Jeg har fået en virus eller en trojan.

Hent Ccleaner her > Klik ude til højre på "Download Latest Version".
http://www.filehippo.com/download_ccleaner/
Der er en manual her > http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Der er en lille forskel "Problemer" er udskiftet med "Register".
Sæt de flueben som vist i manualen punkt 11 inden du kører "Renser".
PS.: Dette program vil  jeg anbefale dig at beholde, det er fremragende til at rydde op med.

Under installationen får du tilbudt [Yahoo Toolbar]. Sig "Nej"  til den.
Lad programmer foretage en oprydning i Renser og Register, og lad den slette det den finder.
Jeg skal ikke se log fra Ccleaner.



Hent Malwarebytes Anti-Malware herfra:
http://www.malwarebytes.org/mbam-download.php
Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

Manual for HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

Hent Hijackthis her: http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

PS: Vistabrugere skal klikke med højre-musetast på filen og vælge (Kør som administrator)

Det har jeg så gjort nu. :-)

Den ene fra malware:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4090

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11-05-2010 22:36:46
mbam-log-2010-05-11 (22-36-46).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 165511
Tid gået: 40 minut(ter), 38 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 5
Registreringsdatabaseværdier Inficeret: 1
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 5

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65589dbe-901a-41fd-b793-d0fb95d33f7f} (Trojan.BHO.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{65589dbe-901a-41fd-b793-d0fb95d33f7f} (Trojan.BHO.H) -> No action taken.
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> No action taken.

Registreringsdatabaseværdier Inficeret:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (IM.Worm) -> No action taken.

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
c:\WINDOWS\system32\wesqxko.dll (Trojan.BHO.H) -> No action taken.
C:\Documents and Settings\Henrik\Lokale indstillinger\Temp\gtogxjyx.dat (Rootkit.Agent) -> No action taken.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Henrik\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.


Den anden fra hijack:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:48:38, on 11-05-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgchsvx.exe
C:\Programmer\AVG\AVG9\avgrsx.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Programmer\Support.com\bin\tgcmd.exe
C:\Programmer\Fælles filer\Java\Java Update\jusched.exe
C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\AVG\AVG9\avgnsx.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgemc.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqbam08.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Henrik\Skrivebord\High jack\HiJackThis(2).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [hcenter] "C:\Programmer\Support.com\bin\tgcmd.exe" /server /startmonitor
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Fælles filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Programmer\4shared Desktop\down_all.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.2.1
O15 - ESC Trusted IP range: http://192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

--
End of file - 5925 bytes

Ups :)

"No action taken"

Ny scanning med Malwarebytes Anti-Malware, og husk: "Fjern det valgte".

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4090

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11-05-2010 22:37:16
mbam-log-2010-05-11 (22-37-16).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 165511
Tid gået: 40 minut(ter), 38 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 5
Registreringsdatabaseværdier Inficeret: 1
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 5

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65589dbe-901a-41fd-b793-d0fb95d33f7f} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{65589dbe-901a-41fd-b793-d0fb95d33f7f} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.

Registreringsdatabaseværdier Inficeret:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (IM.Worm) -> Quarantined and deleted successfully.

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
c:\WINDOWS\system32\wesqxko.dll (Trojan.BHO.H) -> Delete on reboot.
C:\Documents and Settings\Henrik\Lokale indstillinger\Temp\gtogxjyx.dat (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Henrik\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.



Hijack:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:20:26, on 12-05-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgchsvx.exe
C:\Programmer\AVG\AVG9\avgrsx.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Programmer\Support.com\bin\tgcmd.exe
C:\Programmer\Fælles filer\Java\Java Update\jusched.exe
C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\Programmer\AVG\AVG9\avgnsx.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgemc.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqbam08.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Henrik\Skrivebord\High jack\HiJackThis(2).exe
C:\WINDOWS\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [hcenter] "C:\Programmer\Support.com\bin\tgcmd.exe" /server /startmonitor
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Fælles filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Programmer\4shared Desktop\down_all.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.2.1
O15 - ESC Trusted IP range: http://192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

--
End of file - 5892 bytes

...Internet Explorer v6.00 ... ???
Du mangler sansynligvis også MANGE andre opdateringer fra WindowsUpdate ???

Selvom du "kun" bruger FireFox, så kan/vil 'banditterne' bruge en IKKE opdateret IE på din PC!!!

Nemlig :)

Hullerne i IE6 forsvinder jo ikke, selv om man ikke bruger det...

Opdater IE

Kender du disse ip´er?

O15 - Trusted IP range: http://192.168.2.1 
O15 - ESC Trusted IP range: http://192.168.2.1



Hent og installere SAS

http://kortlink.dk/3g4f/


Start superantispyware, klik på Tjek for opdateringer.
Klik på Skan din computer, sæt flueben ved alle drev. (Fixed disk betyder harddisk)
Flyt prikken til Udfør komplet skan og klik på Næste, så kører scanningen.


Når den er færdig kommer der et vindue med en opsummering, klik på OK, klik så på næste og så på Udfør.

Der kommer et vindue med Quarantine and removal Complete, klik på OK, klik på Udfør.
Luk programmet, genstart normalt.
---------------------------------------
Start SuperAntiSpyware igen, klik på Preferences, skift til fanebladet Statistics/Logs, i vinduet dobbeltklikker du på SUPERAntiSpyware Scan Log.


Kom så med sas loggen og en ny log fra malwarebytes og hijackthis

OBS: HUSK at opdatere malwarebytes inden du scanner.

De to ip'er? Er det ikke min egen ip? :-)

Jeg går i gang med at scanne med det samme og vender tilbage..

De 2 IP´er ligner IP på en router...?

Ja det er min router. :-)

Her er så tre friske logs:


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/12/2010 at 08:21 PM

Application Version : 4.34.1000

Core Rules Database Version : 4924
Trace Rules Database Version: 2736

Scan type      : Complete Scan
Total Scan Time : 00:30:20

Memory items scanned      : 498
Memory threats detected  : 1
Registry items scanned    : 5251
Registry threats detected : 11
File items scanned        : 15520
File threats detected    : 12

Adware.Vundo/Variant-Bx
    C:\WINDOWS\SYSTEM32\OATVHDY.DLL
    C:\WINDOWS\SYSTEM32\OATVHDY.DLL
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65589DBE-901A-41FD-B793-D0FB95D33F7F}
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}#Version
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}\InprocServer32
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}\InprocServer32#ThreadingModel
    HKCR\CLSID\{65589DBE-901A-41FD-B793-D0FB95D33F7F}\ProgID
    HKCR\Mrgpltlm
    HKCR\Mrgpltlm#TimeStamp
    HKCR\Mrgpltlm\CLSID
    HKU\S-1-5-21-823518204-1482476501-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{65589DBE-901A-41FD-B793-D0FB95D33F7F}

Adware.Tracking Cookie
    C:\Documents and Settings\Henrik\Cookies\system@adfscript[1].txt
    C:\Documents and Settings\Henrik\Cookies\system@ad.yieldmanager[1].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@nojsstats.appspot[2].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@bluestreak[1].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Henrik\Cookies\system@track.adform[2].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@atdmt[1].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@eas8.emediate[2].txt
    C:\Documents and Settings\Henrik\Cookies\system@edge.ru4[1].txt

