Analysering af HiJack This log

Hent og gem ComboFix på dit skrivebord.

Højreklik på skrivebordet og vælg ny->tekstdokument og kopier det fremhævede ind og gem filen som CFScript

Killall::
Snapshot::

Da Combofix kan konflikte med dine sikkerhedsprogrammer er det vigtigt at du deaktiverer dem.

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif

Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\Combofix.txt

Indholdet af denne fil må du gerne lægge herind.

ComboFix 11-01-31.02 - Jutta 01-02-2011  10:16:37.1.3 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.45.1030.18.3070.2186 [GMT 1:00]
Kører fra: c:\users\Jutta\Desktop\ComboFix.exe
Kommandoer benyttet :: c:\users\Jutta\Desktop\CFscript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Jutta\AppData\Roaming\Microsoft\Windows\Recent\Fyens Stiftstidende.url
c:\users\Jutta\AppData\Roaming\Microsoft\Windows\Recent\Højskolesangbogen - Folkehøjskolernes Forening i Danmark (FFD).url

.
(((((((((((((((((((((((((((((  Filer skabt fra 2011-01-01 til 2011-02-01  )))))))))))))))))))))))))))))))))))
.

2011-02-01 09:20 . 2011-02-01 09:22    --------    d-----w-    c:\users\Jutta\AppData\Local\temp
2011-02-01 08:57 . 2011-02-01 08:57    28752    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{92D009C6-D8D4-4816-8809-B2679D551A82}\MpKsl72a71329.sys
2011-01-31 13:15 . 2011-01-20 09:39    5890896    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{92D009C6-D8D4-4816-8809-B2679D551A82}\mpengine.dll
2011-01-22 13:28 . 2011-01-22 13:28    --------    d-----w-    c:\program files\Common Files\Adobe
2011-01-22 12:14 . 2011-01-20 09:39    5890896    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-01-22 08:29 . 2011-01-31 19:28    --------    d-----w-    c:\users\Jutta\Antivirus-spamfighter
2011-01-21 22:00 . 2010-11-30 09:43    439632    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E4034E3A-9363-4963-853B-839B6A3B618A}\gapaengine.dll
2011-01-21 21:51 . 2011-01-21 21:52    --------    d-----w-    c:\program files\Microsoft Security Client
2011-01-21 21:50 . 2010-04-05 20:00    221568    ----a-w-    c:\windows\system32\drivers\netio.sys
2011-01-21 21:45 . 2011-01-21 21:45    --------    d-----w-    c:\programdata\McAfee
2011-01-21 21:31 . 2011-01-21 21:31    --------    d-----w-    c:\windows\da
2011-01-21 21:28 . 2010-09-22 23:21    39272    ----a-w-    c:\windows\system32\drivers\fssfltr.sys
2011-01-21 21:25 . 2011-01-21 21:25    --------    d-----w-    c:\program files\Microsoft SQL Server Compact Edition
2011-01-21 21:19 . 2011-01-21 21:32    --------    d-----w-    c:\program files\Windows Live
2011-01-21 19:06 . 2011-01-13 09:41    5890896    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{9DA2C7BE-519A-4373-AFE9-64C58B8F8EFB}\mpengine.dll
2011-01-21 19:04 . 2011-01-21 19:04    469256    ----a-w-    c:\program files\Common Files\Windows Live\.cache\16b15f651cbb99e04\InstallManager_WLE_WLE.exe
2011-01-21 19:04 . 2011-01-21 19:04    15712    ----a-w-    c:\program files\Common Files\Windows Live\.cache\d30a2251cbb99e03\MeshBetaRemover.exe
2011-01-21 19:04 . 2009-09-04 16:44    69464    ----a-w-    c:\windows\system32\XAPOFX1_3.dll
2011-01-21 19:04 . 2009-09-04 16:44    515416    ----a-w-    c:\windows\system32\XAudio2_5.dll
2011-01-21 19:04 . 2009-09-04 16:29    453456    ----a-w-    c:\windows\system32\d3dx10_42.dll
2011-01-21 19:04 . 2011-01-21 19:04    94040    ----a-w-    c:\program files\Common Files\Windows Live\.cache\d05c051cbb99e02\DSETUP.dll
2011-01-21 19:04 . 2011-01-21 19:04    525656    ----a-w-    c:\program files\Common Files\Windows Live\.cache\d05c051cbb99e02\DXSETUP.exe
2011-01-21 19:04 . 2011-01-21 19:04    1691480    ----a-w-    c:\program files\Common Files\Windows Live\.cache\d05c051cbb99e02\dsetup32.dll
2011-01-21 19:04 . 2006-11-29 12:06    3426072    ----a-w-    c:\windows\system32\d3dx9_32.dll
2011-01-21 19:04 . 2011-01-21 19:04    94040    ----a-w-    c:\program files\Common Files\Windows Live\.cache\fc52a3e51cbb99d01\DSETUP.dll
2011-01-21 19:04 . 2011-01-21 19:04    525656    ----a-w-    c:\program files\Common Files\Windows Live\.cache\fc52a3e51cbb99d01\DXSETUP.exe
2011-01-21 19:04 . 2011-01-21 19:04    1691480    ----a-w-    c:\program files\Common Files\Windows Live\.cache\fc52a3e51cbb99d01\dsetup32.dll
2011-01-21 17:06 . 2011-01-21 17:06    --------    d-----w-    c:\users\Jutta\AppData\Roaming\Malwarebytes
2011-01-21 17:06 . 2011-01-21 17:06    --------    d-----w-    c:\programdata\Malwarebytes
2011-01-21 17:06 . 2010-12-20 17:09    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-21 17:06 . 2011-01-21 17:16    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2011-01-21 17:06 . 2010-12-20 17:08    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys
2011-01-21 17:00 . 2011-01-27 14:42    --------    d-----w-    c:\program files\CCleaner
2011-01-12 10:52 . 2010-12-28 15:55    413696    ----a-w-    c:\windows\system32\odbc32.dll
2011-01-12 10:52 . 2010-12-28 15:53    708608    ----a-w-    c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 10:52 . 2010-12-28 15:53    253952    ----a-w-    c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 10:52 . 2010-12-28 15:53    241664    ----a-w-    c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 10:52 . 2010-12-28 15:53    57344    ----a-w-    c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-12 10:52 . 2010-12-28 15:53    180224    ----a-w-    c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 10:52 . 2010-12-14 14:49    1169408    ----a-w-    c:\windows\system32\sdclt.exe

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 03:35 . 2010-12-02 03:35    4280320    ----a-w-    c:\windows\system32\GPhotos.scr
2010-11-16 13:17 . 2010-11-16 13:16    11843016    ----a-w-    c:\users\Jutta\windows-kb890830-v3.13.exe
2010-11-12 17:53 . 2010-04-16 07:50    472808    ----a-w-    c:\windows\system32\deployJava1.dll
2010-11-10 01:54 . 2010-11-10 01:54    49016    ----a-w-    c:\windows\system32\sirenacm.dll
2010-11-10 01:28 . 2010-11-10 01:28    301936    ----a-w-    c:\windows\WLXPGSS.SCR
2010-11-04 18:56 . 2010-12-15 11:06    345600    ----a-w-    c:\windows\system32\wmicmiplugin.dll
2010-11-04 18:55 . 2010-12-15 11:06    352768    ----a-w-    c:\windows\system32\taskschd.dll
2010-11-04 18:55 . 2010-12-15 11:06    270336    ----a-w-    c:\windows\system32\taskcomp.dll
2010-11-04 18:55 . 2010-12-15 11:06    601600    ----a-w-    c:\windows\system32\schedsvc.dll
2010-11-04 16:34 . 2010-12-15 11:06    171520    ----a-w-    c:\windows\system32\taskeng.exe
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-08-28 20480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-05 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2008-06-10 54672]
"SetPoint"="c:\program files\Logitech\SetPoint\KEM.EXE" [2004-07-15 581632]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8473120]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-28 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\KEM.exe [2008-8-28 581632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-11-15 20:02    35736    ----a-w-    c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 MpKsl8bc75f8c;MpKsl8bc75f8c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F9D160B5-58F7-40C4-900C-AACAFEE6E2B6}\MpKsl8bc75f8c.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Tjenesten Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-05 135664]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 MpKsl72a71329;MpKsl72a71329;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{92D009C6-D8D4-4816-8809-B2679D551A82}\MpKsl72a71329.sys [2011-02-01 28752]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ      FontCache
.
Indhold af mappen 'Planlagte Opgaver'

2011-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-05 08:35]

2011-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-05 08:35]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = localhost;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki ... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
Trusted Zone: banktrelleborg.dk
Trusted Zone: bec.dk
Trusted Zone: bec.dk\webbankhelp.prod
Trusted Zone: danid.dk
Trusted Zone: eikbank.dk
Trusted Zone: portalbank.dk\www
Trusted Zone: skandiabanken.dk\www
Trusted Zone: danid.dk
.
- - - - TOMME GENVEJE FJERNET - - - -

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-Run-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe
AddRemove-HijackThis - K:\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-01 10:23
Windows 6.0.6002 Service Pack 2 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'Explorer.exe'(1324)
c:\users\Jutta\AppData\Local\Temp\IadHide4.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\program files\Logitech\SetPoint\KHALMNPR.EXE
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Gennemført tid: 2011-02-01  10:26:10 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2011-02-01 09:26

Pre-Kørsel: 379.164.209.152 byte ledig
Post-Kørsel: 378.989.248.512 byte ledig

- - End Of File - - 1D22765320A3A9B7BCB15CA9F918C06C

Start hijackthis, klik på "do  a system scan only" og sæt flueben ved følgende.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>

Luk så alle andre vinduer og klik "fix checked"

------


Hvad får dig til at tro det, for der er ikke andet ?

Fordi Microsoft Security Essentialts var blevet slået fra efter at have opdaget en trojaner 2 dage i træk. Men fint hvis det er væk nu. Kører lige den HiJaskThis igen så må vi se hvordan det ser ud.

Her er så den nye HiJackThis logfile - er der mere?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:32:48, on 01-02-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Windows\RtHDVCpl.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\KbdStub.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jutta\Antivirus-spamfighter\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=81&bd=Pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" -delete
O4 - HKLM\..\Run: [SetPoint] C:\Program Files\Logitech\SetPoint\KEM.EXE
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki ... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://*.danid.dk
O15 - Trusted Zone: http://*.danid.dk (HKLM)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Tjenesten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 6613 bytes

Jeg vil hellere ha' du opdaterer og kører malwarebytes igen. Kopier liggen herind.

Nu har jeg kørt malware og loggen er her:

  Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5654

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

01-02-2011 18:16:54
mbam-log-2011-02-01 (18-16-54).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 254997
Tid gået: 30 minut(ter), 46 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
(Ingen skadelige objekter blev fundet)

Fint  :)

Deaktiver dit antivirus-program, kør en online scanning med ESET Online Scanner:
http://www.eset.com/onlinescan/

Du skal acceptere betingelserne for brug, og klik på Start.
Efter ActiveX Control er indlæst, vil det tage et par minutter for scanneren at blive klar.
Dernæst skal du sætte flueben i følgende felter: (kun dem)

Scan archives

under advanced settings
Scan for potentialy unwanted applications
Scan for potentially unsafe applications
Enable anti-stealth technology

Klik på Start. Denne scanning kan tage et stykke tid, så vær tålmodig.
En log vil åbne, når scanningen er færdig.

(hvis ikke, skal du gå til C:\Programmer\EsetOnlineScanner\ og åbne filen Log.txt).

Kopier den herind i næste svar.

Er det nødvendigt at bruge endnu flere scanningsprogrammer? Nu har jeg Microsofts antivirus, HiJackThis, Malware og CCleaner, samt den af dig foreslåede Combofix - er det ikke muligt at nøjes med dem?

CCleaner er ikke et Skanner program.
ComboFix er et analyse program.
HijackThis er ikke ret meget værd.

Malwarebytes er et skanner program
Microsoft Security Essentials er et Antivirus/Antispyware program.

ESET Online Scanner skal bruges til at sikre at der ikke gemmer sig noget.

Så spørgsmålet er. Vil du ha' ryddet op på den PC ?

Jotak - den er ryddet op nu med hvad jeg allerede har på PC'en så jeg tror vi lader det være ved det.
Tak for hjælpen.

Ok

------

Tast  <Windows> + <R> samtidig og kopier dette ind: combofix /uninstall
Tryk enter
Det vil fjerne Combofix og nulstille urets indstillinger.
Nulstille systemgendannelsen.
Skjule filtypenavne hvis det kræves.
Skjule System/skjulte filer hvis det kræves.

Tak for hjælpen