Hej.
Først, efter den har genstartet og jeg gik på nettet for at komme herind kom vinduet, IE7 er ikke standdart browser skal den være det, og det sagde jeg ja til.
Her er så combofix loggen :
ComboFix 07-08-14.4 - “Ejer” 2007-08-20 18:42:47.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1030.18.619 [GMT 2:00]
Command switches used :: C:\Documents and Settings\Ejer\Skrivebord\Virus Ikoner\CFScript.txt
* Created a new restore point
FILE::
C:\WINDOWS\vidcap32.Exe
ADS removed - C:\WINDOWS\system32:lpr.exe: Den angivne fil blev ikke fundet.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\vidcap32.Exe
((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 )))))))))))))))))))))))))))))))
2007-08-20 18:41 51,200—a———C:\WINDOWS\nircmd.exe
2007-08-19 13:03 <DIR> d————C:\WINDOWS\speech
2007-08-19 13:03 <DIR> d————C:\Programmer\uTorrent
2007-08-19 13:03 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\XemiComputers
2007-08-19 13:02 <DIR> dr———- C:\DOCUME~1\ADMINI~1.HJE\Menuen Start
2007-08-19 13:02 <DIR> d—h——- C:\DOCUME~1\ADMINI~1.HJE\Printere
2007-08-19 13:02 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\MxBoost
2007-08-19 13:02 <DIR> d————C:\DOCUME~1\ADMINI~1.HJE\Skrivebord
2007-08-19 10:27 <DIR> d————C:\DOCUME~1\Ejer\.housecall6.6
2007-08-18 23:56 15,642,624—a———C:\DOCUME~1\Ejer\ntuser.dat
2007-08-18 08:57 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\XemiComputers
2007-08-18 07:14 444,776—a———C:\WINDOWS\system32\d3dx10_35.dll
2007-08-18 07:14 443,752—a———C:\WINDOWS\system32\d3dx10_34.dll
2007-08-18 07:14 443,752—a———C:\WINDOWS\system32\d3dx10_33.dll
2007-08-18 07:14 3,727,720—a———C:\WINDOWS\system32\d3dx9_35.dll
2007-08-18 07:14 3,497,832—a———C:\WINDOWS\system32\d3dx9_34.dll
2007-08-18 07:14 267,112—a———C:\WINDOWS\system32\xactengine2_9.dll
2007-08-18 07:14 266,088—a———C:\WINDOWS\system32\xactengine2_8.dll
2007-08-18 07:14 261,480—a———C:\WINDOWS\system32\xactengine2_7.dll
2007-08-18 07:14 18,280—a———C:\WINDOWS\system32\x3daudio1_2.dll
2007-08-18 07:14 1,358,192—a———C:\WINDOWS\system32\D3DCompiler_35.dll
2007-08-18 07:14 1,124,720—a———C:\WINDOWS\system32\D3DCompiler_34.dll
2007-08-18 07:14 1,123,696—a———C:\WINDOWS\system32\D3DCompiler_33.dll
2007-08-18 07:13 3,495,784—a———C:\WINDOWS\system32\d3dx9_33.dll
2007-08-16 18:12 786,432—ah——- C:\DOCUME~1\ADMINI~1.HJE\ntuser.dat
2007-08-16 18:12 <DIR> d—h——- C:\DOCUME~1\ADMINI~1.HJE\Skabeloner
2007-08-16 18:12 <DIR> d—h——- C:\DOCUME~1\ADMINI~1.HJE\Lokale indstillinger
2007-08-15 20:21 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2007-08-15 16:32 15,840—a———C:\WINDOWS\system32\Machnm1.exe
2007-08-13 23:11 90,568—a———C:\WINDOWS\system32\drivers\usbVM31b.sys
2007-08-13 23:11 61,440—a———C:\WINDOWS\system32\VM31bSTI.dll
2007-08-13 23:11 53,248—a———C:\WINDOWS\StillCap.exe
2007-08-13 23:11 49,152—a———C:\WINDOWS\amcap.exe
2007-08-13 23:11 40,960—a———C:\WINDOWS\VM_STI.EXE
2007-08-13 23:11 24,576—a———C:\WINDOWS\RunSetup.dll
2007-08-13 23:11 147,456—a———C:\WINDOWS\VMCap.exe
2007-08-13 22:18 1,261,568————- C:\WINDOWS\NuNinst.exe
2007-08-13 22:17 86,752————- C:\WINDOWS\system32\drivers\incdfs.sys
2007-08-13 22:17 5,264————- C:\WINDOWS\system32\drivers\incdrec.sys
2007-08-13 22:17 28,432————- C:\WINDOWS\system32\drivers\incdpass.sys
2007-08-13 22:17 <DIR> d————C:\WINDOWS\InCD
2007-08-13 06:30 127,034 -r———- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2007-08-12 20:36 <DIR> d————C:\Programmer\Realtek AC97
2007-08-12 20:33 <DIR> d————C:\WINDOWS\EffectResources
2007-08-12 19:16 38,912—a———C:\WINDOWS\system32\drivers\AmdK8.sys
2007-08-12 16:00 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\ExtraFilm
2007-08-12 14:33 <DIR> d————C:\Programmer\Canon
2007-08-12 10:59 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
2007-08-08 23:17 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\VSRevoGroup
2007-08-08 18:32 <DIR> d————C:\APPS
2007-08-03 08:56 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\Logitech
2007-08-03 08:56 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\LogiShrd
2007-08-03 08:55 <DIR> d————C:\Programmer\F‘lles filer\LogiShrd
2007-08-03 08:54 56,080—a———C:\WINDOWS\KHALMNPR.Exe
2007-08-03 08:54 36,112—a———C:\WINDOWS\system32\drivers\LMouFilt.Sys
2007-08-03 08:54 34,832—a———C:\WINDOWS\system32\drivers\LHidFilt.Sys
2007-08-03 08:54 1,419,024—a———C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-08-03 08:54 <DIR> d————C:\Programmer\F‘lles filer\Logitech
2007-08-03 08:54 <DIR> d————C:\DOCUME~1\Ejer\APPLIC~1\InstallShield
2007-08-03 08:54 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Logitech
2007-08-02 11:00 118,784 -r———- C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe
2007-08-01 16:17 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Drivers Headquarters
2007-07-29 13:06 <DIR> d————C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PhotoCare
2007-07-27 01:06 524,288—a———C:\WINDOWS\system32\DivXsm.exe
2007-07-27 01:06 144,704—a———C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-07-27 01:03 823,296—a———C:\WINDOWS\system32\divx_xx0c.dll
2007-07-27 01:03 823,296—a———C:\WINDOWS\system32\divx_xx07.dll
2007-07-27 01:03 802,816—a———C:\WINDOWS\system32\divx_xx11.dll
2007-07-27 01:03 740,442—a———C:\WINDOWS\system32\DivX.dll
2007-07-27 01:03 53,248—a———C:\WINDOWS\system32\dpuGUI10.dll
2007-07-27 01:03 344,064—a———C:\WINDOWS\system32\dpus11.dll
2007-07-27 01:03 294,912—a———C:\WINDOWS\system32\dpu10.dll
2007-07-27 01:03 12,288—a———C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-21 00:46 <DIR> d————C:\Programmer\Google
2007-07-20 21:01 356,352—a———C:\WINDOWS\system32\NVUNINST.EXE
2007-07-20 20:54 9,728—a———C:\WINDOWS\system32\ALi55prp.dll
2007-07-20 20:54 63,488—a———C:\WINDOWS\system32\drivers\ALi55WDM.sys
2007-07-20 20:53 28,672—a———C:\WINDOWS\system32\drivers\ULILAN51.SYS
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-19 22:54————- d————C:\DOCUME~1\Ejer\APPLIC~1\uTorrent
2007-08-19 13:05————- d—h——- C:\Programmer\InstallShield Installation Information
2007-08-19 11:56————- d————C:\DOCUME~1\Ejer\APPLIC~1\OpenOffice.org2
2007-08-19 09:36————- d————C:\Programmer\SUPERAntiSpyware
2007-08-18 22:13 1530—a———C:\WINDOWS\system32\tmp.reg
2007-08-18 21:35————- d————C:\Programmer\Blubster
2007-08-18 14:16————- d————C:\DOCUME~1\Ejer\APPLIC~1\Vso
2007-08-15 20:09————- d————C:\DOCUME~1\Ejer\APPLIC~1\Skype
2007-08-13 20:39————- d————C:\Programmer\ExPLabs.com
2007-08-12 20:33————- d————C:\Programmer\Vimicro
2007-08-12 18:26————- d————C:\Programmer\AMD
2007-08-09 19:06————- d————C:\Programmer\IE7pro
2007-08-09 19:04————- d————C:\Programmer\NCH Swift Sound
2007-08-09 19:04————- d————C:\DOCUME~1\Ejer\APPLIC~1\NCH Swift Sound
2007-08-09 18:55————- d————C:\Programmer\Microsoft Picture It! 7
2007-08-03 10:18————- d————C:\Programmer\MSN Messenger
2007-08-03 08:55 0—ah——- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-08-03 08:55 0—ah——- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2007-08-03 08:55 0—ah——- C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2007-07-27 01:06 43528————- C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-07-27 01:06 3596288—a———C:\WINDOWS\system32\qt-dx331.dll
2007-07-27 01:06 200704—a———C:\WINDOWS\system32\ssldivx.dll
2007-07-27 01:06 129784————- C:\WINDOWS\system32\pxafs.dll
2007-07-27 01:06 120056————- C:\WINDOWS\system32\pxcpyi64.exe
2007-07-27 01:06 118520————- C:\WINDOWS\system32\pxinsi64.exe
2007-07-27 01:06 1044480—a———C:\WINDOWS\system32\libdivx.dll
2007-07-27 01:03 81920—a———C:\WINDOWS\system32\dpl100.dll
2007-07-27 01:03 593920—a———C:\WINDOWS\system32\dpuGUI11.dll
2007-07-27 01:03 57344—a———C:\WINDOWS\system32\dpv11.dll
2007-07-27 01:03 294912—a———C:\WINDOWS\system32\dpu11.dll
2007-07-27 01:03 196608—a———C:\WINDOWS\system32\dtu100.dll
2007-07-23 19:41 190—a———C:\CONFIG.SYS
2007-07-23 19:41 132—a———C:\AUTOEXEC.BAT
2007-07-21 07:21 21808—a———C:\WINDOWS\system32\drivers\Aldebaran.sys
2007-07-21 07:21 16855—a———C:\WINDOWS\system32\drivers\Achernar.sys
2007-07-20 21:26————- d————C:\DOCUME~1\Ejer\APPLIC~1\CallingID
2007-07-20 21:15 108144—a———C:\WINDOWS\system32\CmdLineExt.dll
2007-07-19 08:58 3583488—a—c—- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-15 20:48————- d————C:\DOCUME~1\Ejer\APPLIC~1\SMSSender
2007-07-14 09:24————- d————C:\Programmer\MSECache
2007-07-13 22:12————- d————C:\Programmer\Skype
2007-07-13 17:23————- d————C:\DOCUME~1\Ejer\APPLIC~1\SummaSummarum
2007-07-13 01:31 765952—a—c—- C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-12 20:04————- d————C:\Programmer\Microsoft SMS Sender
2007-07-12 20:02————- d————C:\DOCUME~1\Ejer\APPLIC~1\Windows Desktop Search
2007-07-12 20:01————- d————C:\Programmer\Windows Desktop Search
2007-07-09 18:46 557128—a———C:\WINDOWS\system32\dao360.dll
2007-07-08 17:53————- d————C:\Programmer\MSBuild
2007-07-08 17:48————- d————C:\Programmer\Microsoft Visual Studio 8
2007-07-08 17:38————- d————C:\Programmer\Alcohol Soft
2007-07-08 17:36————- d————C:\Programmer\Microsoft Works
2007-07-06 19:42————- d————C:\DOCUME~1\Ejer\APPLIC~1\Talkback
2007-07-06 19:41————- d————C:\DOCUME~1\Ejer\APPLIC~1\Thunderbird
2007-07-06 19:07————- d————C:\DOCUME~1\Ejer\APPLIC~1\Webcam Saver
2007-06-30 16:55 21840—a———C:\WINDOWS\system32\SIntfNT.dll
2007-06-30 16:55 17212—a———C:\WINDOWS\system32\SIntf32.dll
2007-06-30 16:55 12067—a———C:\WINDOWS\system32\SIntf16.dll
2007-06-29 01:54 356352—a———C:\WINDOWS\system32\nvudisp.exe
2007-06-29 00:43 8466432—a———C:\WINDOWS\system32\nvcpl.dll
2007-06-29 00:43 81920—a———C:\WINDOWS\system32\nvwddi.dll
2007-06-29 00:43 81920—a———C:\WINDOWS\system32\nvmctray.dll
2007-06-29 00:43 753664—a———C:\WINDOWS\system32\nvcplui.exe
2007-06-29 00:43 6807328—a———C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-06-29 00:43 6729728—a———C:\WINDOWS\system32\nvoglnt.dll
2007-06-29 00:43 6234112—a———C:\WINDOWS\system32\nvdisps.dll
2007-06-29 00:43 5690624—a———C:\WINDOWS\system32\nv4_disp.dll
2007-06-29 00:43 5455872—a———C:\WINDOWS\system32\nvdispsr.dll
2007-06-29 00:43 466944—a———C:\WINDOWS\system32\nvshell.dll
2007-06-29 00:43 458752—a———C:\WINDOWS\system32\nvmccssr.dll
2007-06-29 00:43 45056—a———C:\WINDOWS\system32\nvmccsrs.dll
2007-06-29 00:43 442368—a———C:\WINDOWS\system32\nvappbar.exe
2007-06-29 00:43 425984—a———C:\WINDOWS\system32\keystone.exe
2007-06-29 00:43 37376—a———C:\WINDOWS\system32\nvcodins.dll
2007-06-29 00:43 37376—a———C:\WINDOWS\system32\nvcod.dll
2007-06-29 00:43 360448—a———C:\WINDOWS\system32\nvapi.dll
2007-06-29 00:43 3600384—a———C:\WINDOWS\system32\nvvitvsr.dll
2007-06-29 00:43 3518464—a———C:\WINDOWS\system32\nvvitvs.dll
2007-06-29 00:43 3321856—a———C:\WINDOWS\system32\nvgames.dll
2007-06-29 00:43 3072000—a———C:\WINDOWS\system32\nvgamesr.dll
2007-06-29 00:43 307200—a———C:\WINDOWS\system32\nvexpbar.dll
2007-06-29 00:43 286720—a———C:\WINDOWS\system32\nvnt4cpl.dll
2007-06-29 00:43 2854912—a———C:\WINDOWS\system32\nvmoblsr.dll
2007-06-29 00:43 2416640—a———C:\WINDOWS\system32\nvwssr.dll
2007-06-29 00:43 2330624—a———C:\WINDOWS\system32\nvwss.dll
2007-06-29 00:43 229376—a———C:\WINDOWS\system32\nvmccs.dll
2007-06-29 00:43 188416—a———C:\WINDOWS\system32\nvmccss.dll
2007-06-29 00:43 1703936—a———C:\WINDOWS\system32\nvwdmcpl.dll
2007-06-29 00:43 1626112—a———C:\WINDOWS\system32\nwiz.exe
2007-06-29 00:43 155716—a———C:\WINDOWS\system32\nvsvc32.exe
2007-06-29 00:43 1474560—a———C:\WINDOWS\system32\nview.dll
2007-06-29 00:43 147456—a———C:\WINDOWS\system32\nvcolor.exe
2007-06-29 00:43 1339392—a———C:\WINDOWS\system32\nvdspsch.exe
2007-06-29 00:43 1142784—a———C:\WINDOWS\system32\nvmobls.dll
2007-06-29 00:43 1073152—a———C:\WINDOWS\system32\nvcpluir.dll
2007-06-29 00:43 1019904—a———C:\WINDOWS\system32\nvwimg.dll
2007-06-29 00:43 1018772—a———C:\WINDOWS\system32\nvucode.bin
2007-06-27 16:05 823808—a—c—- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 16:05 671232—a—c—- C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 16:05 6058496——-c—- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 16:05 52224——-c—- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avgnt”=“C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe” [2007-04-02 10:35]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-06-29 00:43]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-26 18:53]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
“IETI”=C:\Programmer\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
C:\Documents and Settings\Ejer\Menuen Start\Programmer\Start\
SpywareGuard.lnk - F:\Programmer\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 name]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
“NoSharedDocuments”=00000000
“MaxRecentDocs”=11 (0xb)
“GreyMSIAds”=1 (0x1)
“NoTrayItemsDisplay”=00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
“{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2007-01-19 17:45 77824]
“{56F9679E-7826-4C84-81F3-532071A8BCC5}”= C:\Programmer\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL 2007-06-03 10:36 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
“Notification Packages”= :\WINDOWS\syste
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=”“
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
“LDM”=F:\Programmer\logitec\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
“SunJavaUpdateSched”=“C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe”
“NvCplDaemon”=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
“Logitech Hardware Abstraction Layer”=KHALMNPR.EXE
“Kernel and Hardware Abstraction Layer”=KHALMNPR.EXE
R0 Achernar;Achernar - Storage Filter Drivers;C:\WINDOWS\system32\Drivers\Achernar.sys
R0 aliidex;aliidex;C:\WINDOWS\system32\drivers\aliidex.sys
R0 aliperf;aliperf;C:\WINDOWS\system32\drivers\aliperf.sys
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys
R1 avgio;avgio;\??\C:\Programmer\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\C:\WINDOWS\system32\Drivers\Aldebaran.sys
R3 avgntflt;avgntflt;\??\C:\Programmer\AntiVir PersonalEdition Classic\avgntflt.sys
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS
R3 ZSMC302;VIMICRO USB PC Camera;C:\WINDOWS\system32\Drivers\usbVM31b.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys
S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
S3 SABProcEnum;SABProcEnum;\??\C:\Programmer\Internet Explorer\SABProcEnum.sys
S3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
“C:\Programmer\Fælles filer\LightScribe\LSRunOnce.exe”
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7F67F8DD-D049-BFA7-4E4F-8F317C66F7EE}]
C:\WINDOWS\system32:lpr.exe
Contents of the ‘Scheduled Tasks’ folder
2007-08-17 15:15:27 C:\WINDOWS\Tasks\1-Click Maintenance.job - F:\Programmer\Tune up utillities\SystemOptimizer.exe
2007-08-20 13:03:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Programmer\Windows Defender\MpCmdRun.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-20 18:53:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\aawservice]
“ImagePath”=”\“F:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe\”“
Completion time: 2007-08-20 18:55:16 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-20 18:55
C:\ComboFix2.txt ... 2007-08-16 20:55
—- E O F—-
Og her er en ny HJT log :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:07:23, on 20-aug-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
F:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
f:\Programmer\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Programmer\SpywareGuard\sgmain.exe
F:\Programmer\SpywareGuard\sgbhp.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Programmer\Hijackthis\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - f:\Programmer\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [avgnt] “C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe” /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘LOKAL TJENESTE’)
O4 - HKUS\S-1-5-19\..\Run: [Ordbogen.com] C:\Programmer\CoolSystems\ordbogen.com\ordbogen.exe (User ‘LOKAL TJENESTE’)
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘NETVÆRKSTJENESTE’)
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Programmer\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User ‘SYSTEM’)
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Programmer\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User ‘Default user’)
O4 - Startup: SpywareGuard.lnk = F:\Programmer\SpywareGuard\sgmain.exe
O8 - Extra context menu item: Download link med Mega Manager… - f:\Programmer\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&ksporter; til Microsoft Excel - res://F:\PUBLIS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open in &new; window - C:\Documents and Settings\Ejer\Application Data\TuneUp Software\TuneUp Utilities\Web\tuofinw.htm
O8 - Extra context menu item: Search with &Google; - C:\Documents and Settings\Ejer\Application Data\TuneUp Software\TuneUp Utilities\Web\gsearch.htm
O9 - Extra button: IE7pro - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programmer\IE7pro\IE7pro.dll
O9 - Extra ‘Tools’ menuitem: IE7pro Ctrl+Alt+7 - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programmer\IE7pro\IE7pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra ‘Tools’ menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PUBLIS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - F:\Programmer\logitec\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - F:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
—
End of file - 7156 bytes
MVH
bjarnebf