Trojan.SVCHost/Fake
    C:\WINDOWS\TEMP\RSQO.TMP\SVCHOST.EXE
    C:\WINDOWS\Prefetch\SVCHOST.EXE-11664DAB.pf




Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4090

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12-05-2010 21:04:51
mbam-log-2010-05-12 (21-04-51).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 168086
Tid gået: 36 minut(ter), 16 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
(Ingen skadelige objekter blev fundet)




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:06:22, on 12-05-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgchsvx.exe
C:\Programmer\AVG\AVG9\avgrsx.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Programmer\Support.com\bin\tgcmd.exe
C:\Programmer\Fælles filer\Java\Java Update\jusched.exe
C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\AVG\AVG9\avgwdsvc.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\AVG\AVG9\avgnsx.exe
C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\AVG\AVG9\avgemc.exe
C:\Programmer\AVG\AVG9\avgcsrvx.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqbam08.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Henrik\Skrivebord\High jack\HiJackThis(2).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [hcenter] "C:\Programmer\Support.com\bin\tgcmd.exe" /server /startmonitor
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Fælles filer\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Programmer\4shared Desktop\down_all.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted IP range: http://192.168.2.1
O15 - ESC Trusted IP range: http://192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmer\AVG\AVG9\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

--
End of file - 6251 bytes

Credits to Atribune for this fix:
http://www.atribu...view/24/1/

-- Download dette fix til rodbiblioteket på din computer (som regel c:\):
http://www.atribu...k.php?id=4

-- Dobbeltklik på VundoFix.exe for at køre det. Klik på "Scan for Vundo"-knappen. Når programmet er færdig med at scanne, skal du klikke på "Remove Vundo"-knappen

Du vil så blive spurgt om du er sikker på, at du vil fjerne filerne. Her skal du klikke på "Yes". Herefter bliver dit skrivebord blankt, og fixet vil forsøge at fjerne Vundo. Når den er færdig, vil værktøjet have lov til at genstarte computeren. Det skal du acceptere.

Genstart herefter computeren, og lav en ny log med HJT, som du lægger herind. Læg også indholdet af denne fil herind: C:\vundofix.txt

Bemærk: Det er muligt at Vundofix ved første scanning finder en fil, som den ikke kan fjerne i første omgang. Så vil Vundofixet genstarte, og fortsætte efter genstarten. HVis dette sker, skal du bare følge instruksionerne ovenfor efter genstarten (startende med "Klik på Scan for Vundo-knappen

Patrik14, dine link virker ikke. :-(

Download vundofix her: http://www.atribune.org/ccount/click.php?id=4

Jeg fandt dem her: http://www.ejvindh.net/forum/viewthread.php?thread_id=30

Denne her virker: http://www.atribune.org/ccount/click.php?id=4
Men http://www.atribune.org/content/view/24/1/ virker ikke.

Der var ingen inficerede filer:


VundoFix V7.0.6

Scan started at 13:22:21 13-05-2010

Listing files found while scanning....

No infected files were found.

Download Lop S&D by Eric_71 og gem det på dit Skrivebord.
http://eric.71.mespages.googlepages.com/lop.sd.en
Klik på - Download knappen til venstre

—Kør LopSD. Tast e - for Engelsk. Tryk Enter.
Tast så 2 = (Fix + Hosts)
Tryk Enter. Så kører scanningen.
Lad programmet gennemføre en rensning.

Når scanningen er færdig, ligger der en log fil her C:lopR txt, som du godt må kopiere ind i dit næste svar.

Efter LOPSD så vil jeg gerne have dig til at gøre følgende:

Hent VirtumundoBeGone, gem det på skrivebordet:
http://secured2k....BeGone.exe

-- Luk alle kørende programmer, også Internetvinduer, dobbeltklik på VirtumundoBeGone.exe på skrivebordet, læs intro-informationen, klik så på Continue, klik på Start.
Når den spørger om du vil fortsætte, klik på Yes for at køre fixet.
Klik så på Save log.

-- Det sker sommetider at fixet afslutter med "BSOD"(blå skærm og frosset PC) så skal du bare genstarte på Resetknappen.

-- Der kommer en tekstfil på dit skrivebord der hedder VBG.TXT

Kan du ikke lige komme med forklaring på hvorfor du vil ha´  ham til at køre de programmer, det er det rene gætværk og kopiering andre steder fra.

sullep, duar meget mere erfaring end mig så du overtager bare ;)

Nej, det gør jeg ikke.

wowjoey, hvis at du ikke er tryg ved at jeg supporter dig, så synes jeg at du skal oprette dit spørgsmål på www.spywarefri.dk/forum og linke til tråden her. :)

Der kommer et par logs mere :-)

Sjov nok at jeg godt kan skrive her, men jeg kan ikke paste en log ind??? Har det noget med indholdet af loggen?

Prøv at uploade dem til www.gratisupload.dk og smide linksne her.

[05/13/2010, 15:10:12] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Henrik\Dokumenter\Hentede filer\VirtumundoBeGone.exe" )
[05/13/2010, 15:10:17] - Detected System Information:
[05/13/2010, 15:10:17] -  Windows Version: 5.1.2600, Service Pack 3
[05/13/2010, 15:10:17] -  Current Username: Henrik (Admin)
[05/13/2010, 15:10:17] -  Windows is in NORMAL mode.
[05/13/2010, 15:10:17] - Searching for Browser Helper Objects:
[05/13/2010, 15:10:17] -  BHO 1: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} (Adobe PDF Link Helper)
[05/13/2010, 15:10:17] -  BHO 2: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (AVG Safe Search)
[05/13/2010, 15:10:17] -  BHO 3: {DBC80044-A445-435b-BC74-9C25C1C588A9} (Java(tm) Plug-In 2 SSV Helper)
[05/13/2010, 15:10:17] -  BHO 4: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} (JQSIEStartDetectorImpl Class)
[05/13/2010, 15:10:17] - Finished Searching Browser Helper Objects
[05/13/2010, 15:10:17] - Finishing up...
[05/13/2010, 15:10:17] - Nothing found! Exiting...

Den VIL ikke acceptere loggen fra Lop SD. Browseren siger at den er udløbet når jeg klikker opret

Upload den til www.gratisupload.dk og give mig linket fra gratisupload

Den ville sgu heller ikke der.. Ikke før jeg pakkede filen. Underligt. Men nu er den der altså, og den er som sagt pakket.

http://www.gratisupload.dk/download/43856/

Denne linie kan jeg ikke lide

--------------------\\  Cracks & Keygens ..

  C:\DOCUME~1\Henrik\Application Data\uTorrent\2_Clone CD + Any DVD + Clone DVD + cracks.rar.torrent
  C:\DOCUME~1\Henrik\Dokumenter\Downloads\2_Clone CD + Any DVD + Clone DVD + cracks.rar
  C:\DOCUME~1\Henrik\Dokumenter\DRM\Keygen
  C:\DOCUME~1\Henrik\Dokumenter\DRM\Keygen\Keygen.exe
  C:\DOCUME~1\Henrik\Dokumenter\Filer\Adobe\keygen.exe

Har du scannet craksne og keygensne inden at du brugte dem?


