msn virus logfiler
nu har jeg kørt alle de scanninger og her er logfilerne... nu håber jeg at i kan hjælpe mig...ogfile of HijackThis v1.99.1
Scan saved at 18:49:32, on 19-09-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Spyware Doctor\swdoctor.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
D:\Download\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.dk/0SEDADK/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ni.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmer\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Programmer\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmer\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Qxl Ricardo Toolbar - {DAA9F4A6-996D-44d7-AE05-E5449D517DF6} - C:\PROGRA~1\QXLRIC~1\QXLRIC~1\QXLTOO~1.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Annemarie\Skrivebord\Xinstall.exe
O4 - HKLM\..\Run: [\\JENS\EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P30 "\\JENS\EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmer\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk361CFDK
O8 - Extra context menu item: &Translate English Word - res://c:\programmer\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135280162806
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\Fælles filer\PCSuite\Services\ServiceLayer.exe
SUPERAntiSpyware Scan Log
Generated 09/19/2006 at 02:13 PM
Core Rules Database Version : 0
Trace Rules Database Version: 0
Memory threats detected : 0
Registry threats detected : 0
File threats detected : 16
Trojan.Error Safe Free
C:\Programmer\Error Safe Free\lock.dat
C:\Programmer\Error Safe Free
Adware.Toolbar888
C:\Programmer\Toolbar888\Activate.exe
C:\Programmer\Toolbar888\Uninst.exe
C:\Programmer\Toolbar888
C:\WINDOWS\Prefetch\ACTIVATE.EXE-0D2C00EF.pf
Adware.Tracking Cookie
C:\Documents and Settings\Annemarie\Cookies\annemarie@adfair[1].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@adtech[2].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@advertising[1].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@as1.falkag[2].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@atdmt[2].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@doubleclick[1].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@mediaplex[1].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@track.adform[1].txt
C:\Documents and Settings\Annemarie\Cookies\annemarie@tradedoubler[1].txt
C:\Documents and Settings\Annemarie\Lokale indstillinger\Temp\Cookies\annemarie@doubleclick[1].txt
drsmartload1135a.#xe C:\Documents and Settings\Annemarie\Skrivebord Adware.DollarRevenue Renamed.
BubbleBlastSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
LuxorSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
SudokuSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
TumblebugsSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
A0083484.exe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Win32.HLLW.MyBot Deleted.
A0083485.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.DollarRevenue Renamed.
A0083486.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083487.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083488.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083489.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
drsmartload1135a.#xe C:\Documents and Settings\Annemarie\Skrivebord Adware.DollarRevenue Renamed.
BubbleBlastSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
LuxorSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
SudokuSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
TumblebugsSetup-dm[1].#xe C:\Downloads Adware.TryMedia Renamed.
A0083484.exe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Win32.HLLW.MyBot Deleted.
A0083485.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.DollarRevenue Renamed.
A0083486.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083487.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083488.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
A0083489.#xe C:\System Volume Information\_restore{B1666F11-18D6-4EA9-B009-3893026AFD92}\RP299 Adware.TryMedia Renamed.
