size: 28672 File Visible: - Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys
Address: 0xA5C60000 Size: 333952 File Visible: - Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys
Address: 0xBADD0000 Size: 4352 File Visible: - Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys
Address: 0xB4ACC000 Size: 361600 File Visible: - Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS
Address: 0xBABF0000 Size: 20480 File Visible: - Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys
Address: 0xB9C45000 Size: 40704 File Visible: - Signed: -
Status: -

Name: UdfReadr_xp.SYS
Image Path: C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS
Address: 0xB4B72000 Size: 206464 File Visible: - Signed: -
Status: -

Name: usbccgp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbccgp.sys
Address: 0xBABA8000 Size: 32128 File Visible: - Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS
Address: 0xBADDC000 Size: 8192 File Visible: - Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys
Address: 0xBABE0000 Size: 30208 File Visible: - Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys
Address: 0xB9C25000 Size: 59520 File Visible: - Signed: -
Status: -

Name: usbohci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbohci.sys
Address: 0xBABD8000 Size: 17152 File Visible: - Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS
Address: 0xB9B91000 Size: 147456 File Visible: - Signed: -
Status: -

Name: usbprint.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbprint.sys
Address: 0xAED11000 Size: 25856 File Visible: - Signed: -
Status: -

Name: usbscan.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbscan.sys
Address: 0xAF7CC000 Size: 15104 File Visible: - Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xBABA0000 Size: 20992 File Visible: - Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS
Address: 0xB973A000 Size: 81920 File Visible: - Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xBA8F8000 Size: 53504 File Visible: - Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys
Address: 0xB8AD8000 Size: 34560 File Visible: - Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xBAC48000 Size: 20480 File Visible: - Signed: -
Status: -

Name: Wdf01000.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
Address: 0xAE434000 Size: 503808 File Visible: - Signed: -
Status: -

Name: WDFLDR.SYS
Image Path: C:\WINDOWS\System32\Drivers\WDFLDR.SYS
Address: 0xAEAA1000 Size: 53248 File Visible: - Signed: -
Status: -

Name: wfsintwq.sys
Image Path: C:\WINDOWS\system32\wfsintwq.sys
Address: 0xB4A40000 Size: 105300 File Visible: - Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000 Size: 1851392 File Visible: - Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000 Size: 1851392 File Visible: - Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS
Address: 0xBADAA000 Size: 8192 File Visible: - Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000 Size: 2154496 File Visible: - Signed: -
Status: -

Name: ws2ifsl.sys
Image Path: C:\WINDOWS\System32\drivers\ws2ifsl.sys
Address: 0xB6A36000 Size: 12032 File Visible: - Signed: -
Status: -

Synes godt om

220661 Ekspert

20. december 2009 - 01:03 #1

Du har kørt:
Malwarebytes antimalware fuldt opdateret fuld scanning.
Renset med CCleaner?

Synes godt om

f-arn Guru

20. december 2009 - 11:58 #2

La' os lige starte helt forfra.

Hent og installér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Den bør du sige nej til.
Lad programmer foretage en oprydning. (også af register)

http://vistaguide.dk/?Artikler/CCleaner-GuideTilOptimeringAfVista/763

------

Hent "Malwarebytes' Anti-Malware" her: http://www.malwarebytes.org/mbam.php
Installer og start programmet, opdater, lav "Hurtig skan" under fanebladet "skanner".
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind sammen med en log fra DDS som du finder her: http://download.bleepingcomputer.com/sUBs/dds.scr

eller her: http://www.forospyware.com/sUBs/dds

Den laver to logs,(DDS.txt og Attach.txt) gem dem på skrivebordet og kopier indholdet af DDS.txt herind.

OBS - DDS skal gemmes på computeren og ikke køres fra nettet.

NB Når du opdaterer Malwarebytes, så klik på opdater til den skriver at der ikke er flere opdateringer.

Synes godt om

johnekroll Nybegynder

20. december 2009 - 12:00 #3

som sagt: har forsøgt mig med 'karise_larry's tale': http://www.eksperten.dk/spm/869716
Den kan ikke køre nogle af programmerne. Dog har jeg kørt VirusFighter - den har fjernet noget men "I-Worm.Bagle.AAKP", "Trojan.TPM.BCD" kan den ikke fjerne permanent.

Skal nok ud i noget 'fejlsikret tilstand - slet alt temp ... mv' ...

...

Synes godt om

johnekroll Nybegynder

20. december 2009 - 15:07 #4

Tak f-arn! - CCleaner bliver blokkeret/kan ikke launche'
et klik på dit Malwarebytes-link får browser'ne til at crache'! (opera, firefox, IE)...
sååååååååå ... søger/googler nu på ´remove':
(Trojan.) TPM.BCD
(Trojan.) TPM.BAY
(I-Worm.) Bagle.AAKP
- som virus fighter bliver ved med at finde ...

Synes godt om

f-arn Guru

20. december 2009 - 15:37 #5

Hvis du ikke kan få nogen programmer til at virke så ptøv at følge denne:
http://www.eksperten.dk/guide/1296
Fromsej har lavet en billedvejledning til kaspersky:
http://www.fromsej.dk/Vejledninger/html/kasres.html

Synes godt om

johnekroll Nybegynder

20. december 2009 - 16:59 #6

Tak f-arn! 'ser på det' \:/

Synes godt om

220661 Ekspert

20. december 2009 - 18:06 #7

Hent programmerne i den nyeste version fra en anden maskine på en usb pind og installer dem. Prøv at opdatere malwarebytes hvis du kan, og hvis du ikke kan lad den finde det den kan i første omgang.Når du har fjernet alt skidtet efter første kørsel kan du måske opdatere igen og køre den.

Synes godt om

f-arn Guru

20. december 2009 - 21:39 #8

@johnekroll
Hvis dit problem skyldes malware, og du vælger at følge 220661s råd, så skal, både installations filen, og selve program filen, til malwarebytes omdøbes til navnet på vigtige windows filer.
Ellers der det meget tvivlsomt om det virker.

Synes godt om

johnekroll Nybegynder

20. december 2009 - 22:21 #9

@f-arn
Tak for post!

har hentet malwarebytes mbam-setup.exe via USB-pind og prøvet at køre - uden held - der sker INGENTING ...

All right - er det så klogt at omdøbe den - og i givet fald til hvad?

Synes godt om

220661 Ekspert

20. december 2009 - 22:46 #10

Er din maskine ikke oppe i Windows?, eller kan du kun køre fejlsikret. Min bror havde noget af det samme problem som dig, og der havde jeg filen jeg downloadede med hen og installerede fra usb pind uden prooblemer. Og jeg omdøbte ikke filen. Mystisk

Synes godt om

johnekroll Nybegynder

20. december 2009 - 22:56 #11

'oppe i windows' - jeg kører ikke fejlsikret! ...

hmmm - er det mon klogt at omdøbe den og køre den - evt fra fejlsikret. Og omdøbe til hvad? ...

Synes godt om

220661 Ekspert

20. december 2009 - 23:08 #12

Prøv at installere fra fejlsikret og se om den kan herfra, uden at omdøbe.

Synes godt om

f-arn Guru

20. december 2009 - 23:11 #13

@johnekroll
du må ta' en beslutning. Hvem af os vil du lytte til. En af os trækker sig.

Synes godt om

johnekroll Nybegynder

20. december 2009 - 23:13 #14

@220661 - læser lige:http://www.bleepingcomputer.com/forums/lofiversion/index.php/t249968.html

Some types of malware will disable Malwarebytes Anti-Malware and other security tools. If MBAM will not install, try renaming it first.
•Right-click on the mbam-setup.exe file file and rename it to mysetup.exe.
•Double-click on mysetup.exe to start the installation.
•If that did not work, then try renaming and changing the file extension. <- click this link if you do not see the file extension
•Right-click on the mbam-setup.exe file, rename it to mysetup and change the .exe extension to .scr, .com, .pif, or .bat.
•Then double-click on mysetup.scr (or whatever extension you renamed it) to begin installation.
If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files.
•Right-click on mbam.exe, rename it to myscan.exe.
•Double-click on myscan.exe to launch the program.
•If that did not work, then try renaming and change the .exe extension in the same way as noted above.
•Double-click on myscan.scr (or whatever extension you renamed it) to launch the program.
If using Windows Vista, refer to How to Change a File Extension in Windows Vista.

Be sure to update MBAM through the program's interface (preferable method) or manually download the definition updates and just double-click on mbam-rules.exe to install. Then perform a Quick Scan in normal mode and check all items found for removal. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the report in your next reply.