Hent Combofix, og gem den i en mappe som alg.exe:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Åbn mappen med Combofix, højreklik et tomt sted i mappen, vælg Ny->tekstdokument, åbn tekstdokumentet, kopier følgende ind:

Killall::
Snapshot::

klik på Filer->Gem som, navngiv den CFScript, luk tekstdokumentet.

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/swfcombo.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Kopier den fremkomne log herind.


OBS: Den må ikke hedde alg.exe.exe eller CFScript.txt.txt, du kan kun se typerne når at du har slået fuld visning til.

--------------------\\  Lop S&D 4.2.5-0  XP/Vista

  Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
  X86-based PC ( Uniprocessor Free :        Intel(R) Pentium(R) M processor 1.73GHz )
  BIOS : Phoenix NoteBIOS 4.0 Release 6.1   
  USER : Henrik ( Administrator )
  BOOT : Normal boot
  Antivirus : AVG Anti-Virus Free 9.0 (Activated)
  C:\ (Local Disk) - NTFS - Total:55 Go (Free:28 Go)
  D:\ (CD or DVD)
  E:\ (CD or DVD)

  "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
  Option : [2] ( 13-05-2010|14:30 )


  \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


  --------------------\\  Listing folders in APPLIC~1

  [24-03-2010|20:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
  [10-05-2010|18:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\Spyware Terminator
  [10-05-2010|17:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
  [0|fil(er)] C:\DOCUME~1\ADMINI~1\APPLIC~1\byte
  [5|mappe(r)] C:\DOCUME~1\ADMINI~1\APPLIC~1\byte ledig

  [11-05-2010|14:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
  [19-01-2010|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
  [20-04-2010|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
  [20-04-2010|17:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
  [03-01-2010|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg9
  [20-04-2010|17:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
  [02-04-2010|13:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
  [03-03-2010|22:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Global Graphics
  [04-01-2010|18:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
  [04-04-2010|10:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
  [04-04-2010|11:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP Product Assistant
  [11-05-2010|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
  [11-05-2010|21:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
  [20-04-2010|16:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
  [19-04-2010|15:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
  [20-04-2010|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
  [20-04-2010|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
  [11-05-2010|14:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
  [30-03-2010|23:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sun
  [24-03-2010|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
  [03-01-2010|20:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
  [20-03-2010|14:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
  [09-04-2010|11:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
  [06-03-2010|09:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WEBREG
  [23-02-2010|11:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
  [20-04-2010|18:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\xml_param
  [0|fil(er)] C:\DOCUME~1\ALLUSE~1\APPLIC~1\byte
  [28|mappe(r)] C:\DOCUME~1\ALLUSE~1\APPLIC~1\byte ledig

  [03-01-2010|20:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
  [0|fil(er)] C:\DOCUME~1\DEFAUL~1\APPLIC~1\byte
  [3|mappe(r)] C:\DOCUME~1\DEFAUL~1\APPLIC~1\byte ledig

  [27-03-2010|22:34] C:\DOCUME~1\Henrik\APPLIC~1\AccurateRip
  [03-05-2010|12:30] C:\DOCUME~1\Henrik\APPLIC~1\Adobe
  [20-04-2010|17:52] C:\DOCUME~1\Henrik\APPLIC~1\Apple Computer
  [02-05-2010|23:56] C:\DOCUME~1\Henrik\APPLIC~1\dvdcss
  [27-03-2010|22:27] C:\DOCUME~1\Henrik\APPLIC~1\FreeAudioPack
  [03-03-2010|22:46] C:\DOCUME~1\Henrik\APPLIC~1\Global Graphics
  [04-01-2010|22:38] C:\DOCUME~1\Henrik\APPLIC~1\HP
  [14-04-2010|08:22] C:\DOCUME~1\Henrik\APPLIC~1\Hyperz
  [03-01-2010|20:31] C:\DOCUME~1\Henrik\APPLIC~1\Identities
  [10-04-2010|10:22] C:\DOCUME~1\Henrik\APPLIC~1\ImgBurn
  [03-03-2010|22:43] C:\DOCUME~1\Henrik\APPLIC~1\jaws
  [04-01-2010|18:02] C:\DOCUME~1\Henrik\APPLIC~1\Macromedia
  [11-05-2010|21:44] C:\DOCUME~1\Henrik\APPLIC~1\Malwarebytes
  [20-04-2010|17:27] C:\DOCUME~1\Henrik\APPLIC~1\Microsoft
  [04-01-2010|00:51] C:\DOCUME~1\Henrik\APPLIC~1\Mozilla
  [20-03-2010|13:38] C:\DOCUME~1\Henrik\APPLIC~1\nCleaner
  [15-03-2010|00:32] C:\DOCUME~1\Henrik\APPLIC~1\Opera
  [30-03-2010|14:02] C:\DOCUME~1\Henrik\APPLIC~1\Scribus
  [20-04-2010|17:34] C:\DOCUME~1\Henrik\APPLIC~1\Sony
  [20-04-2010|17:20] C:\DOCUME~1\Henrik\APPLIC~1\Sony Setup
  [11-05-2010|14:28] C:\DOCUME~1\Henrik\APPLIC~1\Spyware Terminator
  [04-01-2010|00:57] C:\DOCUME~1\Henrik\APPLIC~1\Sun
  [11-05-2010|14:23] C:\DOCUME~1\Henrik\APPLIC~1\SUPERAntiSpyware.com
  [24-03-2010|20:33] C:\DOCUME~1\Henrik\APPLIC~1\SystemRequirementsLab
  [11-05-2010|14:22] C:\DOCUME~1\Henrik\APPLIC~1\uTorrent
  [08-04-2010|21:19] C:\DOCUME~1\Henrik\APPLIC~1\vlc
  [11-05-2010|14:02] C:\DOCUME~1\Henrik\APPLIC~1\Vso
  [14-04-2010|10:02] C:\DOCUME~1\Henrik\APPLIC~1\YoWindow
  [0|fil(er)] C:\DOCUME~1\Henrik\APPLIC~1\byte
  [30|mappe(r)] C:\DOCUME~1\Henrik\APPLIC~1\byte ledig

  [03-01-2010|20:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
  [0|fil(er)] C:\DOCUME~1\LOCALS~1\APPLIC~1\byte
  [3|mappe(r)] C:\DOCUME~1\LOCALS~1\APPLIC~1\byte ledig

  [11-05-2010|20:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\Adobe
  [11-05-2010|20:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\Macromedia
  [03-01-2010|20:29] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
  [0|fil(er)] C:\DOCUME~1\NETWOR~1\APPLIC~1\byte
  [5|mappe(r)] C:\DOCUME~1\NETWOR~1\APPLIC~1\byte ledig

  --------------------\\  Scheduled Tasks located in C:\WINDOWS\Tasks

  [20-04-2010 17:24][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
  [12-05-2010 20:27][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
  [12-05-2010 20:23][--a------] C:\WINDOWS\tasks\WGASetup.job
  [12-05-2010 20:23][--ah-----] C:\WINDOWS\tasks\SA.DAT
  [09-10-2001 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

  --------------------\\  Listing Folders in C:\Programmer

  [09-03-2010|18:47] C:\Programmer\Acro Software
  [19-01-2010|12:34] C:\Programmer\Adobe
  [20-04-2010|17:24] C:\Programmer\Apple Software Update
  [03-01-2010|20:50] C:\Programmer\AVG
  [11-05-2010|21:33] C:\Programmer\CCleaner
  [23-02-2010|15:35] C:\Programmer\CD & DVD Label Maker
  [03-01-2010|20:22] C:\Programmer\ComPlus Applications
  [28-03-2010|11:30] C:\Programmer\Daniusoft
  [27-03-2010|22:23] C:\Programmer\directx
  [07-02-2010|18:44] C:\Programmer\DVD Decrypter
  [01-04-2010|18:37] C:\Programmer\DVD Shrink
  [01-04-2010|09:11] C:\Programmer\Elaborate Bytes
  [21-03-2010|18:11] C:\Programmer\Enigma Software Group
  [27-03-2010|22:51] C:\Programmer\FLVCodec
  [31-01-2010|11:24] C:\Programmer\FreeUndelete
  [11-05-2010|14:23] C:\Programmer\F‘lles filer
  [30-03-2010|22:58] C:\Programmer\Google
  [09-03-2010|18:54] C:\Programmer\GPLGS
  [30-03-2010|13:30] C:\Programmer\gs
  [04-04-2010|11:05] C:\Programmer\Hewlett-Packard
  [04-04-2010|11:05] C:\Programmer\HP
  [27-03-2010|22:34] C:\Programmer\Illustrate
  [01-04-2010|09:20] C:\Programmer\ImgBurn
  [21-04-2010|17:28] C:\Programmer\InstallShield Installation Information
  [12-05-2010|07:05] C:\Programmer\Internet Explorer
  [18-04-2010|14:33] C:\Programmer\Java
  [23-02-2010|12:08] C:\Programmer\K-Lite Codec Pack
  [27-03-2010|16:14] C:\Programmer\Lavalys
  [11-05-2010|11:49] C:\Programmer\Lavasoft
  [11-05-2010|21:43] C:\Programmer\Malwarebytes' Anti-Malware
  [03-01-2010|22:19] C:\Programmer\Messenger
  [20-03-2010|14:04] C:\Programmer\Microsoft AntiSpyware
  [03-01-2010|20:26] C:\Programmer\microsoft frontpage
  [30-03-2010|23:15] C:\Programmer\Microsoft Office
  [24-03-2010|20:32] C:\Programmer\Microsoft Windows 7 Upgrade Advisor
  [30-03-2010|22:46] C:\Programmer\Microsoft.NET
  [20-04-2010|18:00] C:\Programmer\MIKSOFT
  [14-03-2010|09:58] C:\Programmer\Movie Maker
  [11-05-2010|14:02] C:\Programmer\Mozilla Firefox
  [30-03-2010|23:15] C:\Programmer\MSBuild
  [03-01-2010|20:21] C:\Programmer\MSN Gaming Zone
  [05-01-2010|15:58] C:\Programmer\MSXML 4.0
  [03-01-2010|22:04] C:\Programmer\NetMeeting
  [20-03-2010|13:37] C:\Programmer\NKProds
  [03-01-2010|20:24] C:\Programmer\Onlinetjenester
  [03-01-2010|22:17] C:\Programmer\Outlook Express
  [10-05-2010|14:54] C:\Programmer\QuickTime
  [19-04-2010|16:59] C:\Programmer\RamBooster
  [04-03-2010|19:14] C:\Programmer\Reference Assemblies
  [30-03-2010|17:34] C:\Programmer\Simple Port Forwarding
  [01-04-2010|09:04] C:\Programmer\SlySoft
  [20-04-2010|17:28] C:\Programmer\Sony
  [21-04-2010|17:28] C:\Programmer\Sony Ericsson
  [11-05-2010|14:23] C:\Programmer\Spyware Terminator
  [11-05-2010|14:23] C:\Programmer\SUPERAntiSpyware
  [03-01-2010|21:00] C:\Programmer\Support.com
  [03-01-2010|20:59] C:\Programmer\SupportSoft
  [24-03-2010|20:33] C:\Programmer\SystemRequirementsLab
  [09-04-2010|23:13] C:\Programmer\TotalCommanderPortable
  [03-01-2010|20:31] C:\Programmer\Uninstall Information
  [23-02-2010|13:14] C:\Programmer\uTorrent
  [08-04-2010|21:17] C:\Programmer\VideoLAN
  [05-04-2010|18:20] C:\Programmer\VSO
  [23-02-2010|11:53] C:\Programmer\Windows Media Connect 2
  [23-02-2010|11:55] C:\Programmer\Windows Media Player
  [10-05-2010|16:20] C:\Programmer\Windows NT
  [03-01-2010|20:24] C:\Programmer\WindowsUpdate
  [27-03-2010|22:51] C:\Programmer\WinPcap
  [03-01-2010|21:08] C:\Programmer\WinRAR
  [03-01-2010|20:26] C:\Programmer\xerox
  [13-04-2010|17:17] C:\Programmer\YoWindow
  [0|fil(er)] C:\Programmer\byte
  [73|mappe(r)] C:\Programmer\byte ledig

  --------------------\\  Listing Folders in C:\Programmer\F‘lles filer

  [03-05-2010|12:31] C:\Programmer\F‘lles filer\Adobe
  [20-04-2010|17:25] C:\Programmer\F‘lles filer\Apple
  [04-02-2010|19:30] C:\Programmer\F‘lles filer\Blizzard Entertainment
  [30-03-2010|22:47] C:\Programmer\F‘lles filer\DESIGNER
  [04-01-2010|18:22] C:\Programmer\F‘lles filer\Hewlett-Packard
  [04-04-2010|11:04] C:\Programmer\F‘lles filer\HP
  [17-04-2010|08:38] C:\Programmer\F‘lles filer\InstallShield
  [30-03-2010|23:06] C:\Programmer\F‘lles filer\Java
  [14-04-2010|19:31] C:\Programmer\F‘lles filer\Microsoft Shared
  [03-01-2010|20:23] C:\Programmer\F‘lles filer\MSSoap
  [03-01-2010|21:16] C:\Programmer\F‘lles filer\ODBC
  [20-04-2010|17:28] C:\Programmer\F‘lles filer\Sony Shared
  [03-01-2010|21:16] C:\Programmer\F‘lles filer\SpeechEngines
  [30-03-2010|23:11] C:\Programmer\F‘lles filer\System
  [03-01-2010|20:23] C:\Programmer\F‘lles filer\Tjenester
  [11-05-2010|14:23] C:\Programmer\F‘lles filer\Wise Installation Wizard
  [0|fil(er)] C:\Programmer\F‘lles filer\byte
  [18|mappe(r)] C:\Programmer\F‘lles filer\byte ledig

  --------------------\\  Process

  ( 44 Processes )

  ... OK !

  --------------------\\  Searching with S_Lop

  No Lop folder found !

  --------------------\\  Searching for Lop Files - Folders

  No Lop folder found !

  --------------------\\  Searching within the Registry

  ..... OK !

  --------------------\\  Checking the Hosts file

  Hosts file CLEAN


  --------------------\\  Searching for hidden files with Catchme

  catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2010-05-13 14:40:55
  Windows 5.1.2600 Service Pack 3 NTFS
  scanning hidden processes ...
  scanning hidden files ...
  scan completed successfully
  hidden processes: 0
  hidden files: 0

  --------------------\\  Searching for other infections

  --------------------\\  Cracks & Keygens ..

  C:\DOCUME~1\Henrik\Application Data\uTorrent\2_Clone CD + Any DVD + Clone DVD + cracks.rar.torrent
  C:\DOCUME~1\Henrik\Dokumenter\Downloads\2_Clone CD + Any DVD + Clone DVD + cracks.rar
  C:\DOCUME~1\Henrik\Dokumenter\DRM\Keygen
  C:\DOCUME~1\Henrik\Dokumenter\DRM\Keygen\Keygen.exe
  C:\DOCUME~1\Henrik\Dokumenter\Filer\Adobe\keygen.exe


  [F:137][D:8]-> C:\DOCUME~1\Henrik\LOKALE~1\Temp
  [F:21][D:0]-> C:\DOCUME~1\Henrik\Cookies
  [F:738][D:4]-> C:\DOCUME~1\Henrik\LOKALE~1\TEMPOR~1\content.IE5

  1 - "C:\Lop SD\LopR_1.txt" - 13-05-2010|14:42 - Option : [2]

  --------------------\\  Scan completed at 14:42:56

Har lige sat de lodsd log ind for dig ;)

De cracks og keygen er scannet. Og de har været på pc'en lang tid før jeg fik en virus.

Combofix fortæller mig at jeg skal slå antivirus fra (avg)ellers kan det skade computeren. Kan det passe? Jeg tror umiddelbart ikke at jeg kan deaktivere den?

Måske skal jeg starte op i safe-mode?

Og hvad er det lige præcis combofix gør?

Bare kør combofix med avg slået til.

Combofix er et meget advanceret stykke software til at finde og fjerne virus.

Så lykkedes det også. Her er en log:


ComboFix 10-05-12.06 - Henrik 13-05-2010  19:39:12.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1030.18.2046.1597 [GMT 2:00]
Kører fra: c:\alg\ComboFix.exe
Kommandoer benyttet :: c:\alg\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\hpeC76.dll
c:\documents and settings\Henrik\Application Data\chrtmp
c:\documents and settings\Henrik\Application Data\inst.exe
c:\windows\system32\AbaleZip.dll
c:\windows\system32\drivers\bxgjwwff.sys
c:\windows\system32\w32apiw.dll

Inficeret kopi af c:\windows\system32\drivers\atapi.sys blev fundet og desinficeret
Genskabt kopi fra - Kitty had a snack :p
.
(((((((((((((((((((((((((((((  Filer skabt fra 2010-04-13 til 2010-05-13  )))))))))))))))))))))))))))))))))))
.

2010-05-13 16:53 . 2010-05-13 16:53    --------    d-----r-    c:\documents and settings\Administrator\Dokumenter
2010-05-13 16:53 . 2010-05-13 16:53    --------    d-sh--w-    c:\documents and settings\Administrator\IETldCache
2010-05-13 16:01 . 2010-05-13 17:38    --------    d-----w-    C:\alg
2010-05-13 12:29 . 2010-05-13 12:42    --------    d-----w-    C:\Lop SD
2010-05-13 11:22 . 2010-05-13 11:22    --------    d-----w-    C:\VundoFix Backups
2010-05-13 11:15 . 2010-05-13 11:14    119808    ----a-w-    C:\VundoFix.exe
2010-05-12 05:10 . 2010-05-12 05:10    --------    d-sh--w-    c:\documents and settings\NetworkService\IETldCache
2010-05-12 05:09 . 2010-05-12 05:09    --------    d-sh--w-    c:\documents and settings\Henrik\PrivacIE
2010-05-12 05:05 . 2010-05-12 05:05    --------    d-sh--w-    c:\documents and settings\Henrik\IETldCache
2010-05-12 05:01 . 2010-05-12 05:02    --------    dc-h--w-    c:\windows\ie8
2010-05-11 19:44 . 2010-05-11 19:44    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Malwarebytes
2010-05-11 19:43 . 2010-04-29 13:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-11 19:43 . 2010-05-11 19:43    --------    d-----w-    c:\programmer\Malwarebytes' Anti-Malware
2010-05-11 19:43 . 2010-05-11 19:43    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-11 19:43 . 2010-04-29 13:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-05-11 19:33 . 2010-05-11 19:33    --------    d-----w-    c:\programmer\CCleaner
2010-05-11 18:34 . 2010-05-11 18:34    --------    d-s---w-    c:\documents and settings\NetworkService\UserData
2010-05-11 12:24 . 2010-05-11 12:24    --------    d-----w-    c:\documents and settings\LocalService\Skrivebord
2010-05-10 15:13 . 2010-05-10 15:13    52224    ----a-w-    c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-10 15:13 . 2010-05-10 15:13    117760    ----a-w-    c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-10 15:12 . 2010-05-10 15:12    --------    d-----w-    c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-05-10 15:12 . 2010-05-10 17:30    --------    d-----r-    c:\documents and settings\Administrator\Foretrukne
2010-05-10 14:21 . 2010-05-10 14:21    --------    d-----w-    c:\windows\system32\wbem\Repository
2010-04-20 16:00 . 2010-04-20 16:00    --------    d-----w-    c:\programmer\MIKSOFT
2010-04-20 15:52 . 2010-04-20 15:52    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Apple Computer
2010-04-20 15:39 . 2010-04-20 15:39    --------    d-----w-    c:\documents and settings\All Users\Application Data\BVRP Software
2010-04-20 15:35 . 2010-04-20 15:35    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\Sony
2010-04-20 15:28 . 2010-04-20 15:28    --------    d-----w-    c:\programmer\Fælles filer\Sony Shared
2010-04-20 15:27 . 2010-04-20 15:27    10134    ----a-r-    c:\documents and settings\Henrik\Application Data\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
2010-04-20 15:27 . 2010-04-20 15:27    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\Downloaded Installations
2010-04-20 15:27 . 2010-04-20 15:28    --------    d-----w-    c:\programmer\Sony
2010-04-20 15:27 . 2010-04-20 15:27    --------    d-----w-    c:\documents and settings\All Users\Application Data\Sony Corporation
2010-04-20 15:25 . 2010-05-10 12:54    --------    d-----w-    c:\programmer\QuickTime
2010-04-20 15:25 . 2010-04-20 15:25    --------    d-----w-    c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 15:25 . 2010-04-20 15:25    --------    d-----w-    c:\programmer\Fælles filer\Apple
2010-04-20 15:24 . 2010-04-20 15:24    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\Apple
2010-04-20 15:24 . 2010-04-20 15:24    --------    d-----w-    c:\programmer\Apple Software Update
2010-04-20 15:24 . 2010-04-20 15:24    --------    d-----w-    c:\documents and settings\All Users\Application Data\Apple
2010-04-20 15:24 . 2010-04-20 15:24    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\Apple Computer
2010-04-20 15:20 . 2010-04-20 15:24    33850672    ----a-w-    c:\documents and settings\Henrik\Application Data\Sony Setup\9234765D-29DF-48d0-93FB-284B7B6009B9\QuickTimeInstaller.exe
2010-04-20 15:17 . 2010-04-20 15:34    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Sony
2010-04-20 15:17 . 2010-04-20 15:20    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Sony Setup
2010-04-20 14:37 . 2010-04-21 15:28    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\Sony Ericsson
2010-04-20 14:36 . 2009-03-25 15:48    109864    ----a-w-    c:\windows\system32\drivers\s1018unic.sys
2010-04-20 14:36 . 2009-03-25 15:48    10792    ----a-w-    c:\windows\system32\drivers\s1018cr.sys
2010-04-20 14:36 . 2009-03-25 15:48    26024    ----a-w-    c:\windows\system32\drivers\s1018nd5.sys
2010-04-20 14:36 . 2009-03-25 15:48    106208    ----a-w-    c:\windows\system32\drivers\s1018mgmt.sys
2010-04-20 14:36 . 2009-03-25 15:48    104744    ----a-w-    c:\windows\system32\drivers\s1018obex.sys
2010-04-20 14:36 . 2009-03-25 15:48    15016    ----a-w-    c:\windows\system32\drivers\s1018mdfl.sys
2010-04-20 14:36 . 2009-03-25 15:48    12200    ----a-w-    c:\windows\system32\drivers\s1018cmnt.sys
2010-04-20 14:36 . 2009-03-25 15:48    12200    ----a-w-    c:\windows\system32\drivers\s1018cm.sys
2010-04-20 14:36 . 2009-03-25 15:48    114728    ----a-w-    c:\windows\system32\drivers\s1018mdm.sys
2010-04-20 14:36 . 2009-03-25 15:48    12200    ----a-w-    c:\windows\system32\drivers\s1018whnt.sys
2010-04-20 14:36 . 2009-03-25 15:48    12200    ----a-w-    c:\windows\system32\drivers\s1018wh.sys
2010-04-20 14:36 . 2009-03-25 15:48    86824    ----a-w-    c:\windows\system32\drivers\s1018bus.sys
2010-04-20 14:35 . 2010-04-21 15:28    --------    d--h--w-    c:\programmer\InstallShield Installation Information
2010-04-20 14:35 . 2010-04-21 15:28    --------    d-----w-    c:\programmer\Sony Ericsson
2010-04-20 14:35 . 2010-04-20 15:32    --------    d-----w-    c:\documents and settings\All Users\Application Data\Sony Ericsson
2010-04-19 14:54 . 2010-04-19 14:59    --------    d-----w-    c:\programmer\RamBooster
2010-04-19 14:54 . 1998-02-06 19:37    299520    ----a-w-    c:\windows\uninst.exe
2010-04-19 14:54 . 2010-04-19 14:54    --------    d-----w-    c:\documents and settings\Henrik\WINDOWS
2010-04-18 12:33 . 2010-04-12 15:29    411368    ----a-w-    c:\windows\system32\deployJava1.dll
2010-04-17 06:38 . 2010-04-17 06:38    --------    d-----w-    c:\programmer\Fælles filer\InstallShield
2010-04-14 17:32 . 2010-04-14 17:32    --------    d-----w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\PCHealth
2010-04-14 06:22 . 2010-04-14 06:22    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Hyperz

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 17:50 . 2010-05-11 07:47    117760    ----a-w-    c:\documents and settings\Henrik\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-11 13:20 . 2004-08-03 20:59    96512    ----a-w-    c:\windows\system32\drivers\atapi.sys
2010-05-11 12:28 . 2010-05-11 07:44    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Spyware Terminator
2010-05-11 12:23 . 2010-05-11 09:49    --------    dc-h--w-    c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-11 12:23 . 2010-03-24 16:55    --------    d-----w-    c:\programmer\SUPERAntiSpyware
2010-05-11 12:23 . 2010-03-24 16:55    --------    d-----w-    c:\documents and settings\Henrik\Application Data\SUPERAntiSpyware.com
2010-05-11 12:23 . 2010-05-11 12:23    --------    d-----w-    c:\documents and settings\All Users\Application Data\Spyware Terminator
2010-05-11 12:23 . 2010-05-11 07:44    --------    d-----w-    c:\programmer\Spyware Terminator
2010-05-11 12:23 . 2010-01-03 18:59    --------    d-----w-    c:\programmer\Fælles filer\Wise Installation Wizard
2010-05-11 12:22 . 2010-01-24 18:47    --------    d-----w-    c:\documents and settings\Henrik\Application Data\uTorrent
2010-05-11 12:02 . 2010-04-05 16:21    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Vso
2010-05-11 09:52 . 2010-05-11 11:11    15880    ----a-w-    c:\windows\system32\lsdelete.exe
2010-05-11 09:49 . 2010-05-11 09:49    --------    d-----w-    c:\programmer\Lavasoft
2010-05-11 09:49 . 2010-03-19 23:56    --------    d-----w-    c:\documents and settings\All Users\Application Data\Lavasoft
2010-05-11 07:47 . 2010-05-11 07:47    52224    ----a-w-    c:\documents and settings\Henrik\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-11 07:45 . 2010-05-11 07:45    5632    ----a-w-    c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2010-05-11 07:45 . 2010-05-11 07:45    5632    ----a-w-    c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2010-05-10 16:50 . 2010-03-21 18:04    --------    d-----w-    c:\documents and settings\Administrator\Application Data\Spyware Terminator
2010-05-03 10:31 . 2010-01-04 21:32    --------    d-----w-    c:\programmer\Fælles filer\Adobe
2010-05-02 21:56 . 2010-04-08 21:08    --------    d-----w-    c:\documents and settings\Henrik\Application Data\dvdcss
2010-04-22 09:13 . 2010-01-03 18:50    242896    ----a-w-    c:\windows\system32\drivers\avgtdix.sys
2010-04-20 16:12 . 2010-03-31 21:08    --------    d-----w-    c:\documents and settings\All Users\Application Data\xml_param
2010-04-19 13:21 . 2010-03-30 20:38    --------    d-----w-    c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-19 07:52 . 2010-04-04 08:51    175460    ----a-w-    c:\windows\hpoins27.dat
2010-04-18 12:33 . 2010-01-03 22:58    --------    d-----w-    c:\programmer\Java
2010-04-14 08:02 . 2010-04-13 15:17    --------    d-----w-    c:\documents and settings\Henrik\Application Data\YoWindow
2010-04-13 15:17 . 2010-04-13 15:16    --------    d-----w-    c:\programmer\YoWindow
2010-04-11 10:14 . 2010-04-11 10:14    24064    ----a-w-    c:\windows\autoload.exe
2010-04-11 05:01 . 2010-04-04 07:20    664    ----a-w-    c:\windows\system32\d3d9caps.dat
2010-04-10 08:22 . 2010-04-01 07:22    --------    d-----w-    c:\documents and settings\Henrik\Application Data\ImgBurn
2010-04-09 21:13 . 2010-04-09 21:13    --------    d-----w-    c:\programmer\TotalCommanderPortable
2010-04-09 09:11 . 2010-04-09 09:11    --------    d-----w-    c:\documents and settings\All Users\Application Data\vsosdk
2010-04-08 19:19 . 2010-04-08 19:18    --------    d-----w-    c:\documents and settings\Henrik\Application Data\vlc
2010-04-08 19:17 . 2010-04-08 19:17    --------    d-----w-    c:\programmer\VideoLAN
2010-04-07 07:03 . 2010-04-07 07:03    341504    ----a-w-    c:\windows\system32\yowindow.scr
2010-04-05 16:21 . 2010-04-05 16:21    47360    ----a-w-    c:\windows\system32\drivers\pcouffin.sys
2010-04-05 16:21 . 2010-04-05 16:21    47360    ----a-w-    c:\documents and settings\Henrik\Application Data\pcouffin.sys
2010-04-05 16:21 . 2010-04-05 16:21    47360    ----a-w-    c:\documents and settings\Henrik\Application Data\pcouffin.sys
2010-04-05 16:20 . 2010-04-05 16:20    --------    d-----w-    c:\programmer\VSO
2010-04-04 21:51 . 2010-01-03 23:09    68376    ----a-w-    c:\documents and settings\Henrik\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2010-04-04 09:05 . 2010-04-04 09:05    --------    d-----w-    c:\documents and settings\All Users\Application Data\HP Product Assistant
2010-04-04 09:05 . 2010-01-04 16:19    --------    d-----w-    c:\programmer\HP
2010-04-04 09:05 . 2010-04-04 09:05    --------    d-----w-    c:\programmer\Hewlett-Packard
2010-04-04 09:04 . 2010-04-04 09:04    --------    d-----w-    c:\programmer\Fælles filer\HP
2010-04-04 08:34 . 2010-03-06 07:49    --------    d-----w-    c:\documents and settings\All Users\Application Data\HP
2010-04-02 11:31 . 2010-04-01 16:37    --------    d-----w-    c:\documents and settings\All Users\Application Data\DVD Shrink
2010-04-01 16:37 . 2010-04-01 16:37    --------    d-----w-    c:\programmer\DVD Shrink
2010-04-01 07:20 . 2010-04-01 07:19    --------    d-----w-    c:\programmer\ImgBurn
2010-04-01 07:11 . 2010-02-23 11:10    --------    d-----w-    c:\programmer\Elaborate Bytes
2010-04-01 07:04 . 2010-04-01 06:55    --------    d-----w-    c:\programmer\SlySoft
2010-03-30 21:15 . 2010-03-04 17:14    --------    d-----w-    c:\programmer\MSBuild
2010-03-30 21:06 . 2010-03-30 21:06    503808    ----a-w-    c:\documents and settings\Henrik\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-43ba1001-n\msvcp71.dll
2010-03-30 21:06 . 2010-03-30 21:06    499712    ----a-w-    c:\documents and settings\Henrik\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-43ba1001-n\jmc.dll
2010-03-30 21:06 . 2010-03-30 21:06    348160    ----a-w-    c:\documents and settings\Henrik\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-43ba1001-n\msvcr71.dll
2010-03-30 21:06 . 2010-03-30 21:06    --------    d-----w-    c:\programmer\Fælles filer\Java
2010-03-30 21:06 . 2010-03-30 21:06    61440    ----a-w-    c:\documents and settings\Henrik\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-669e87f7-n\decora-sse.dll
2010-03-30 21:06 . 2010-03-30 21:06    12800    ----a-w-    c:\documents and settings\Henrik\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-669e87f7-n\decora-d3d.dll
2010-03-30 21:01 . 2001-10-09 12:00    78192    ----a-w-    c:\windows\system32\perfc006.dat
2010-03-30 21:01 . 2001-10-09 12:00    447834    ----a-w-    c:\windows\system32\perfh006.dat
2010-03-30 20:58 . 2010-03-25 07:53    --------    d-----w-    c:\programmer\Google
2010-03-30 20:46 . 2010-03-30 20:46    --------    d-----w-    c:\programmer\Microsoft.NET
2010-03-30 15:34 . 2010-03-30 12:46    --------    d-----w-    c:\programmer\Simple Port Forwarding
2010-03-30 12:02 . 2010-03-30 11:32    --------    d-----w-    c:\documents and settings\Henrik\Application Data\Scribus
2010-03-30 11:30 . 2010-03-30 11:30    --------    d-----w-    c:\programmer\gs
2010-03-28 09:30 . 2010-03-28 09:30    --------    d-----w-    c:\programmer\Daniusoft
2010-03-27 20:51 . 2010-03-27 20:51    --------    d-----w-    c:\programmer\FLVCodec
2010-03-27 20:51 . 2010-03-27 20:51    --------    d-----w-    c:\programmer\WinPcap
2010-03-27 20:34 . 2010-03-27 20:34    --------    d-----w-    c:\documents and settings\Henrik\Application Data\AccurateRip
2010-03-27 20:34 . 2010-03-27 20:34    --------    d-----w-    c:\programmer\Illustrate
2010-03-27 20:33 . 2010-03-27 20:34    5652144    ----a-w-    c:\windows\system32\SpoonUninstall.exe
2010-03-27 20:27 . 2010-03-27 20:27    --------    d-----w-    c:\documents and settings\Henrik\Application Data\FreeAudioPack
2010-03-27 20:23 . 2010-03-27 20:23    --------    d-----w-    c:\programmer\directx
2010-03-27 14:14 . 2010-03-27 14:14    --------    d-----w-    c:\programmer\Lavalys
2010-03-24 18:34 . 2010-03-24 18:34    --------    d-----w-    c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-24 18:33 . 2010-03-24 18:33    --------    d-----w-    c:\programmer\SystemRequirementsLab
2010-03-24 18:33 . 2010-03-24 18:33    --------    d-----w-    c:\documents and settings\Henrik\Application Data\SystemRequirementsLab
2010-03-24 18:32 . 2010-03-22 11:23    --------    d-----w-    c:\programmer\Microsoft Windows 7 Upgrade Advisor
2010-03-22 11:36 . 2010-03-22 11:36    84480    ----a-w-    c:\documents and settings\Henrik\Application Data\SystemRequirementsLab\srlproxy_intel_4.1.66.0A.dll
2010-03-21 16:11 . 2010-03-21 16:11    --------    d-----w-    c:\programmer\Enigma Software Group
2010-03-21 10:37 . 2010-03-21 10:32    78093    ----a-w-    c:\windows\hpqins05.dat
2010-03-20 12:05 . 2010-03-20 12:05    --------    d---a-w-    c:\documents and settings\All Users\Application Data\TEMP
2010-03-20 12:04 . 2010-03-20 09:36    --------    d-----w-    c:\programmer\Microsoft AntiSpyware
2010-03-20 11:38 . 2010-03-20 11:38    --------    d-----w-    c:\documents and settings\Henrik\Application Data\nCleaner
2010-03-20 11:37 . 2010-03-20 11:37    --------    d-----w-    c:\programmer\NKProds
2010-03-19 23:58 . 2010-03-19 23:58    95024    ----a-w-    c:\windows\system32\drivers\SBREDrv.sys
2010-03-19 12:21 . 2010-03-27 20:50    23096    ----a-w-    c:\windows\system32\drivers\DrmRAudio.sys
2010-03-17 15:42 . 2010-03-17 15:42    12464    ----a-w-    c:\windows\system32\avgrsstx.dll
2010-03-17 15:42 . 2010-01-03 18:50    29512    ----a-w-    c:\windows\system32\drivers\avgmfx86.sys
2010-03-17 14:58 . 2010-01-03 18:50    216200    ----a-w-    c:\windows\system32\drivers\avgldx86.sys
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\programmer\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-11-20 434176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hcenter"="c:\programmer\Support.com\bin\tgcmd.exe" [2005-04-08 1757184]
"SunJavaUpdateSched"="c:\programmer\Fælles filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Photo Downloader"="c:\programmer\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
"Adobe Reader Speed Launcher"="c:\programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"VirtualCloneDrive"="c:\programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"HP Software Update"="c:\programmer\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"QuickTime Task"="c:\programmer\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menuen Start\Programmer\Start\
HP Digital Imaging Monitor.lnk - c:\programmer\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 12:21    548352    ----a-w-    c:\programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-17 15:42    12464    ----a-w-    c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\AVG\\AVG9\\avgemc.exe"=
"c:\\Programmer\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programmer\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Programmer\\Support.com\\bin\\tgcmd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmer\\uTorrent\\uTorrent.exe"=
"c:\\Programmer\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Programmer\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"55194:TCP"= 55194:TCP:SPF Port 55194 TCP

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11-05-2010 11:53 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [03-01-2010 20:50 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [03-01-2010 20:50 242896]
R1 SASDIFSV;SASDIFSV;c:\programmer\SUPERAntiSpyware\sasdifsv.sys [17-02-2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\programmer\SUPERAntiSpyware\SASKUTIL.SYS [17-02-2010 10:15 66632]
R2 avg9emc;AVG Free E-mail Scanner;c:\programmer\AVG\AVG9\avgemc.exe [17-03-2010 16:58 916760]
R2 avg9wd;AVG Free WatchDog;c:\programmer\AVG\AVG9\avgwdsvc.exe [17-03-2010 17:42 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programmer\Lavasoft\Ad-Aware\AAWService.exe [04-02-2010 17:52 1291544]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [01-06-2008 09:13 34064]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\programmer\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [20-04-2010 17:32 90112]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [27-03-2010 22:57 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [27-03-2010 22:58 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [27-03-2010 22:58 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [27-03-2010 22:58 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [27-03-2010 22:59 25704]
S0 yhvdwzqp;yhvdwzqp;c:\windows\system32\drivers\yhvdwzqp.sys --> c:\windows\system32\drivers\yhvdwzqp.sys [?]
S2 oaiofgqw;Sony Ericsson Device 1018 USB WMC Modem Helper;c:\windows\System32\svchost.exe -k netsvcs [26-08-2004 17:53 14336]
S3 cpudrv;cpudrv;c:\programmer\SystemRequirementsLab\cpudrv.sys [18-12-2009 11:58 11336]
S3 DrmRAudio;DrmRAudio;c:\windows\system32\drivers\DrmRAudio.sys [27-03-2010 22:50 23096]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [20-04-2010 16:36 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [20-04-2010 16:36 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [20-04-2010 16:36 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [20-04-2010 16:36 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [20-04-2010 16:36 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [20-04-2010 16:36 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [20-04-2010 16:36 109864]
S3 SASENUM;SASENUM;c:\programmer\SUPERAntiSpyware\SASENUM.SYS [17-02-2010 10:15 12872]
S3 SndTAudio;SndTAudio;c:\windows\system32\drivers\SndTAudio.sys [28-03-2010 00:53 23096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12    REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt    REG_MULTI_SZ      hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
oaiofgqw
.
Indhold af mappen 'Planlagte Opgaver'

2010-05-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programmer\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:52]

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-01-03 21:18]
.
.
------- Yderligere scanning -------
.
IE: &Download All using 4shared Desktop - c:\programmer\4shared Desktop\down_all.htm
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Henrik\Application Data\Mozilla\Firefox\Profiles\nto7b4bn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.dk/ig?hl=da&source=iglk
FF - plugin: c:\programmer\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\programmer\Sony\Media Go\npmediago.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLITIKKER ----
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".dk");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - TOMME GENVEJE FJERNET - - - -

ShellIconOverlayIdentifiers-{65589DBE-901A-41FD-B793-D0FB95D33F7F} - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-13 19:48
Windows 5.1.2600 Service Pack 3 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'winlogon.exe'(584)
c:\programmer\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(956)
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programmer\AVG\AVG9\avgchsvx.exe
c:\programmer\AVG\AVG9\avgrsx.exe
c:\programmer\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\AVG\AVG9\avgnsx.exe
c:\programmer\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\programmer\HP\Digital Imaging\bin\hpqSTE08.exe
c:\programmer\HP\Digital Imaging\bin\hpqbam08.exe
.
**************************************************************************
.
Gennemført tid: 2010-05-13  19:50:34 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2010-05-13 17:50

Pre-Kørsel: 30.922.080.256 byte ledig
Post-Kørsel: 30.946.770.944 byte ledig

- - End Of File - - F2DD50BDC8DD3F2C9DDA999284F3A3C6

Jeg er lidt blank her, så jeg vil anbefale dig at oprette en tråd på endten spywarefri.dk/forum eller malwarecheck.dk/forum så vil en uddanet supporter kigge op logsne og ikke sådan en selvuddanet en som mig. Grunden til at jeg henviser dig til en anden side er at jeg er lidt i tivl om at du har en rootkit infektion. Håber at det er iorden, du er selvfølgelig også velkommen til at vente og se om at der kommer svar her.

p.s. husk at linke til tråden her.

Okay... tak for hjælpen.

Jeg synes at combofix skrev at den ville genstarte pga rootkit...!?

Velbekomme



Der er også tegn på rootkit i loggen og dem kan jeg ikke rense, jeg vil anbefale dig at oprette tråden på www.spywarefri.dk/forum og linke til denne tråd.

Snup bare selv pointene igen

Det er hermed gjort. Og jeg takker igen, og selvfølgelig skal du da have point for hjælpen :-)

Tak Tak :-)

Hvorfor kan jeg ikke give dig point?

Så lidt

Dette indlæg er sendt som et svar, du sætter et flueben ved mig og nederst på siden trykker på uddel point :)