Trojan: Torpig og Virtumonde - hjælp

http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

-- Hent S!Ri's SmitfraudFix.zip og gem det på dit Skrivebord.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Alternativt herfra:
http://72.232.135.12/siri/SmitfraudFix.exe

NB: Filen "process.exe" som ligger i dette værktøj bliver af visse antivirus-programmer identificeret som "RiskTool". Det har dog ikke noget på sig!

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Kør SmitfraudFix. Tast 2 - svar ja til at rense (y=yes). Lad programmet gennemføre en rensning. Det vil også checke om systemfilen wininet.dll er inficeret. Hvis den er det, vil du blive bedt om tilladelse til at erstatte den med en anden. Her skal du vælge "Yes", ved at taste "y".

Programmet bliver muligvis nødt til at genstarte undervejs. Herefter vil der dukke en liste med resultaterne af rensningen op . Kopiér denne liste ind i tråden.

-- Genstart og læg en log med det program, som vejmand linker til herind, sammen med loggen fra SmitfraudFix (C:\rapport.txt).

Sorry, forkert vejledning!!!

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

--  Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

ComboFix-quarantined-files.txt

[code]
2007-07-10 07:16      1026    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_NTMLSVC.reg.cf
2007-07-10 07:16      3708    --a------    C:\Qoobox\Quarantine\Registry_backups\services_NtmlSvc.reg.cf


Folder PATH listing for volume System
Volume serial number is B0CA-AF8E
C:\QOOBOX
\---Quarantine
    \---Registry_backups
            LEGACY_NTMLSVC.reg.cf
            services_NtmlSvc.reg.cf
           
[/code]

ComboFix.txt

"Nordea-Elev" - 2007-07-10  7:16:17 - ComboFix 07-07-10.1 - Service Pack 2 


(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NTMLSVC
-------\NtmlSvc


(((((((((((((((((((((((((  Files Created from 2007-06-10 to 2007-07-10  )))))))))))))))))))))))))))))))


2007-07-10 07:15    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-07-10 00:38    6,369    ---hs----    C:\WINDOWS\system32\npstv.bak1
2007-07-10 00:37    266,336    --a------    C:\WINDOWS\system32\vtspn.dll.vir
2007-07-10 00:22    24,576    --a------    C:\WINDOWS\system32\VundoFixSVC.exe
2007-07-10 00:16    <DIR>    d--------    C:\VundoFix Backups
2007-07-09 18:17    <DIR>    d--------    C:\Program Files\Common Files\Application
2007-07-09 18:16    <DIR>    d--------    C:\Program Files\SPYWAREfighter
2007-07-09 17:46    12,290,511    ---------    C:\avg7qt.dat
2007-07-09 17:41    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\TrojanHunter
2007-07-09 07:34    <DIR>    d--------    C:\Program Files\TrojanHunter 4.7
2007-07-08 19:20    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ssdata
2007-07-08 19:01    <DIR>    d--------    C:\Program Files\Windows Live Safety Center
2007-07-08 17:54    626,688    --a------    C:\WINDOWS\system32\msvcr80.dll
2007-07-08 06:40    31,254    --a------    C:\WINDOWS\system32\xxyxvtq.dll.vir
2007-07-08 06:03    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\WebStripper
2007-07-07 12:23    <DIR>    d--------    C:\Program Files\Lavasoft
2007-07-07 12:23    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-07 12:22    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 03:53    <DIR>    d--------    C:\Program Files\Common Files\DirectX
2007-07-06 03:46    <DIR>    d--------    C:\Program Files\EA GAMES
2007-07-06 02:19    786,432    --ah-----    C:\DOCUME~1\Guest\NTUSER.DAT
2007-07-04 11:28    7,552    --a------    C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-07-02 09:59    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\HP
2007-06-23 15:14    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-07 10:13:25    --------    d-----w    C:\Program Files\Google
2007-07-07 10:08:46    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Lavasoft
2007-07-07 09:22:23    --------    d-----w    C:\Program Files\IrfanView
2007-07-03 11:48:18    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\dvdcss
2007-07-02 21:53:06    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Skype
2007-06-30 06:51:25    --------    d-----w    C:\Program Files\Lx_cats
2007-06-23 14:01:43    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Apple Computer
2007-06-23 13:21:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Google
2007-06-08 09:52:50    947,096    ----a-w    C:\WINDOWS\system32\_ISource30.dll
2007-06-07 18:50:01    4,385    ----a-w    C:\WINDOWS\mozver.dat
2007-06-04 13:18:48    9,344    ----a-w    C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02    8,320    ----a-w    C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56    6,272    ----a-w    C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-02 07:52:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Azureus
2007-05-31 19:46:18    71,096    ----a-w    C:\DOCUME~1\NORDEA~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-05-23 22:08:51    --------    d-----w    C:\Program Files\Nokia
2007-05-23 22:01:38    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Nokia
2007-05-20 14:00:43    --------    d-----w    C:\Program Files\LimeWire
2007-05-17 19:18:57    --------    d-----w    C:\Program Files\QuickTime
2007-05-16 15:12:02    683,520    ----a-w    C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15    144,896    ----a-w    C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23    2,854,400    ----a-w    C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36    33,624    ----a-w    C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54    1,710,936    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48    549,720    ----a-w    C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42    325,976    ----a-w    C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36    203,096    ----a-w    C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28    92,504    ----a-w    C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20    53,080    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20    43,352    ----a-w    C:\WINDOWS\system32\wups2.dll
2007-04-13 13:19:52    7,680    ----a-w    C:\WINDOWS\system32\lsdelete.exe


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16    59032    --a------    C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43    501400    --a------    C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC93A6DF-F31C-44B1-A24A-C1723F723971}]
            C:\WINDOWS\system32\nnnmj.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 C:\WINDOWS\system32\bthprops.cpl]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-20 01:38]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-20 01:38]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-20 01:38]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-20 01:38]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-25 21:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 14:17]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 14:16]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" []
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 11:57]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 13:39]
"PDFCreatorClient"="C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe" [2003-08-08 18:30]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 22:00]
"TP4EX"="tp4ex.exe" [2005-10-17 01:11 C:\WINDOWS\system32\TP4EX.exe]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 16:08]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-09-13 02:23]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 C:\WINDOWS\system32\tweakui.cpl]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 C:\WINDOWS\KHALMNPR.Exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"NPDTRAY"="C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe" [2006-07-21 02:54]
"THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19]
"spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-06-08 11:52]
"@"="" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"TPKMAPMN"="C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe" []
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2003-09-01 20:52]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Documents and Settings\Nordea-Elev\Desktop\DSC00240.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpge32]
winpge32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
C:\Program Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    BthServ


Contents of the 'Scheduled Tasks' folder
2007-05-17 09:43:00  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-10 05:15:36  C:\WINDOWS\tasks\User_Feed_Synchronization-{F21A76AE-4D89-4A84-926B-625F4E085A11}.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 07:19:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-10  7:20:30 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-10 07:20

    --- E O F ---

Det ser ud til at Combofix fik taget godt fat. Prøv så følgende:

-- Kopiér indholdet mellem de bølgede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt. Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

~~~~~~~~~~~~~~~~~~~~~~~~~~
File::
C:\WINDOWS\system32\npstv.bak1
C:\WINDOWS\system32\vtspn.dll.vir
C:\WINDOWS\system32\xxyxvtq.dll.vir
C:\WINDOWS\system32\nnnmj.dll
c:\WINDOWS\system32\winpge32.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC93A6DF-F31C-44B1-A24A-C1723F723971}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpge32]
~~~~~~~~~~~~~~~~~~~~~~~~~~
Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen. Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind til gennemsyn

-- Hent så Hijackthis på dette link:
http://www.filehippo.com/download_hijackthis/
(Klik på "Download latest version" øverst til højre)

Efter kort tid vil programmet "HJTInstall.exe" blive downloadet. Dobbeltklik på filen, og klik på Install. Så vil programmet blive installeret på et øjeblik, hvorefter et nyt vindue dukker op. Klik på "Do a systemscan and save a logfile". Efter kort tid åbnes et notepad-vindue med en logfil. Kopiér indholdet af denne logfil herind i denne tråd.

Arrghh. Fejl igen. Her er den rigtige procedure:

-- Kopiér indholdet mellem de bølgede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt. Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

~~~~~~~~~~~~~~~~~~~~~~~~~~
File::
C:\WINDOWS\system32\npstv.bak1
C:\WINDOWS\system32\vtspn.dll.vir
C:\WINDOWS\system32\xxyxvtq.dll.vir
C:\WINDOWS\system32\nnnmj.dll
c:\WINDOWS\system32\winpge32.dll

Registry::
[-hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{FC93A6DF-F31C-44B1-A24A-C1723F723971}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpge32]
~~~~~~~~~~~~~~~~~~~~~~~~~~
Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen. Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind til gennemsyn

-- Hent så Hijackthis på dette link:
http://www.filehippo.com/download_hijackthis/
(Klik på "Download latest version" øverst til højre)

Efter kort tid vil programmet "HJTInstall.exe" blive downloadet. Dobbeltklik på filen, og klik på Install. Så vil programmet blive installeret på et øjeblik, hvorefter et nyt vindue dukker op. Klik på "Do a systemscan and save a logfile". Efter kort tid åbnes et notepad-vindue med en logfil. Kopiér indholdet af denne logfil herind i denne tråd.

Efter at have lavet den .txt fil og trukket den over i ComboFix.exe og det hele var slut kom denne besked på skærmen.



nircmd.cfexe - Unable To Locate Component

This applicatio has failed to start because ConnAPI.DLL was not found. Re-installing the application may fix the problem.

Efter jeg har kørt det du bad mig om lavede den en "ComboFix2.txt" hvor i der står følgende:




"Nordea-Elev" - 2007-07-10  7:16:17 - ComboFix 07-07-10.1 - Service Pack 2 


(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NTMLSVC
-------\NtmlSvc


(((((((((((((((((((((((((  Files Created from 2007-06-10 to 2007-07-10  )))))))))))))))))))))))))))))))


2007-07-10 07:15    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-07-10 00:38    6,369    ---hs----    C:\WINDOWS\system32\npstv.bak1
2007-07-10 00:37    266,336    --a------    C:\WINDOWS\system32\vtspn.dll.vir
2007-07-10 00:22    24,576    --a------    C:\WINDOWS\system32\VundoFixSVC.exe
2007-07-10 00:16    <DIR>    d--------    C:\VundoFix Backups
2007-07-09 18:17    <DIR>    d--------    C:\Program Files\Common Files\Application
2007-07-09 18:16    <DIR>    d--------    C:\Program Files\SPYWAREfighter
2007-07-09 17:46    12,290,511    ---------    C:\avg7qt.dat
2007-07-09 17:41    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\TrojanHunter
2007-07-09 07:34    <DIR>    d--------    C:\Program Files\TrojanHunter 4.7
2007-07-08 19:20    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ssdata
2007-07-08 19:01    <DIR>    d--------    C:\Program Files\Windows Live Safety Center
2007-07-08 17:54    626,688    --a------    C:\WINDOWS\system32\msvcr80.dll
2007-07-08 06:40    31,254    --a------    C:\WINDOWS\system32\xxyxvtq.dll.vir
2007-07-08 06:03    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\WebStripper
2007-07-07 12:23    <DIR>    d--------    C:\Program Files\Lavasoft
2007-07-07 12:23    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-07 12:22    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 03:53    <DIR>    d--------    C:\Program Files\Common Files\DirectX
2007-07-06 03:46    <DIR>    d--------    C:\Program Files\EA GAMES
2007-07-06 02:19    786,432    --ah-----    C:\DOCUME~1\Guest\NTUSER.DAT
2007-07-04 11:28    7,552    --a------    C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-07-02 09:59    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\HP
2007-06-23 15:14    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-07 10:13:25    --------    d-----w    C:\Program Files\Google
2007-07-07 10:08:46    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Lavasoft
2007-07-07 09:22:23    --------    d-----w    C:\Program Files\IrfanView
2007-07-03 11:48:18    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\dvdcss
2007-07-02 21:53:06    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Skype
2007-06-30 06:51:25    --------    d-----w    C:\Program Files\Lx_cats
2007-06-23 14:01:43    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Apple Computer
2007-06-23 13:21:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Google
2007-06-08 09:52:50    947,096    ----a-w    C:\WINDOWS\system32\_ISource30.dll
2007-06-07 18:50:01    4,385    ----a-w    C:\WINDOWS\mozver.dat
2007-06-04 13:18:48    9,344    ----a-w    C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02    8,320    ----a-w    C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56    6,272    ----a-w    C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-02 07:52:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Azureus
2007-05-31 19:46:18    71,096    ----a-w    C:\DOCUME~1\NORDEA~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-05-23 22:08:51    --------    d-----w    C:\Program Files\Nokia
2007-05-23 22:01:38    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Nokia
2007-05-20 14:00:43    --------    d-----w    C:\Program Files\LimeWire
2007-05-17 19:18:57    --------    d-----w    C:\Program Files\QuickTime
2007-05-16 15:12:02    683,520    ----a-w    C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15    144,896    ----a-w    C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23    2,854,400    ----a-w    C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36    33,624    ----a-w    C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54    1,710,936    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48    549,720    ----a-w    C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42    325,976    ----a-w    C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36    203,096    ----a-w    C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28    92,504    ----a-w    C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20    53,080    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20    43,352    ----a-w    C:\WINDOWS\system32\wups2.dll
2007-04-13 13:19:52    7,680    ----a-w    C:\WINDOWS\system32\lsdelete.exe


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16    59032    --a------    C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43    501400    --a------    C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC93A6DF-F31C-44B1-A24A-C1723F723971}]
            C:\WINDOWS\system32\nnnmj.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 C:\WINDOWS\system32\bthprops.cpl]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-20 01:38]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-20 01:38]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-20 01:38]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-20 01:38]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-25 21:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 14:17]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 14:16]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" []
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 11:57]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 13:39]
"PDFCreatorClient"="C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe" [2003-08-08 18:30]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 22:00]
"TP4EX"="tp4ex.exe" [2005-10-17 01:11 C:\WINDOWS\system32\TP4EX.exe]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 16:08]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-09-13 02:23]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 C:\WINDOWS\system32\tweakui.cpl]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 C:\WINDOWS\KHALMNPR.Exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"NPDTRAY"="C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe" [2006-07-21 02:54]
"THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19]
"spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-06-08 11:52]
"@"="" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"TPKMAPMN"="C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe" []
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2003-09-01 20:52]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Documents and Settings\Nordea-Elev\Desktop\DSC00240.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpge32]
winpge32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
C:\Program Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    BthServ


Contents of the 'Scheduled Tasks' folder
2007-05-17 09:43:00  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-10 05:15:36  C:\WINDOWS\tasks\User_Feed_Synchronization-{F21A76AE-4D89-4A84-926B-625F4E085A11}.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 07:19:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-10  7:20:30 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-10 07:20

    --- E O F ---

og den lavede en fil ved navn "ComboFix-quarantined-files.txt" hvori der står følgende:

[code]
2007-07-08 06:40      31254    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xxyxvtq.dll.vir.vir
2007-07-10 00:37      266336    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vtspn.dll.vir.vir
2007-07-10 00:38      6369    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\npstv.bak1.vir
2007-07-10 07:16      1026    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_NTMLSVC.reg.cf
2007-07-10 07:16      3708    --a------    C:\Qoobox\Quarantine\Registry_backups\services_NtmlSvc.reg.cf


Folder PATH listing for volume System
Volume serial number is B0CA-AF8E
C:\QOOBOX
\---Quarantine
    +---C
    |  \---WINDOWS
    |      \---system32
    |              npstv.bak1.vir
    |              vtspn.dll.vir.vir
    |              xxyxvtq.dll.vir.vir
    |             
    \---Registry_backups
            LEGACY_NTMLSVC.reg.cf
            services_NtmlSvc.reg.cf
           
[/code]

Ops... fejl...

Jeg postede den gamle ComboFix log fil - den fra imorges . . . her den fra i aften:



"Nordea-Elev" - 2007-07-10 22:26:58 - ComboFix 07-07-10.1 - Service Pack 2 
Command switches used ::  C:\Documents and Settings\Nordea-Elev\Desktop\CFScript.txt


(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\npstv.bak1
C:\WINDOWS\system32\vtspn.dll.vir
C:\WINDOWS\system32\xxyxvtq.dll.vir


(((((((((((((((((((((((((  Files Created from 2007-06-10 to 2007-07-10  )))))))))))))))))))))))))))))))


2007-07-10 07:15    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-07-10 00:22    24,576    --a------    C:\WINDOWS\system32\VundoFixSVC.exe
2007-07-10 00:16    <DIR>    d--------    C:\VundoFix Backups
2007-07-09 18:17    <DIR>    d--------    C:\Program Files\Common Files\Application
2007-07-09 18:16    <DIR>    d--------    C:\Program Files\SPYWAREfighter
2007-07-09 17:46    12,290,511    ---------    C:\avg7qt.dat
2007-07-09 17:41    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\TrojanHunter
2007-07-09 07:34    <DIR>    d--------    C:\Program Files\TrojanHunter 4.7
2007-07-08 19:20    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ssdata
2007-07-08 19:01    <DIR>    d--------    C:\Program Files\Windows Live Safety Center
2007-07-08 17:54    626,688    --a------    C:\WINDOWS\system32\msvcr80.dll
2007-07-08 06:03    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\WebStripper
2007-07-07 12:23    <DIR>    d--------    C:\Program Files\Lavasoft
2007-07-07 12:23    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-07 12:22    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 03:53    <DIR>    d--------    C:\Program Files\Common Files\DirectX
2007-07-06 03:46    <DIR>    d--------    C:\Program Files\EA GAMES
2007-07-06 02:19    786,432    --ah-----    C:\DOCUME~1\Guest\NTUSER.DAT
2007-07-04 11:28    7,552    --a------    C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-07-02 09:59    <DIR>    d--------    C:\DOCUME~1\NORDEA~1\APPLIC~1\HP
2007-06-23 15:14    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-07 10:13:25    --------    d-----w    C:\Program Files\Google
2007-07-07 10:08:46    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Lavasoft
2007-07-07 09:22:23    --------    d-----w    C:\Program Files\IrfanView
2007-07-03 11:48:18    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\dvdcss
2007-07-02 21:53:06    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Skype
2007-06-30 06:51:25    --------    d-----w    C:\Program Files\Lx_cats
2007-06-23 14:01:43    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Apple Computer
2007-06-23 13:21:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Google
2007-06-08 09:52:50    947,096    ----a-w    C:\WINDOWS\system32\_ISource30.dll
2007-06-07 18:50:01    4,385    ----a-w    C:\WINDOWS\mozver.dat
2007-06-04 13:18:48    9,344    ----a-w    C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02    8,320    ----a-w    C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56    6,272    ----a-w    C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-02 07:52:10    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Azureus
2007-05-31 19:46:18    71,096    ----a-w    C:\DOCUME~1\NORDEA~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-05-23 22:08:51    --------    d-----w    C:\Program Files\Nokia
2007-05-23 22:01:38    --------    d-----w    C:\DOCUME~1\NORDEA~1\APPLIC~1\Nokia
2007-05-20 14:00:43    --------    d-----w    C:\Program Files\LimeWire
2007-05-17 19:18:57    --------    d-----w    C:\Program Files\QuickTime
2007-05-16 15:12:02    683,520    ----a-w    C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15    144,896    ----a-w    C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23    2,854,400    ----a-w    C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36    33,624    ----a-w    C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54    1,710,936    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48    549,720    ----a-w    C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42    325,976    ----a-w    C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36    203,096    ----a-w    C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28    92,504    ----a-w    C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20    53,080    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20    43,352    ----a-w    C:\WINDOWS\system32\wups2.dll
2007-04-13 13:19:52    7,680    ----a-w    C:\WINDOWS\system32\lsdelete.exe


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16    59032    --a------    C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43    501400    --a------    C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 C:\WINDOWS\system32\bthprops.cpl]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-20 01:38]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-20 01:38]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-20 01:38]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-20 01:38]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-25 21:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 14:17]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 14:16]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" []
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 11:57]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 13:39]
"PDFCreatorClient"="C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe" [2003-08-08 18:30]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 22:00]
"TP4EX"="tp4ex.exe" [2005-10-17 01:11 C:\WINDOWS\system32\TP4EX.exe]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 16:08]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-09-13 02:23]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 C:\WINDOWS\system32\tweakui.cpl]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 C:\WINDOWS\KHALMNPR.Exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"THGuard"="C:\Program Files\TrojanHunter 4.7\THGuard.exe" [2007-06-23 00:19]
"spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-06-08 11:52]
"@"="" []
"NPDTRAY"="C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe" [2006-07-21 02:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"TPKMAPMN"="C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe" []
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2003-09-01 20:52]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Documents and Settings\Nordea-Elev\Desktop\DSC00240.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
C:\Program Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    BthServ


Contents of the 'Scheduled Tasks' folder
2007-05-17 09:43:00  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-10 20:26:20  C:\WINDOWS\tasks\User_Feed_Synchronization-{F21A76AE-4D89-4A84-926B-625F4E085A11}.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 22:28:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-10 22:29:27
C:\ComboFix-quarantined-files.txt ... 2007-07-10 22:29
C:\ComboFix2.txt ... 2007-07-10 07:20

    --- E O F ---

Og her er hijackthis logfilen:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:21, on 10-07-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PDFCreatorMessages.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\Logi_MwX.Exe
C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.180.2:8081
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PDFCreatorClient] C:\Program Files\JawsSystems\Jaws PDF Creator\PDFClient.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe"
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [NPDTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cordless DUALphone opstart.lnk = C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\PkgMgr.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.windowsvistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121437881581
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd - C:\WINDOWS\system32\PDFCreatorMessages.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe (file missing)
O24 - Desktop Component 0: (no name) - C:\Documents and Settings\Nordea-Elev\Desktop\DSC00240.jpg

--
End of file - 10397 bytes

ps: Hvad betød dette ? "Det ser ud til at Combofix fik taget godt fat"

Godt fat = slettet alt for meget?

Godt fat = Min maskine begynder så småt at se lidt spyware/trojan fri ud?

Venlig hilsen en urolig (og meget taknemmelig)

Mads

Det var godt på den "gode" måde ;-) Nu tror jeg nemlig efterhånden at du er ved at være i bund.

Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Genstart så computeren, og lav en ny log med Hijackthis, hvor du checker at ovennævnte linie er forsvundet. Hvis den er det, er der ikke mere at komme efter i dine logs.

Kører computeren tilfredsstillende nu?

For at gøre arbejdet helt færdig:
Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så kan det også være en god ide at skjule dine systemfiler og -mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Det kan også være en god ide at få renset ud i dine midlertidige filer. Det kan gøres på en hurtig og nem måde med denne fil
www.spywareinfo.dk/download/cleantempxp2k.bat
---------------------------

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Du finder links og gode råd her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg vil også foreslå, at du læser disse artikler om hvordan du kan undgå at blive inficeret i fremtiden:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://www.ejvindh.net/viewtopic.php?t=37

Hej Ejvind
Nu har jeg gjort som du instruerede i og linien er væk iflg. hijackthis.

Jeg føler nu er computeren er fuldstændig ren og at jeg med sikkerhed kan tilslutte min eksterne harddisk igen og ta en backup af de vigtigste ting.

Derefter tror jeg at jeg vil lave en formatering af computeren - både fordi det gør jeg gerne 1 gang om året - men også for at være 112% sikker.

Når jeg fremover bruger min Windows bærbar vil jeg helt sikkert sikre den bedre. Jeg har de senere par aftener læst utrolig meget inde på de danske spywarefri/info-sider og blevet meget klogere. Jeg ved ihvertfal hvilken "pakkeløsning" som fremover er at finde på min maskine. Sådan en skide trojan er sgu svær at slippe af med!!

Tusind tusin tak for din hjælp og din tid!

Hvis du vil være så venlig at sende en mail til mads.staun snabela tdcadsl.dk om hvortil jeg må sende en lille "tak for hjælpen dusør" så tror jeg faktisk jeg kan lukke denne tråd.

Endnu engang mange tak.

mstaun

ps: Da der kan være andre der lurer med på denne tråd og nu tænker "Jeg sender sgu da bare en mail til mstaun og så sender han mig "dusøren" i stedet for til ejvindh.
Think again!

@mstaun: Dejligt at du har fået en bedre computer. Du har ret i, at du er mere sikker, hvis du formaterer den. Jeg vil nu dog også tro, at det kunne du rolig have gjort imens du var inficeret, men det er jo op til dig :-) Det er i hvert fald dejligt at høre, at du har lært noget af sagen. Det ser vi desværre alt for sjældent (folk tror at de bare kan blive ved med at rense, hver gang de bliver inficerede...)

Angående den kontante dusør: Så er det en pæn tanke af dig. Men jeg har en fin løn andetsteds fra, så det er ikke nødvendigt. Det er rigelig med løn, at du vender tilbage med en "Tak for hjælpen". Det er vi heller ikke så forvænte med :-)

Hvis du vil lukke tråden, kan det ske ved at du ude til venstre markerer mit navn i feltet ud for "Accepter", og herefter klikker på "Accepter".