Note: MBAM uses Inno Setup instead of the Windows Installer Service to install the program. If installation fails in normal mode, try installing in safe mode. Doing this is usually not advised as MBAM is designed to be at full power when running in normal mode and loses some effectiveness for detection & removal when used in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Therefore, after completing a scan it is recommended to uninstall MBAM, then reinstall it in normal mode and perform another Quick Scan.

Synes godt om

220661 Ekspert

20. december 2009 - 23:20 #15

Det behøver han ikke,du tager den bare herfra f-arn. Fint nok med mig.

Synes godt om

johnekroll Nybegynder

20. december 2009 - 23:23 #16

@f-arn
Don't make me choose - huhu'! ... \;-(

allright - hvis det er uomgiveligt vilkår så ser jeg mig nødsaget til at vælge 'f-arn' baseret på 7.945 point mod 4.175 point ... uhuh'...

Jeg er newbie her så tilgiv mig hvis jeg træder lidt ved siden af.

;o)

Synes godt om

f-arn Guru

20. december 2009 - 23:24 #17

Ok, så har jeg hermed trukket mig og overvåger ikke længere denne "tråd"

Synes godt om

johnekroll Nybegynder

20. december 2009 - 23:26 #18

Tak for dine posts 220661! -god jul og godt nytår! :D

Synes godt om

johnekroll Nybegynder

20. december 2009 - 23:28 #19

WHAT? - det gik vist lidt for hurtigt f-arn og 220661 - jeg kan godt svare for mig selv!

Synes godt om

f-arn Guru

20. december 2009 - 23:32 #20

Beklager-jeg så ikke de to sidste kommentarer før jeg skrev mit sidste indlæg.
Men-jeg er søvnig, så vi bli'r nødt til at fortsætte i morgen.

Synes godt om

220661 Ekspert

20. december 2009 - 23:33 #21

Jeg har ikke lukket tråden endnu,. Kan ikke forstå f-arn, at han reagerer på denne måde.
Da jeg kun har været medlem her på eksperten i 2 måneder, vil jeg ikke gøre mig upopulær med nogen. Det var derfor jeg trak mig lidt i baggrunden og ville være med på en kigger. Men det var ikke det f-arn ville desværre.

Synes godt om

johnekroll Nybegynder

20. december 2009 - 23:38 #22

Dognat de herrer' :D

@220661 - hehe - 'ny på arbejde' så må man lige se hvem der sidder hvor i kantinen'

@f-arn - tak for venligheden! :D

postes' ved i morgen :)

overandout'

Synes godt om

220661 Ekspert

20. december 2009 - 23:38 #23

Det var godt det var problemer med indlæggene der var skyld i misforståelserne. Min intention er at hjælpe, og jeg gør hvad jeg kan. Håber det hjælper i den rigtige retning.

Synes godt om

f-arn Guru

20. december 2009 - 23:39 #24

WHAT? - det gik vist lidt for hurtigt f-arn og 220661 - jeg kan godt svare for mig selv!

Jeg gider ikke mere-god fornøjelse.

Synes godt om

johnekroll Nybegynder

21. december 2009 - 14:16 #25

f-arm "så skal, både installations filen, og selve program filen, til malwarebytes omdøbes til navnet på vigtige windows filer.
Ellers der det meget tvivlsomt om det virker."

har forsøgt mig med omdøbning af mbam-setup.exe til explorer.exe uden held - kan ikke finde to filer at omdøbe ... (newbie...)

har forsøgt at F8' mig til fejlsikret - det begynder fint men 10sekunder inde begynder booten forfra i standard mode'...

...S.O.S...

Synes godt om

220661 Ekspert

21. december 2009 - 14:46 #26

Bærbar eller stationær? Styresystem?

Synes godt om

johnekroll Nybegynder

21. december 2009 - 14:53 #27

stationær XP SP3

Synes godt om

220661 Ekspert

21. december 2009 - 14:53 #28

Har du prøvet det du selv fandt i #14?

Synes godt om

220661 Ekspert

21. december 2009 - 14:55 #29

omdøbe filen til mysetup.exe og prøve det?

Synes godt om

johnekroll Nybegynder

21. december 2009 - 15:01 #30

har prøvet! ingen forskel

... tænker på at sætte en ny HD med WIN7 i maskinen og sideløbende redde den nuværende XP ...

Synes godt om

220661 Ekspert

21. december 2009 - 15:06 #31

Ja eller sætte harddisken til sata/ide til usb adapter og scanne den fra en fuldt opdateret computer. Du kan ikke sætte en hd fra en anden maskine med windows 7 i, og forvente den kan boote op med den. Du kan sætte den inficerede disk i den anden maskine med win 7 fuldt opdateret og scanne derfra.

Synes godt om

220661 Ekspert

21. december 2009 - 15:11 #32

Men helt ærligt,hvis det er det du vil, så tag backup af de ting du vil passe på, inden du går igang med de store armbevægelser.
Havde det været mig og muligheden var der, havde jeg startet helt fra bunden med windows installation.

Synes godt om

johnekroll Nybegynder

21. december 2009 - 16:49 #33

Tak 220661!
Ved godt at jeg ikke kan redde XP-eren med en anden Win i samme maskine.
Rigtig god ide at backe' ALT væsentligt op før jeg gør noget mere - eventuelt skitseret af f-arn i #5 - og så stille og roligt bygge en WIN7 op.
Der kan dog nok gå 3uger før WIN7 kan kører som workstation...

Synes godt om

f-arn Guru

21. december 2009 - 17:10 #34

Start RootRepeal og vælg "report", klik skan og sæt flueben i "files" og "Hidden services" og lad den søge
Når den er færdig viser den en liste over filer.
Tryk på "save report" og send den herind.

Synes godt om

johnekroll Nybegynder

21. december 2009 - 18:54 #35

@f-arn - tak for post!
Har prøvet den før - med samme resultat: CRASCH! - 1 sekunds blå skærm med gul+ tekst og så en automatisk reboot... arrrgh! ...

btw: VirusFighter' rapporterer om tre angreb:
Bagle.AAKP (I-Worm)og
TPM.BAY (Trojan)
TPM.BCD (Trojan)

...

Synes godt om

f-arn Guru

21. december 2009 - 19:23 #36

Jeg kunne bare se at du havde kørt rootrepeal.

hent: http://www.gmer.net/download.php
og download installationsprogrammet for Gmer til skrivebordet, og klik derefter på filen for at køre Gmer.

Hvis den indledende scanning Gmer lokaliserer poster vist i rødt eller angiver "skjult" eller "rootkit", stop der, og klik på Kopiér knappen, og højreklik på skrivebordet, vælg Nyt Tekst dokument. Når filen er oprettet, skal du åbne den og højreklik igen og vælge Sæt ind. Kopier indholdet og post det her, tak.
jeg ønsker ikke, at computeren går ned bare for at tage et første kig på tingene.

Hvis ikke, så klik på Scan, før scanning, skal du sørge for alle andre programmer er lukket, og ingen andre aktioner såsom en planlagt antivirus scanning vil ske samtidig med denne scanning. Brug heller ikke computeren under scanningen.

Når scanningen er færdig, klik på Kopier knappen, og højreklik på skrivebordet, vælg nyt Tekst dokument. Når filen er oprettet, skal du åbne den og højreklik igen og vælge Sæt ind. Kopier oplysninger og post det her tak.

Synes godt om

johnekroll Nybegynder

21. december 2009 - 23:28 #37

Tak for post' f-arn!

browsere crasher når jeg vil ind på gmer-sites ...
Kan prøve i morgen at hente den via en anden PC i morgen ...

natnat

:D

Synes godt om

f-arn Guru

21. december 2009 - 23:35 #38

Så hent lige den her også:
http://sites.google.com/site/sysprotantirootkit/Home/SysProt.zip?attredirects=0

Synes godt om

f-arn Guru

22. december 2009 - 03:14 #39

brug dette link istedet:
http://sites.google.com/site/sysprotantirootkit/Home/SysProt.zip?attredirects=0&d=1

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
Er gratis Bitdefender værd at installere ? Af Ikke-ekspert i Virus	8	31/08/202519:08	01/09/202514:18
Ukendte filer på min Pc Af jonpet i Virus	10	03/02/202514:20	04/02/202511:05
mulig ukendt virus Af jackie18 i Virus	3	18/01/202514:07	18/01/202516:39
virus popper op med jævne mellemrum Af Malm i Virus	13	18/01/202511:40	20/01/202517:53
Total AV Af Malm i Virus	10	16/01/202516:48	17/01/202520:47

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS