CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg

Log ind eller opret profil

Du kan også logge ind via nedenstående tjenester

xy Nybegynder

12. juni 2006 - 19:21 Der er 13 kommentarer og
2 løsninger

Worm/Rbot og TR/ Drop hvordan kommer jeg af med dem

Dis to virus finder antivir ofte. Ewido og Trojanhunter sige ingenting. Så jeg ved ikke om de i det hele taget betyder noget

For at I bedre kan se hvad det præcist, er for nogle har jeg taget et skærmbillede fra quarantive med

http://img111.imageshack.us/img111/8692/virus8of.png

Synes godt om

ejvindh Ekspert

12. juni 2006 - 19:27 #1

Download Hijackthis:
http://danborg.org/spy1/HJT/hijackthis.exe

Kør Hijackthis.exe fra en mappe som du opretter til formålet:
Klik på "Do a systemscan and save a logfile". Efter kort tid åbnes et notepad-vindue med en logfil. Kopiér indholdet af denne logfil herind i denne tråd. Jeg vil fraråde at du selv begynder at fixe noget.

Synes godt om

xy Nybegynder

12. juni 2006 - 19:32 #2

Jeg var faktisk ved at køre det profram og kopiere det ind her. Det er fra Spywarefri jeg har gjort det. Håber det er det rigtige

Logfile of HijackThis v1.99.1
Scan saved at 19:28:43, on 12-06-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
C:\Programmer\AntiVir PersonalEdition Premium\sched.exe
C:\Programmer\AntiVir PersonalEdition Premium\avguard.exe
C:\Programmer\AntiVir PersonalEdition Premium\avesvc.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\BitGuard\Firewall\FireSvc.Exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmer\UPHClean\uphclean.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\AntiVir PersonalEdition Premium\avmailc.exe
C:\Programmer\AntiVir PersonalEdition Premium\avgnt.exe
C:\Programmer\TrojanHunter 4.5\THGuard.exe
C:\Programmer\abelhadigital.com\HostsMan\hm.exe
C:\Programmer\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedhlp.exe
C:\Programmer\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Programmer\BitGuard\Firewall\Firewall.Exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Marianne\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 4.5\THGuard.exe"
O4 - HKLM\..\Run: [HostsMan] C:\Programmer\abelhadigital.com\HostsMan\hm.exe -s
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Programmer\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programmer\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programmer\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmer\Fælles filer\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpamBully 3 for Outlook Express] "C:\Programmer\Axaware\Spam Bully 3 for OE\sb3oe.exe" install
O4 - HKCU\..\Run: [IE Privacy Keeper] "C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" -startup
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BitGuard Personal Firewall.lnk = C:\Programmer\BitGuard\Firewall\Firewall.Exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O10 - Broken Internet access because of LSP provider 'avsda.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: FirewallService - DanwareSecurity A/S - C:\PROGRA~1\BitGuard\Firewall\FireSvc.Exe

Synes godt om

xy Nybegynder

12. juni 2006 - 19:34 #3

Jeg har ikke rørt ved noget, i Hijackthis. Kørte Ewido i eftermiddags i fejlsikret tilstand, men den fandt intet

Synes godt om

xy Nybegynder

12. juni 2006 - 19:50 #4

Jeg kan huske fra en tidligere tråd enten her fra eksperten eller spywarefri, at der var snak om der skulle gøres noget ved 010, men flere fandt ud af, at det skulle der ikke gøres

Synes godt om

xy Nybegynder

12. juni 2006 - 19:54 #5

ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den: 17:27:50, 12-06-2006
+ Rapport-Checksum: 5D303042

+ Scanningsresultat:
Ingen inficerede filer fundet!

::Rapport slut

Gemt scanningsrapport fra Ewido i eftermiddags

Synes godt om

ejvindh Ekspert

12. juni 2006 - 21:00 #6

-- Hent Dr. Web, og gem det på skrivebordet:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

-- Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

-- Genstart til fejlsikret tilstand (tryk F8 under opstarten)

-- Dobbeltklik på drweb-cureit.exe, den vil køre en expressscan, det siger du ja til.
Når den skriver "Select object for Scanning" nederst til venstre, skal du klikke på Options->Change settings.
Skift til fanebladet Scan, fjern fluebenet ved Heuristic analysis.
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Rename.
Klik så på OK, for at komme ud til hovedmenuen igen.
Klik så på det eller de drev du vil have scannet, der kommer en rød prik for at vise det/de er valgt.

Klik så på den grønne pil ovre til højre på siden, så starter scanningen.
Første gang Dr.Web finder noget, klik "Yes to All", så fjerner den hvad den finder.
Klik så på Start->Søg, find filen CureIt.log kopier det nederste af teksten herind, startende med:
Scan statistics.

-- Genstart herefter til normal tilstand, og lav en ny log med Hijackthis, som du lægger herind til check.

-- Download Gmer-rootkit scanner, og pak den ud til skrivebordet:
http://www.gmer.net/gmer.zip

Kør programmet, klik på fanebladet "Rootkit", og klik på "Scan". Når scanningen er færdig, skal du klikke på "Copy". Så dukker et vindue op, som fortæller at resultatet af rootkit-scanningen er blevet lagt ind i udklipsholderen. Du kan herefter gå ind i denne tråd, og kopiere indholdet herind, ved at stille dig i indtastningsfeltet, og trykke ctrl-v.

Synes godt om

xy Nybegynder

12. juni 2006 - 22:37 #7

Først ville den ikke hente Dr web, men efter en genstart lykkedes det. Det kan vare lidt tid, da jeg valgte at scanne alle drev. Mit eksterne drev er stort. Dr web er ni nået til ca 35 % Jeg skriver fra min søns computer

Synes godt om

ejvindh Ekspert

12. juni 2006 - 22:46 #8

Du melder bare tilbage, når du er klar *S*

Synes godt om

xy Nybegynder

13. juni 2006 - 00:33 #9

Fra Cureit.log
Scan statistics

Objects scanned: 0
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 0 Kb/s
Scan time: 00:00:00

[Scan path] C:\WINDOWS\system32\smss.exe
[Scan path] C:\WINDOWS\system32\csrss.exe
[Scan path] C:\WINDOWS\system32\winlogon.exe
[Scan path] C:\WINDOWS\system32\services.exe
[Scan path] C:\WINDOWS\system32\lsass.exe
[Scan path] C:\WINDOWS\system32\svchost.exe
[Scan path] C:\WINDOWS\explorer.exe
[Scan path] C:\DOCUME~1\Marianne\LOKALE~1\Temp\RarSFX0\_start.exe
[Scan path] C:\DOCUME~1\Marianne\LOKALE~1\Temp\RarSFX0\cureit.exe
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\avgnt.exe
[Scan path] C:\Programmer\TrojanHunter 4.5\THGuard.exe
[Scan path] C:\Programmer\abelhadigital.com\HostsMan\hm.exe
[Scan path] C:\Programmer\SpywareBlaster\sbautoupdate.exe
[Scan path] C:\Programmer\Acronis\TrueImageHome\TrueImageMonitor.exe
[Scan path] C:\Programmer\Acronis\TrueImageHome\TimounterMonitor.exe
[Scan path] C:\Programmer\Fælles filer\Acronis\Schedule2\schedhlp.exe
[Scan path] C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
[Scan path] C:\WINDOWS\system32\ctfmon.exe
[Scan path] C:\Programmer\Axaware\Spam Bully 3 for OE\sb3oe.exe
[Scan path] C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe
[Scan path] C:\Documents and Settings\Marianne\Menuen Start\Programmer\Start\desktop.ini
[Scan path] C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
[Scan path] C:\Programmer\BitGuard\Firewall\Firewall.Exe
[Scan path] C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\desktop.ini
[Scan path] C:\WINDOWS\system32\mmsys.cpl
[Scan path] C:\WINDOWS\system32\icmui.dll
[Scan path] C:\WINDOWS\system32\rshx32.dll
[Scan path] C:\WINDOWS\system32\docprop.dll
[Scan path] C:\WINDOWS\system32\ntshrui.dll
[Scan path] C:\WINDOWS\System32\themeui.dll
[Scan path] C:\WINDOWS\system32\deskadp.dll
[Scan path] C:\WINDOWS\system32\deskmon.dll
[Scan path] C:\WINDOWS\system32\dssec.dll
[Scan path] C:\WINDOWS\system32\SlayerXP.dll
[Scan path] C:\WINDOWS\system32\shscrap.dll
[Scan path] C:\WINDOWS\system32\diskcopy.dll
[Scan path] C:\WINDOWS\system32\ntlanui2.dll
[Scan path] C:\WINDOWS\system32\printui.dll
[Scan path] C:\WINDOWS\system32\dskquoui.dll
[Scan path] C:\WINDOWS\system32\syncui.dll
[Scan path] C:\WINDOWS\System32\hticons.dll
[Scan path] C:\WINDOWS\system32\fontext.dll
[Scan path] C:\WINDOWS\system32\deskperf.dll
[Scan path] C:\WINDOWS\system32\cryptext.dll
[Scan path] C:\WINDOWS\system32\NETSHELL.dll
[Scan path] C:\WINDOWS\system32\wiashext.dll
[Scan path] C:\WINDOWS\System32\remotepg.dll
[Scan path] C:\WINDOWS\system32\wuaucpl.cpl
[Scan path] C:\WINDOWS\System32\wshext.dll
[Scan path] C:\Programmer\Fælles filer\System\Ole DB\oledb32.dll
[Scan path] C:\WINDOWS\System32\mstask.dll
[Scan path] C:\WINDOWS\system32\shdocvw.dll
[Scan path] C:\WINDOWS\System32\shmedia.dll
[Scan path] C:\WINDOWS\System32\browseui.dll
[Scan path] C:\WINDOWS\System32\sendmail.dll
[Scan path] C:\WINDOWS\System32\occache.dll
[Scan path] C:\WINDOWS\System32\webcheck.dll
[Scan path] C:\WINDOWS\System32\appwiz.cpl
[Scan path] C:\WINDOWS\System32\shimgvw.dll
[Scan path] C:\WINDOWS\System32\netplwiz.dll
[Scan path] C:\WINDOWS\System32\zipfldr.dll
[Scan path] C:\WINDOWS\System32\cdfview.dll
[Scan path] C:\WINDOWS\System32\msieftp.dll
[Scan path] C:\WINDOWS\System32\docprop2.dll
[Scan path] C:\WINDOWS\System32\dsquery.dll
[Scan path] C:\WINDOWS\System32\dsuiext.dll
[Scan path] C:\WINDOWS\System32\mydocs.dll
[Scan path] C:\WINDOWS\System32\cscui.dll
[Scan path] C:\WINDOWS\msagent\agentpsh.dll
[Scan path] C:\WINDOWS\System32\dfsshlex.dll
[Scan path] C:\WINDOWS\System32\photowiz.dll
[Scan path] C:\WINDOWS\System32\mmcshext.dll
[Scan path] C:\WINDOWS\system32\cabview.dll
[Scan path] C:\Programmer\Outlook Express\wabfind.dll
[Scan path] C:\WINDOWS\system32\wmpshell.dll
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\shlext.dll
[Scan path] C:\PROGRA~1\FLLESF~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
[Scan path] C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
[Scan path] C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
[Scan path] C:\Programmer\Microsoft Office\OFFICE11\msohev.dll
[Scan path] C:\WINDOWS\System32\twext.dll
[Scan path] C:\WINDOWS\System32\extmgr.dll
[Scan path] C:\PROGRA~1\TROJAN~1.5\contmenu.dll
[Scan path] C:\Programmer\Fælles filer\Ahead\lib\NeroDigitalExt.dll
[Scan path] C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[Scan path] C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[Scan path] C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
[Scan path] C:\WINDOWS\system32\SHELL32.dll
[Scan path] C:\WINDOWS\System32\stobject.dll
[Scan path] C:\WINDOWS\system32\crypt32.dll
[Scan path] C:\WINDOWS\system32\cryptnet.dll
[Scan path] C:\WINDOWS\system32\cscdll.dll
[Scan path] C:\WINDOWS\system32\wlnotify.dll
[Scan path] C:\WINDOWS\system32\sclgntfy.dll
[Scan path] C:\WINDOWS\system32\WgaLogon.dll
[Scan path] C:\WINDOWS\System32\DRIVERS\ACPI.sys
[Scan path] C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
[Scan path] C:\WINDOWS\system32\drivers\aec.sys
[Scan path] C:\WINDOWS\System32\drivers\afd.sys
[Scan path] C:\WINDOWS\system32\drivers\ALCXWDM.SYS
[Scan path] C:\WINDOWS\System32\alg.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\amdk7.sys
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\avmailc.exe
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\sched.exe
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\avguard.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\asyncmac.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\atapi.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\atmarpc.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\audstub.sys
[Scan path] C:\Programmer\AntiVir PersonalEdition Premium\avesvc.exe
[Scan path] C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
[Scan path] C:\WINDOWS\SYSTEM32\drivers\avgntmgr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\cdrom.sys
[Scan path] C:\WINDOWS\system32\cisvc.exe
[Scan path] C:\WINDOWS\system32\clipsrv.exe
[Scan path] C:\WINDOWS\System32\dllhost.exe
[Scan path] C:\WINDOWS\system32\DRIVERS\csndis.sys
[Scan path] C:\WINDOWS\System32\Drivers\CSTDIS.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\disk.sys
[Scan path] C:\WINDOWS\System32\dmadmin.exe
[Scan path] C:\WINDOWS\System32\drivers\dmboot.sys
[Scan path] C:\WINDOWS\System32\drivers\dmio.sys
[Scan path] C:\WINDOWS\System32\drivers\dmload.sys
[Scan path] C:\WINDOWS\system32\drivers\DMusic.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\Dot4.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\dot4usb.sys
[Scan path] C:\WINDOWS\system32\drivers\drmkaud.sys
[Scan path] C:\Programmer\ewido\security suite\ewidoctrl.exe
[Scan path] C:\Programmer\ewido\security suite\guard.sys
[Scan path] C:\Programmer\ewido\security suite\ewidoguard.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\fdc.sys
[Scan path] C:\PROGRA~1\BitGuard\Firewall\FireSvc.Exe
[Scan path] C:\WINDOWS\System32\DRIVERS\flpydisk.sys
[Scan path] C:\WINDOWS\system32\drivers\fltmgr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ftdisk.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\msgpc.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\hidusb.sys
[Scan path] C:\WINDOWS\System32\Drivers\HTTP.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\imapi.sys
[Scan path] C:\WINDOWS\System32\imapi.exe
[Scan path] C:\WINDOWS\system32\drivers\ip6fw.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipinip.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipnat.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipsec.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\irenum.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\isapnp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\kbdclass.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\kbdhid.sys
[Scan path] C:\WINDOWS\system32\drivers\kmixer.sys
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
[Scan path] C:\WINDOWS\System32\mnmsrvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\mouclass.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mouhid.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mrxdav.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
[Scan path] C:\WINDOWS\System32\msdtc.exe
[Scan path] C:\WINDOWS\System32\msiexec.exe
[Scan path] C:\WINDOWS\system32\drivers\MSKSSRV.sys
[Scan path] C:\WINDOWS\system32\drivers\MSPCLOCK.sys
[Scan path] C:\WINDOWS\system32\drivers\MSPQM.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mssmbios.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndistapi.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndisuio.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndiswan.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\netbios.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\netbt.sys
[Scan path] C:\WINDOWS\system32\netdde.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\Source Engine\OSE.EXE
[Scan path] C:\WINDOWS\System32\DRIVERS\parport.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\pci.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspptp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\psched.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ptilink.sys
[Scan path] C:\WINDOWS\System32\Drivers\PxHelp20.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rasacd.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspppoe.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspti.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rdbss.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rdpdr.sys
[Scan path] C:\WINDOWS\system32\sessmgr.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\redbook.sys
[Scan path] C:\WINDOWS\System32\locator.exe
[Scan path] C:\WINDOWS\System32\rsvp.exe
[Scan path] C:\WINDOWS\System32\SCardSvr.exe
[Scan path] C:\WINDOWS\system32\drivers\scsiport.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\secdrv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\serenum.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\serial.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\snapman.sys
[Scan path] C:\WINDOWS\system32\drivers\splitter.sys
[Scan path] C:\WINDOWS\system32\spoolsv.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\sr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\srv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\swenum.sys
[Scan path] C:\WINDOWS\system32\drivers\swmidi.sys
[Scan path] C:\WINDOWS\system32\drivers\sysaudio.sys
[Scan path] C:\WINDOWS\system32\smlogsvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\tcpip.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\termdd.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\timntr.sys
[Scan path] C:\WINDOWS\System32\tlntsvr.exe
[Scan path] C:\WINDOWS\system32\wdfmgr.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\update.sys
[Scan path] C:\Programmer\UPHClean\uphclean.exe
[Scan path] C:\WINDOWS\System32\ups.exe
[Scan path] C:\WINDOWS\system32\drivers\usbaudio.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\usbccgp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\usbehci.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\usbhub.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
[Scan path] C:\WINDOWS\System32\DRIVERS\usbuhci.sys
[Scan path] C:\WINDOWS\System32\drivers\vga.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\viaagp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\viaide.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\VNic.sys
[Scan path] C:\WINDOWS\System32\vssvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\wanarp.sys
[Scan path] C:\WINDOWS\system32\drivers\wdmaud.sys
[Scan path] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[Scan path] C:\WINDOWS\System32\drivers\ws2ifsl.sys
[Scan path] C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\Adobe Reader Hurtigstart.lnk
[Scan path] C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\BitGuard Personal Firewall.lnk

Scan statistics

Objects scanned: 238
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1644 Kb/s
Scan time: 00:00:33

[Scan path] C:\
C:\Documents and Settings\Marianne\ntuser.dat - read error
C:\Documents and Settings\Marianne\NTUSER~1.LOG - read error
>C:\Documents and Settings\Marianne\Dokumenter\Dok6.doc\PORN.EXE is joke program Joke.Dollars
C:\Documents and Settings\Marianne\Dokumenter\Dok6.doc - archive contains infected objects - moved
C:\Documents and Settings\Marianne\Lokale indstillinger\Application Data\Microsoft\Windows\UsrClass.dat - read error
C:\Documents and Settings\Marianne\Lokale indstillinger\Application Data\Microsoft\Windows\USRCLA~1.LOG - read error
C:\Documents and Settings\NetworkService\NTUSER.DAT - read error
C:\Documents and Settings\NetworkService\NTUSER~1.LOG - read error
C:\Documents and Settings\NetworkService\Lokale indstillinger\Application Data\Microsoft\Windows\UsrClass.dat - read error
C:\Documents and Settings\NetworkService\Lokale indstillinger\Application Data\Microsoft\Windows\USRCLA~1.LOG - read error
C:\RECYCLER\S-1-5-21-861567501-963894560-1417001333-1003\Dc172.exe is hacktool program Tool.Prockill - renamed
C:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}\RP77\A0084864.exe is hacktool program Tool.Prockill - renamed
C:\WINDOWS\system32\config\default - read error
C:\WINDOWS\system32\config\default.LOG - read error
C:\WINDOWS\system32\config\SAM - read error
C:\WINDOWS\system32\config\SAM.LOG - read error
C:\WINDOWS\system32\config\SECURITY - read error
C:\WINDOWS\system32\config\SECURITY.LOG - read error
C:\WINDOWS\system32\config\software - read error
C:\WINDOWS\system32\config\software.LOG - read error
C:\WINDOWS\system32\config\system - read error
C:\WINDOWS\system32\config\system.LOG - read error

[Scan path] D:\
>D:\Dokumenter fra C-drev\Dok6.doc\PORN.EXE is joke program Joke.Dollars
D:\Dokumenter fra C-drev\Dok6.doc - archive contains infected objects - moved

[Scan path] F:\
>F:\dokumenter fra C drevet\Dok6.doc\PORN.EXE is joke program Joke.Dollars
F:\dokumenter fra C drevet\Dok6.doc - archive contains infected objects - moved
>F:\E-drevet\Dokumenter fra C-drev\Dok6.doc\PORN.EXE is joke program Joke.Dollars
F:\E-drevet\Dokumenter fra C-drev\Dok6.doc - archive contains infected objects - moved
F:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}\RP71\A0068501.exe infected with Trojan.MulDrop.3338 - deleted
F:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}\RP75\A0074778.exe infected with Trojan.MulDrop.3338 - deleted
F:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}\RP75\A0074779.exe infected with Trojan.MulDrop.3338 - deleted

Scan statistics

Objects scanned: 196278
Infected objects found: 3
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 4
Riskware programs found: 0
Hacktool programs found: 2
Objects cured: 0
Objects deleted: 3
Objects renamed: 2
Objects moved: 4
Objects ignored: 0
Scan speed: 474 Kb/s
Scan time: 02:02:34

Synes godt om

xy Nybegynder

13. juni 2006 - 00:37 #10

Fra Hijakit

Logfile of HijackThis v1.99.1
Scan saved at 00:35:57, on 13-06-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
C:\Programmer\AntiVir PersonalEdition Premium\sched.exe
C:\Programmer\AntiVir PersonalEdition Premium\avguard.exe
C:\Programmer\AntiVir PersonalEdition Premium\avesvc.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\BitGuard\Firewall\FireSvc.Exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmer\UPHClean\uphclean.exe
C:\Programmer\AntiVir PersonalEdition Premium\avmailc.exe
C:\Programmer\AntiVir PersonalEdition Premium\avgnt.exe
C:\Programmer\TrojanHunter 4.5\THGuard.exe
C:\Programmer\abelhadigital.com\HostsMan\hm.exe
C:\Programmer\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programmer\Fælles filer\Acronis\Schedule2\schedhlp.exe
C:\Programmer\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\BitGuard\Firewall\Firewall.Exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Marianne\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 4.5\THGuard.exe"
O4 - HKLM\..\Run: [HostsMan] C:\Programmer\abelhadigital.com\HostsMan\hm.exe -s
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Programmer\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programmer\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programmer\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmer\Fælles filer\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpamBully 3 for Outlook Express] "C:\Programmer\Axaware\Spam Bully 3 for OE\sb3oe.exe" install
O4 - HKCU\..\Run: [IE Privacy Keeper] "C:\Programmer\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" -startup
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BitGuard Personal Firewall.lnk = C:\Programmer\BitGuard\Firewall\Firewall.Exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O10 - Broken Internet access because of LSP provider 'avsda.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmer\Fælles filer\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: FirewallService - DanwareSecurity A/S - C:\PROGRA~1\BitGuard\Firewall\FireSvc.Exe

Synes godt om

xy Nybegynder

13. juni 2006 - 00:52 #11

Fra Gmer:
GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-06-13 00:51:45
Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.10 ----

SSDT \??\C:\Programmer\ewido\security suite\guard.sys ZwOpenProcess
SSDT \??\C:\Programmer\ewido\security suite\guard.sys ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey

---- Devices - GMER 1.0.10 ----

Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE F3B78C8A

---- Files - GMER 1.0.10 ----

File C:\System Volume Information\MountPointManagerRemoteDatabase
File C:\System Volume Information\tracking.log
File C:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}
File D:\System Volume Information\MountPointManagerRemoteDatabase
File D:\System Volume Information\tracking.log
File D:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}
File F:\f8491580ff8a358dd1\i386\admin.dll
File F:\f8491580ff8a358dd1\i386\admin.exe
File F:\f8491580ff8a358dd1\i386\asms
File F:\f8491580ff8a358dd1\i386\asms\10
File F:\f8491580ff8a358dd1\i386\asms\10\msft
File F:\f8491580ff8a358dd1\i386\asms\10\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\10\msft\windows\gdiplus
File F:\f8491580ff8a358dd1\i386\asms\10\msft\windows\gdiplus\gdiplus.cat
File F:\f8491580ff8a358dd1\i386\asms\10\msft\windows\gdiplus\gdiplus.dll
File F:\f8491580ff8a358dd1\i386\asms\10\policy
File F:\f8491580ff8a358dd1\i386\asms\10\policy\msft
File F:\f8491580ff8a358dd1\i386\asms\10\policy\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\10\policy\msft\windows\gdiplus
File F:\f8491580ff8a358dd1\i386\asms\10\policy\msft\windows\gdiplus\gdiplus.cat
File F:\f8491580ff8a358dd1\i386\asms\51
File F:\f8491580ff8a358dd1\i386\asms\51\msft
File F:\f8491580ff8a358dd1\i386\asms\51\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\51\msft\windows\system
File F:\f8491580ff8a358dd1\i386\asms\51\msft\windows\system\default
File F:\f8491580ff8a358dd1\i386\asms\51\msft\windows\system\default\default.cat
File F:\f8491580ff8a358dd1\i386\asms\51\policy
File F:\f8491580ff8a358dd1\i386\asms\51\policy\msft
File F:\f8491580ff8a358dd1\i386\asms\51\policy\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\51\policy\msft\windows\system
File F:\f8491580ff8a358dd1\i386\asms\51\policy\msft\windows\system\default
File F:\f8491580ff8a358dd1\i386\asms\51\policy\msft\windows\system\default\default.cat
File F:\f8491580ff8a358dd1\i386\asms\52
File F:\f8491580ff8a358dd1\i386\asms\52\msft
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\dxmrtp
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\dxmrtp\dxmrtp.cat
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\dxmrtp\dxmrtp.dll
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcdll
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcdll\rtcdll.cat
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcdll\rtcdll.dll
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcres
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcres\rtcres.cat
File F:\f8491580ff8a358dd1\i386\asms\52\msft\windows\net\rtcres\rtcres.dll
File F:\f8491580ff8a358dd1\i386\asms\52\policy
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows\networking
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows\networking\dxmrtp
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows\networking\dxmrtp\dxmrtp.cat
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows\networking\rtcdll
File F:\f8491580ff8a358dd1\i386\asms\52\policy\msft\windows\networking\rtcdll\rtcdll.cat
File F:\f8491580ff8a358dd1\i386\asms\60
File F:\f8491580ff8a358dd1\i386\asms\60\msft
File F:\f8491580ff8a358dd1\i386\asms\60\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\60\msft\windows\common
File F:\f8491580ff8a358dd1\i386\asms\60\msft\windows\common\controls
File F:\f8491580ff8a358dd1\i386\asms\60\msft\windows\common\controls\comctl32.dll
File F:\f8491580ff8a358dd1\i386\asms\60\msft\windows\common\controls\controls.cat
File F:\f8491580ff8a358dd1\i386\asms\60\policy
File F:\f8491580ff8a358dd1\i386\asms\60\policy\60
File F:\f8491580ff8a358dd1\i386\asms\60\policy\60\comctl
File F:\f8491580ff8a358dd1\i386\asms\60\policy\60\comctl\comctl.cat
File F:\f8491580ff8a358dd1\i386\asms\70
File F:\f8491580ff8a358dd1\i386\asms\70\msft
File F:\f8491580ff8a358dd1\i386\asms\70\msft\windows
File F:\f8491580ff8a358dd1\i386\asms\70\msft\windows\mswincrt
File F:\f8491580ff8a358dd1\i386\asms\70\msft\windows\mswincrt\msvcirt.dll
File F:\f8491580ff8a358dd1\i386\asms\70\msft\windows\mswincrt\msvcrt.dll
File F:\f8491580ff8a358dd1\i386\asms\70\msft\windows\mswincrt\mswincrt.cat
File F:\f8491580ff8a358dd1\i386\asms\70\policy
File F:\f8491580ff8a358dd1\i386\asms\70\policy\msft
File F:\f8491580ff8a358dd1\i386\asms\70\policy\msft\mswincrt
File F:\f8491580ff8a358dd1\i386\asms\70\policy\msft\mswincrt\mswincrt.cat
File F:\f8491580ff8a358dd1\i386\aspnet_isapi.dll
File F:\f8491580ff8a358dd1\i386\aspnet_perf.ini
File F:\f8491580ff8a358dd1\i386\aspnet_perf2.ini
File F:\f8491580ff8a358dd1\i386\aspnet_regiis.exe
File F:\f8491580ff8a358dd1\i386\aspnet_wp.exe
File F:\f8491580ff8a358dd1\i386\author.dll
File F:\f8491580ff8a358dd1\i386\author.exe
File F:\f8491580ff8a358dd1\i386\autochk.exe
File F:\f8491580ff8a358dd1\i386\autofmt.exe
File F:\f8491580ff8a358dd1\i386\cabinet.dll
File F:\f8491580ff8a358dd1\i386\caspol.exe
File F:\f8491580ff8a358dd1\i386\cfgwiz.exe
File F:\f8491580ff8a358dd1\i386\compdata
File F:\f8491580ff8a358dd1\i386\compdata\drvmain.inf
File F:\f8491580ff8a358dd1\i386\corperfmonext.dll
File F:\f8491580ff8a358dd1\i386\corperfmonsymbols.ini
File F:\f8491580ff8a358dd1\i386\csc.exe
File F:\f8491580ff8a358dd1\i386\cscomp.dll
File F:\f8491580ff8a358dd1\i386\dbghelp.dll
File F:\f8491580ff8a358dd1\i386\drvmain.sdb
File F:\f8491580ff8a358dd1\i386\drw
File F:\f8491580ff8a358dd1\i386\drw\dwwin.exe
File F:\f8491580ff8a358dd1\i386\eventlogmessages.dll
File F:\f8491580ff8a358dd1\i386\faxpatch.exe
File F:\f8491580ff8a358dd1\i386\fp4amsft.dll
File F:\f8491580ff8a358dd1\i386\fp4anscp.dll
File F:\f8491580ff8a358dd1\i386\fp4apws.dll
File F:\f8491580ff8a358dd1\i386\fp4areg.dll
File F:\f8491580ff8a358dd1\i386\fp4atxt.dll
File F:\f8491580ff8a358dd1\i386\fp4autl.dll
File F:\f8491580ff8a358dd1\i386\fp4avnb.dll
File F:\f8491580ff8a358dd1\i386\fp4avss.dll
File F:\f8491580ff8a358dd1\i386\fp4awebs.dll
File F:\f8491580ff8a358dd1\i386\fp4awel.dll
File F:\f8491580ff8a358dd1\i386\fp98sadm.exe
File F:\f8491580ff8a358dd1\i386\fp98swin.exe
File F:\f8491580ff8a358dd1\i386\fpadmcgi.exe
File F:\f8491580ff8a358dd1\i386\fpadmdll.dll
File F:\f8491580ff8a358dd1\i386\fpcount.exe
File F:\f8491580ff8a358dd1\i386\fpencode.dll
File F:\f8491580ff8a358dd1\i386\fpexedll.dll
File F:\f8491580ff8a358dd1\i386\fpmmc.dll
File F:\f8491580ff8a358dd1\i386\fpmmcsat.dll
File F:\f8491580ff8a358dd1\i386\fpremadm.exe
File F:\f8491580ff8a358dd1\i386\fpsrvadm.exe
File F:\f8491580ff8a358dd1\i386\fusion.dll
File F:\f8491580ff8a358dd1\i386\ic
File F:\f8491580ff8a358dd1\i386\ic\biosinfo.inf
File F:\f8491580ff8a358dd1\i386\ic\compdata
File F:\f8491580ff8a358dd1\i386\ic\compdata\drvmain.inf
File F:\f8491580ff8a358dd1\i386\ic\compdata\ntcompat.inf
File F:\f8491580ff8a358dd1\i386\ic\dosnet.inf
File F:\f8491580ff8a358dd1\i386\ic\drvindex.inf
File F:\f8491580ff8a358dd1\i386\ic\hivecls.inf
File F:\f8491580ff8a358dd1\i386\ic\hivedef.inf
File F:\f8491580ff8a358dd1\i386\ic\hivesft.inf
File F:\f8491580ff8a358dd1\i386\ic\hivesys.inf
File F:\f8491580ff8a358dd1\i386\ic\intl.inf
File F:\f8491580ff8a358dd1\i386\ic\layout.inf
File F:\f8491580ff8a358dd1\i386\ic\ntprint.inf
File F:\f8491580ff8a358dd1\i386\ic\pidgen.dll
File F:\f8491580ff8a358dd1\i386\ic\txtsetup.sif
File F:\f8491580ff8a358dd1\i386\ic\win9xupg
File F:\f8491580ff8a358dd1\i386\ic\win9xupg\migdb.inf
File F:\f8491580ff8a358dd1\i386\ic\win9xupg\vscandb.inf
File F:\f8491580ff8a358dd1\i386\ic\win9xupg\win95upg.inf
File F:\f8491580ff8a358dd1\i386\ic\winnt32.msi
File F:\f8491580ff8a358dd1\i386\ieexec.exe
File F:\f8491580ff8a358dd1\i386\ieexecremote.dll
File F:\f8491580ff8a358dd1\i386\iehost.dll
File F:\f8491580ff8a358dd1\i386\ilasm.exe
File F:\f8491580ff8a358dd1\i386\imagehlp.dll
File F:\f8491580ff8a358dd1\i386\images
File F:\f8491580ff8a358dd1\i386\ims.cat
File F:\f8491580ff8a358dd1\i386\installutil.exe
File F:\f8491580ff8a358dd1\i386\ip
File F:\f8491580ff8a358dd1\i386\ip\biosinfo.inf
File F:\f8491580ff8a358dd1\i386\ip\compdata
File F:\f8491580ff8a358dd1\i386\ip\compdata\drvmain.inf
File F:\f8491580ff8a358dd1\i386\ip\compdata\ntcompat.inf
File F:\f8491580ff8a358dd1\i386\ip\dosnet.inf
File F:\f8491580ff8a358dd1\i386\ip\drvindex.inf
File F:\f8491580ff8a358dd1\i386\ip\hivecls.inf
File F:\f8491580ff8a358dd1\i386\ip\hivedef.inf
File F:\f8491580ff8a358dd1\i386\ip\hivesft.inf
File F:\f8491580ff8a358dd1\i386\ip\hivesys.inf
File F:\f8491580ff8a358dd1\i386\ip\intl.inf
File F:\f8491580ff8a358dd1\i386\ip\layout.inf
File F:\f8491580ff8a358dd1\i386\ip\ntprint.inf
File F:\f8491580ff8a358dd1\i386\ip\pidgen.dll
File F:\f8491580ff8a358dd1\i386\ip\txtsetup.sif
File F:\f8491580ff8a358dd1\i386\ip\win9xupg
File F:\f8491580ff8a358dd1\i386\ip\win9xupg\migdb.inf
File F:\f8491580ff8a358dd1\i386\ip\win9xupg\vscandb.inf
File F:\f8491580ff8a358dd1\i386\ip\win9xupg\win95upg.inf
File F:\f8491580ff8a358dd1\i386\ip\winnt32.msi
File F:\f8491580ff8a358dd1\i386\ipevlpid.dll
File F:\f8491580ff8a358dd1\i386\ipselpid.dll
File F:\f8491580ff8a358dd1\i386\jsc.exe
File F:\f8491580ff8a358dd1\i386\ksecdd.sys
File F:\f8491580ff8a358dd1\i386\lang
File F:\f8491580ff8a358dd1\i386\licdll.dll
File F:\f8491580ff8a358dd1\i386\licwmi.mof
File F:\f8491580ff8a358dd1\i386\medctrro.cmd
File F:\f8491580ff8a358dd1\i386\microsoft.jscript.dll
File F:\f8491580ff8a358dd1\i386\microsoft.visualbasic.dll
File F:\f8491580ff8a358dd1\i386\mscorcfg.dll
File F:\f8491580ff8a358dd1\i386\mscorcfg.msc
File F:\f8491580ff8a358dd1\i386\mscordbc.dll
File F:\f8491580ff8a358dd1\i386\mscordbi.dll
File F:\f8491580ff8a358dd1\i386\mscoree.dll
File F:\f8491580ff8a358dd1\i386\mscorie.dll
File F:\f8491580ff8a358dd1\i386\mscorjit.dll
File F:\f8491580ff8a358dd1\i386\mscorld.dll
File F:\f8491580ff8a358dd1\i386\mscorlib.dll
File F:\f8491580ff8a358dd1\i386\mscorlib.tlb
File F:\f8491580ff8a358dd1\i386\mscorpe.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.chs.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.cht.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.es.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.fr.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.ger.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.it.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.ja.dll
File F:\f8491580ff8a358dd1\i386\mscorrc.kor.dll
File F:\f8491580ff8a358dd1\i386\mscorsec.dll
File F:\f8491580ff8a358dd1\i386\mscorsn.dll
File F:\f8491580ff8a358dd1\i386\mscorsvr.dll
File F:\f8491580ff8a358dd1\i386\mscortim.dll
File F:\f8491580ff8a358dd1\i386\mscorwks.dll
File F:\f8491580ff8a358dd1\i386\msdaipp.dll
File F:\f8491580ff8a358dd1\i386\msgsc.dll
File F:\f8491580ff8a358dd1\i386\msgslang.dll
File F:\f8491580ff8a358dd1\i386\msmsgs.exe
File F:\f8491580ff8a358dd1\i386\msrdp.ocx
File F:\f8491580ff8a358dd1\i386\netfxupdate.exe
File F:\f8491580ff8a358dd1\i386\netsetup.exe
File F:\f8491580ff8a358dd1\i386\new
File F:\f8491580ff8a358dd1\i386\ngen.exe
File F:\f8491580ff8a358dd1\i386\ntdetect.com
File F:\f8491580ff8a358dd1\i386\ntdll.dll
File F:\f8491580ff8a358dd1\i386\ntfs.sys
File F:\f8491580ff8a358dd1\i386\ntprint.cat
File F:\f8491580ff8a358dd1\i386\oschoice.exe
File F:\f8491580ff8a358dd1\i386\perfcounter.dll
File F:\f8491580ff8a358dd1\i386\regasm.exe
File F:\f8491580ff8a358dd1\i386\regcode.dll
File F:\f8491580ff8a358dd1\i386\regedit.exe
File F:\f8491580ff8a358dd1\i386\regsvcs.exe
File F:\f8491580ff8a358dd1\i386\root
File F:\f8491580ff8a358dd1\i386\root\cmpnents
File F:\f8491580ff8a358dd1\i386\root\cmpnents\mediactr
File F:\f8491580ff8a358dd1\i386\root\cmpnents\mediactr\i386
File F:\f8491580ff8a358dd1\i386\root\cmpnents\mediactr\i386\mcpreins.exe
File F:\f8491580ff8a358dd1\i386\root\cmpnents\netfx
File F:\f8491580ff8a358dd1\i386\root\cmpnents\netfx\i386
File F:\f8491580ff8a358dd1\i386\root\cmpnents\tabletpc
File F:\f8491580ff8a358dd1\i386\root\cmpnents\tabletpc\i386
File F:\f8491580ff8a358dd1\i386\root\ic
File F:\f8491580ff8a358dd1\i386\root\ic\setup.exe
File F:\f8491580ff8a358dd1\i386\root\ip
File F:\f8491580ff8a358dd1\i386\root\ip\setup.exe
File F:\f8491580ff8a358dd1\i386\setregni.exe
File F:\f8491580ff8a358dd1\i386\setuptxt
File F:\f8491580ff8a358dd1\i386\shtml.dll
File F:\f8491580ff8a358dd1\i386\shtml.exe
File F:\f8491580ff8a358dd1\i386\spcmdcon.sys
File F:\f8491580ff8a358dd1\i386\spdwnwxp.exe
File F:\f8491580ff8a358dd1\i386\spmsg.dll
File F:\f8491580ff8a358dd1\i386\spnpinst.exe
File F:\f8491580ff8a358dd1\i386\sprecovr.exe
File F:\f8491580ff8a358dd1\i386\spuninst.exe
File F:\f8491580ff8a358dd1\i386\spupdsvc.exe
File F:\f8491580ff8a358dd1\i386\spupdwxp.exe
File F:\f8491580ff8a358dd1\i386\stub_fpsrvadm.exe
File F:\f8491580ff8a358dd1\i386\stub_fpsrvwin.exe
File F:\f8491580ff8a358dd1\i386\sy52106.dll
File F:\f8491580ff8a358dd1\i386\system.configuration.install.dll
File F:\f8491580ff8a358dd1\i386\system.data.dll
File F:\f8491580ff8a358dd1\i386\system.design.dll
File F:\f8491580ff8a358dd1\i386\system.directoryservices.dll
File F:\f8491580ff8a358dd1\i386\system.drawing.design.dll
File F:\f8491580ff8a358dd1\i386\system.drawing.dll
File F:\f8491580ff8a358dd1\i386\system.enterpriseservices.dll
File F:\f8491580ff8a358dd1\i386\system.enterpriseservices.thunk.dll
File F:\f8491580ff8a358dd1\i386\system.management.dll
File F:\f8491580ff8a358dd1\i386\system.messaging.dll
File F:\f8491580ff8a358dd1\i386\system.runtime.remoting.dll
File F:\f8491580ff8a358dd1\i386\system.runtime.serialization.formatters.soap.dll
File F:\f8491580ff8a358dd1\i386\system.security.dll
File F:\f8491580ff8a358dd1\i386\system.serviceprocess.dll
File F:\f8491580ff8a358dd1\i386\system.web.dll
File F:\f8491580ff8a358dd1\i386\system.web.regularexpressions.dll
File F:\f8491580ff8a358dd1\i386\system.web.services.dll
File F:\f8491580ff8a358dd1\i386\system.windows.forms.dll
File F:\f8491580ff8a358dd1\i386\system.windows.forms.tlb
File F:\f8491580ff8a358dd1\i386\system.xml.dll
File F:\f8491580ff8a358dd1\i386\system32
File F:\f8491580ff8a358dd1\i386\system32\ntdll.dll
File F:\f8491580ff8a358dd1\i386\system32\smss.exe
File F:\f8491580ff8a358dd1\i386\tcptest.exe
File F:\f8491580ff8a358dd1\i386\tcptsat.dll
File F:\f8491580ff8a358dd1\i386\telnet.exe
File F:\f8491580ff8a358dd1\i386\togac.exe
File F:\f8491580ff8a358dd1\i386\update
File F:\f8491580ff8a358dd1\i386\update\branches.inf
File F:\f8491580ff8a358dd1\i386\update\fixccs.exe
File F:\f8491580ff8a358dd1\i386\update\nv4prep.exe
File F:\f8491580ff8a358dd1\i386\update\setupapi.dll
File F:\f8491580ff8a358dd1\i386\update\SP2.CAT
File F:\f8491580ff8a358dd1\i386\update\spcustom.dll
File F:\f8491580ff8a358dd1\i386\update\spnpinst.exe
File F:\f8491580ff8a358dd1\i386\update\update.exe
File F:\f8491580ff8a358dd1\i386\update\update.inf
File F:\f8491580ff8a358dd1\i386\update\update.msi
File F:\f8491580ff8a358dd1\i386\update\update.ver
File F:\f8491580ff8a358dd1\i386\update\updatebr.inf
File F:\f8491580ff8a358dd1\i386\vbc.exe
File F:\f8491580ff8a358dd1\i386\vbc7ui.chs.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.cht.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.es.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.fr.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.ger.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.it.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.ja.dll
File F:\f8491580ff8a358dd1\i386\vbc7ui.kor.dll
File F:\f8491580ff8a358dd1\i386\vsavb7rt.dll
File F:\f8491580ff8a358dd1\i386\win9xmig
File F:\f8491580ff8a358dd1\i386\win9xmig\acrobat
File F:\f8491580ff8a358dd1\i386\win9xmig\acrobat\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\cmmgr
File F:\f8491580ff8a358dd1\i386\win9xmig\cmmgr\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\devupgrd
File F:\f8491580ff8a358dd1\i386\win9xmig\devupgrd\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\dmicall
File F:\f8491580ff8a358dd1\i386\win9xmig\dmicall\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\eastman
File F:\f8491580ff8a358dd1\i386\win9xmig\eastman\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\fax
File F:\f8491580ff8a358dd1\i386\win9xmig\fax\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\hptools
File F:\f8491580ff8a358dd1\i386\win9xmig\hptools\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\ibmav
File F:\f8491580ff8a358dd1\i386\win9xmig\ibmav\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\icm
File F:\f8491580ff8a358dd1\i386\win9xmig\icm\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\iemig
File F:\f8491580ff8a358dd1\i386\win9xmig\iemig\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\mapi
File F:\f8491580ff8a358dd1\i386\win9xmig\mapi\dll
File F:\f8491580ff8a358dd1\i386\win9xmig\mapi\dll\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\modems
File F:\f8491580ff8a358dd1\i386\win9xmig\modems\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\msgqueue
File F:\f8491580ff8a358dd1\i386\win9xmig\msgqueue\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\msp
File F:\f8491580ff8a358dd1\i386\win9xmig\msp\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\neckbd
File F:\f8491580ff8a358dd1\i386\win9xmig\neckbd\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\necpa
File F:\f8491580ff8a358dd1\i386\win9xmig\necpa\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\necwps
File F:\f8491580ff8a358dd1\i386\win9xmig\necwps\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\octopus
File F:\f8491580ff8a358dd1\i386\win9xmig\octopus\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\oewab
File F:\f8491580ff8a358dd1\i386\win9xmig\oewab\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\print
File F:\f8491580ff8a358dd1\i386\win9xmig\print\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\pws
File F:\f8491580ff8a358dd1\i386\win9xmig\pws\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\rumba
File F:\f8491580ff8a358dd1\i386\win9xmig\rumba\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\setup
File F:\f8491580ff8a358dd1\i386\win9xmig\setup\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\transact
File F:\f8491580ff8a358dd1\i386\win9xmig\transact\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\wia
File F:\f8491580ff8a358dd1\i386\win9xmig\wia\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xmig\wmp
File F:\f8491580ff8a358dd1\i386\win9xmig\wmp\migrate.dll
File F:\f8491580ff8a358dd1\i386\win9xupg
File F:\f8491580ff8a358dd1\i386\win9xupg\cabinet.dll
File F:\f8491580ff8a358dd1\i386\win9xupg\imagehlp.dll
File F:\f8491580ff8a358dd1\i386\win9xupg\msvcrt.dll
File F:\f8491580ff8a358dd1\i386\win9xupg\setupapi.dll
File F:\f8491580ff8a358dd1\i386\win9xupg\w95upg.dll
File F:\f8491580ff8a358dd1\i386\winnt.exe
File F:\f8491580ff8a358dd1\i386\winnt32.exe
File F:\f8491580ff8a358dd1\i386\winnt32a.dll
File F:\f8491580ff8a358dd1\i386\winnt32u.dll
File F:\f8491580ff8a358dd1\i386\winntbba.dll
File F:\f8491580ff8a358dd1\i386\winntbbu.dll
File F:\f8491580ff8a358dd1\i386\winntupg
File F:\f8491580ff8a358dd1\i386\winntupg\netupg.inf
File F:\f8491580ff8a358dd1\i386\winntupg\netupgrd.dll
File F:\f8491580ff8a358dd1\i386\winntupg\nv4prep.dll
File F:\f8491580ff8a358dd1\i386\winntupg\setupapi.dll
File F:\f8491580ff8a358dd1\i386\wsdueng.dll
File F:\f8491580ff8a358dd1\i386\xpblkpop.wa_
File F:\f8491580ff8a358dd1\i386\xpinfbar.wa_
File F:\f8491580ff8a358dd1\i386\_networkingperfcounters.ini
File F:\System Volume Information\catalog.wci
File F:\System Volume Information\MountPointManagerRemoteDatabase
File F:\System Volume Information\tracking.log
File F:\System Volume Information\_restore{062D74A4-4868-43C4-BF8F-61A02D98DFDA}
File F:\System Volume Information\_restore{198D90C6-50D9-4A84-9A4E-1CA6262474FC}
File F:\System Volume Information\_restore{1AA38860-89C3-4935-B383-CC1853A180C3}
File F:\System Volume Information\_restore{5036E46C-E32D-4C32-8D93-A1709DC96702}
File F:\System Volume Information\_restore{6A193B4A-ED57-4343-98C7-CDD86E86F672}
File F:\System Volume Information\_restore{C044E2DC-1727-4CD3-83E7-BAB5BBE63877}

---- EOF - GMER 1.0.10 ----

Synes godt om

xy Nybegynder

13. juni 2006 - 00:56 #12

Foreløbelig tak for din indsats. Jeg tror jeg har gjort det som jeg skulle, men ville blive glad for, om du kikkede på det når du får tid

Synes godt om

ejvindh Ekspert

13. juni 2006 - 07:45 #13

Det ser fint ud. Der er ikke mere at se i loggene. Kører computeren bedre nu?

For at gøre arbejdet helt færdig:
Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så kan det også være en god ide at skjule dine systemfiler og -mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Det kan også være en god ide at få renset ud i dine midlertidige filer. Det kan gøres på en hurtig og nem måde med denne fil
www.spywareinfo.dk/download/cleantempxp2k.bat
---------------------------

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Du finder links og gode råd her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg vil også foreslå, at du læser denne artikel om hvordan du kan undgå at blive inficeret i fremtiden:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Synes godt om

xy Nybegynder

13. juni 2006 - 08:16 #14

CCcleaner er installeret, Spywareblaster, Trojanhunter, Ewido, regesupreme og Bitguard. SpywareBlaster, Spyboot Search and Destroy er installeret på min computer. Ligeledes er IE privacy Keeper installeret. Så jeg menr at computeren er godt beskykkettet. Jeg sletter ofte gendannelses punkterne Jeg skal lige have skjult filerne.
www.spywareinfo.dk/download/cleantempxp2k.bat
Dette program kørete jeg før jeg scannede med Ewido
---------------------------

Tusind tak for din indsats. Kan jeg føle mig sikker på at min PC nu er ren for virus og spyware ?

Synes godt om

ejvindh Ekspert

13. juni 2006 - 08:42 #15

Det var så lidt. :-)

100% sikker kan du kun være hvis du formaterer maskinen, og undlader at gå på nettet og ikke sætter en diskette eller CDrom ind i maskinen. Men så har du heller ikke så meget glæde af den ;-)

Men det er nogle grundige programmer du har kørt undervejs, og det ville overraske mig meget, hvis der skulle være mere tilbage :-)

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
pop up black friday Af Malm i Virus	10	22/11/202420:49	23/11/202410:46
Findes der mon et Antivirus program, som ikke, konstant, reklamerer, for at købe ? Af Ikke-ekspert i Virus	21	22/06/202419:22	23/06/202412:54
Anbefaling af antivirusprogram med firewall Af OnePlusFan i Virus	23	07/05/202421:02	13/05/202419:48
trusler Af gerhardpet i Virus	4	26/01/202410:02	27/01/202408:32
Kan ikke fjerne virus Af mik28 i Virus	16	09/01/202416:37	10/01/202419:59

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS