MSN's "Myalbum.zip"-virus..

Hvis maskinen er 5 dage gammel, ligger der så nogen data på hun skal gemme ? Hvis Nej, så vil jeg da køre en Recorvery så maskinen er som da den kom ud af pakken

leif:
hun har givet mig lov til at slette alt på den, så hvordan kører jeg lige den Recorvery?

Hvad maskine er det ?

Leif:
En Acer Aspire 3103WLMI, med Windows XP Home Edition

Uhh, kender jeg ikke proceduren på

Men hvis jeg nu smider en hijack log op, kan du så se på den?

Nope, men fulgte der ikke Recovery CD/DVD med maskinen ? (Ved ikke om Acer leverer dem eller man selv skal huske at brænde dem)

Min veninde siger at der kun fulgte 1 cd med og at den var med Norton (spørg mig ikke hvorfor hun ikke installerede det)

Men hvis jeg nu selv skal brænde den, hvor finder jeg så filerne?

Normalt følger de en stak cd'er med acer bærbare..
1 til at boote på, og så 3 sæt til at gendanne grund installationen.
Hvis hun ikke har fået dem med, så skal hun bare gå ned i butikken og forlange dem.

Imens kan du fjerne virussen...
http://www.eksperten.dk/artikler/1124

Tak for hjælpen webmasterdk (og fromsej, hvis du læser med)
Nu har jeg kørt de 2 msn-scans men de fandt intet, så jeg regner med at jeg har fået dem ned med nakken..
Jeg går igang med at køre de andre scans, fra den anden guide, nu her, og så poster jeg log'ne så snart de bliver færdige..

HiJackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 18:03:58, on 26-07-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Maria\Skrivebord\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmer\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmer\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AVP] "C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmer\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/229?69d838f7913d43618abcf7b673f09453
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/230?69d838f7913d43618abcf7b673f09453
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://newscanner.virus112.com/ols/fscax.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmer\CyberLink\Shared Files\RichVideo.exe

ComboLog:

"Maria" - 2007-07-26 18:08:16 - ComboFix 07-07-23.6 - Service Pack 2  FAT32


(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\3_exception.nls


(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC3550U
-------\LEGACY_NTMLSVC
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\asc3550u
-------\NtmlSvc
-------\runtime


(((((((((((((((((((((((((  Files Created from 2007-06-26 to 2007-07-26  )))))))))))))))))))))))))))))))


2007-07-26 18:07    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-07-26 16:19    <DIR>    d--------    C:\Programmer\CCleaner
2007-07-26 04:09    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 22:55    75,932    --a------    C:\WINDOWS\system32\drivers\klick.dat
2007-07-25 22:55    74,396    --a------    C:\WINDOWS\system32\drivers\klin.dat
2007-07-25 22:54    32    --ahs----    C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-25 22:54    32    --ahs----    C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-25 22:54    <DIR>    d--------    C:\Programmer\Kaspersky Lab
2007-07-25 22:54    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-25 22:26    <DIR>    d--------    C:\KAV
2007-07-25 03:41    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\Prevx
2007-07-25 03:40    13,824    --a------    C:\WINDOWS\system32\pxscinst.dll
2007-07-25 03:40    <DIR>    d--------    C:\Programmer\Prevx2
2007-07-25 03:40    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
2007-07-25 03:39    77,312    --a------    C:\WINDOWS\ua2.dll
2007-07-25 03:31    <DIR>    d--------    C:\Programmer\NoAdware5.0
2007-07-25 01:32    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 01:31    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2007-07-25 01:31    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\SUPERAntiSpyware.com
2007-07-24 23:51    8,704    --a------    C:\WINDOWS\system32\drivers\TVicPort64.sys
2007-07-24 23:51    8,704    --a------    C:\WINDOWS\system32\drivers\int15_64.sys
2007-07-24 23:51    69,632    --a------    C:\WINDOWS\system32\drivers\int15.sys
2007-07-24 23:51    6,144    --a------    C:\WINDOWS\system32\drivers\zntport64.sys
2007-07-24 23:51    6,080    --a------    C:\WINDOWS\system32\drivers\zntport.sys
2007-07-24 23:51    14,544    --a------    C:\WINDOWS\system32\drivers\TVicPort.sys
2007-07-24 23:34    602,112    --a------    C:\WINDOWS\system32\Acer.Empowering.Windows.Forms_v820.dll
2007-07-24 23:34    602,112    --a------    C:\WINDOWS\system32\Acer.Empowering.Windows.Forms.dll
2007-07-24 23:34    53,248    --a------    C:\WINDOWS\system32\Interop.Shell32.dll
2007-07-24 23:34    331,776    --a------    C:\WINDOWS\system32\ScrollBarLib.dll
2007-07-24 23:30    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\CyberLink
2007-07-24 22:30    <DIR>    d--------    C:\Programmer\Lavasoft
2007-07-24 22:30    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-24 21:55    <DIR>    d--------    C:\Programmer\F‘lles filer\Wise Installation Wizard
2007-07-24 21:55    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-24 21:31    786,432    --ah-----    C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-24 21:31    <DIR>    dr-------    C:\DOCUME~1\ADMINI~1\Menuen Start
2007-07-24 21:31    <DIR>    dr-------    C:\DOCUME~1\ADMINI~1\Foretrukne
2007-07-24 21:31    <DIR>    dr-------    C:\DOCUME~1\ADMINI~1\Dokumenter
2007-07-24 21:31    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Skabeloner
2007-07-24 21:31    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Printere
2007-07-24 21:31    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Lokale indstillinger
2007-07-24 21:31    <DIR>    d--h-----    C:\DOCUME~1\ADMINI~1\Andre computere
2007-07-24 21:31    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\Skrivebord
2007-07-24 21:31    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
2007-07-24 20:12    <DIR>    d--------    C:\Programmer\Norton AntiVirus
2007-07-24 20:11    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-07-24 20:10    <DIR>    d--------    C:\Programmer\F‘lles filer\Symantec Shared
2007-07-24 12:31    7,277    --a------    C:\DOCUME~1\Maria\usyoyk.exe
2007-07-24 11:36    7,277    --a------    C:\DOCUME~1\Maria\zezxnn.exe
2007-07-24 11:05    <DIR>    d--hs----    C:\FOUND.001
2007-07-24 03:55    8,192    --a------    C:\WINDOWS\system32\drivers\Changer.sys
2007-07-24 00:51    <DIR>    d--hs----    C:\FOUND.000
2007-07-22 03:02    <DIR>    d--------    C:\Programmer\MSXML 4.0
2007-07-21 03:00    <DIR>    d--------    C:\WINDOWS\system32\PreInstall
2007-07-20 16:19    271,224    --a------    C:\WINDOWS\system32\mucltui.dll
2007-07-20 16:19    208,248    --a------    C:\WINDOWS\system32\muweb.dll
2007-07-20 12:53    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\Help
2007-07-20 00:19    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\Google
2007-07-20 00:18    <DIR>    d--------    C:\Programmer\Google
2007-07-20 00:18    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-19 23:45    258,048    --a------    C:\WINDOWS\system32\Uninstall_eRecovery.exe
2007-07-19 23:45    258,048    --a------    C:\WINDOWS\system32\CheckD2DSystem.exe
2007-07-19 23:45    16,384    --a------    C:\WINDOWS\system32\ClearEvent.exe
2007-07-19 23:45    159,744    --a------    C:\WINDOWS\system32\CloseProcessWindow.dll
2007-07-19 23:45    1,168,896    --a------    C:\WINDOWS\system32\ERUpdateHidden.EXE
2007-07-19 23:44    <DIR>    d--------    C:\WINDOWS\Options
2007-07-19 23:42    <DIR>    d--------    C:\Programmer\Launch Manager
2007-07-19 23:41    94,298    --a------    C:\WINDOWS\system32\SynTPAPI.dll
2007-07-19 23:41    82,013    --a------    C:\WINDOWS\system32\SynCOM.dll
2007-07-19 23:41    81,920    --a------    C:\WINDOWS\system32\SynTPCo2.dll
2007-07-19 23:41    69,722    --a------    C:\WINDOWS\system32\SynTPFcs.dll
2007-07-19 23:41    192,672    --a------    C:\WINDOWS\system32\drivers\SynTP.sys
2007-07-19 23:41    114,688    --a------    C:\WINDOWS\system32\SynCtrl.dll
2007-07-19 23:41    <DIR>    d--------    C:\Programmer\Synaptics
2007-07-19 23:40    <DIR>    d--------    C:\WINDOWS\system32\SoftwareDistribution
2007-07-19 23:36    69,632    -ra------    C:\WINDOWS\Alcmtr.exe
2007-07-19 23:36    2,879,488    -ra------    C:\WINDOWS\SkyTel.exe
2007-07-19 23:36    135,168    --a------    C:\WINDOWS\system32\RtlCPAPI.dll
2007-07-19 23:24    2,621,440    --ah-----    C:\DOCUME~1\Maria\NTUSER.DAT
2007-07-19 23:24    <DIR>    dr-------    C:\DOCUME~1\Maria\Foretrukne
2007-07-19 23:24    <DIR>    dr-------    C:\DOCUME~1\Maria\Dokumenter
2007-07-19 23:24    <DIR>    d--h-----    C:\DOCUME~1\Maria\Skabeloner
2007-07-19 23:24    <DIR>    d--h-----    C:\DOCUME~1\Maria\Printere
2007-07-19 23:24    <DIR>    d--h-----    C:\DOCUME~1\Maria\Lokale indstillinger
2007-07-19 23:24    <DIR>    d--h-----    C:\DOCUME~1\Maria\Andre computere
2007-07-19 23:24    <DIR>    d--------    C:\WINDOWS\Acer
2007-07-19 23:24    <DIR>    d--------    C:\DOCUME~1\Maria\Skrivebord
2007-07-19 23:24    <DIR>    d--------    C:\DOCUME~1\Maria\Menuen Start
2007-07-19 23:24    <DIR>    d--------    C:\DOCUME~1\Maria\APPLIC~1\ATI
2007-07-19 23:23    262,144    --a------    C:\DOCUME~1\ALLUSE~1\NTUSER.DAT
2007-07-19 23:23    <DIR>    d--------    C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
2007-07-19 23:20    85,376    --a------    C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-07-19 23:20    5,504    --a------    C:\WINDOWS\system32\drivers\MSTEE.sys
2007-07-19 23:20    19,328    --a------    C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-07-19 23:20    17,024    --a------    C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-07-19 23:20    15,360    --a------    C:\WINDOWS\system32\drivers\StreamIP.sys
2007-07-19 23:20    11,136    --a------    C:\WINDOWS\system32\drivers\SLIP.sys
2007-07-19 23:20    10,880    --a------    C:\WINDOWS\system32\drivers\NdisIP.sys
2007-07-19 23:19    54,272    --a------    C:\WINDOWS\system32\vfwwdm32.dll
2007-07-19 23:19    <DIR>    d--------    C:\WINDOWS\BisonCam


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 16:21:30    32    --sha-w    C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-26 16:21:30    32    --sha-w    C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-24 19:56:00    --------    d-----w    C:\Programmer\Fælles filer\Wise Installation Wizard
2007-07-24 18:10:58    --------    d-----w    C:\Programmer\Fælles filer\Symantec Shared
2007-07-19 21:18:44    903    ----a-r    C:\WINDOWS\HotFix.bat
2007-07-19 21:18:42    948    ----a-r    C:\WINDOWS\CLEANUP.CMD
2007-07-19 16:27:10    74,492    ----a-r    C:\WINDOWS\system32\perfc006.dat
2007-07-19 16:27:10    416,886    ----a-r    C:\WINDOWS\system32\perfh006.dat
2007-06-04 13:18:48    9,344    ----a-w    C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02    8,320    ----a-w    C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56    6,272    ----a-w    C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-16 15:14:26    683,520    ----a-w    C:\WINDOWS\system32\inetcomm.dll


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"AzMixerSel"="C:\Programmer\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [2006-04-27 12:10]
"ATICCC"="C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 03:43 C:\WINDOWS\Alcmtr.exe]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"PrevxOne"="C:\Programmer\Prevx2\PXConsole.exe" [2007-07-10 07:42]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40]
"AVP"="C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-03-09 19:50]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 05:00]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-07-24 23:34:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoDesktop"=0 (0x0)
"NoControlPanel"=0 (0x0)
"NoClose"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"HideClock"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

R0 agpCPQ;Compaq AGP-busfilter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R0 viaagp;VIA AGP-busfilter;C:\WINDOWS\system32\DRIVERS\viaagp.sys
R1 AmdK8;Driver til AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Programmer\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Programmer\SUPERAntiSpyware\SASKUTIL.sys
R1 WmiAcpi;Microsoft Windows Management-gr‘nseflade til ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R2 DritekPortIO;Dritek General Port I/O;\??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys
R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers\tvicport.sys
R2 zntport;zntport;\??\C:\WINDOWS\system32\drivers\zntport.sys
R3 Cam5603D;Acer OrbiCam;C:\WINDOWS\system32\Drivers\BisonCam.sys
R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 HSF_DPV;HSF_DPV;C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
R3 HSFHWAZL;HSFHWAZL;C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
R3 SASENUM;SASENUM;\??\C:\Programmer\SUPERAntiSpyware\SASENUM.SYS
R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
R3 usbehci;Miniportdriver til Microsoft USB 2.0-udvidet v‘rtscontroller;C:\WINDOWS\system32\DRIVERS\usbehci.sys
R3 usbhub;USB2-aktiveret hub;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbohci;Miniportdriver til Microsoft USB-†ben v‘rtscontroller;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S2 crvdll;Windows Messanager;C:\WINDOWS\System32\svchost.exe -k netsvcs
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\C:\WINDOWS\system32\eLock2FSCTLDriver.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 HSXHWAZL;HSXHWAZL;C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys
S3 irsir;Microsoft seriel infrar›d driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 TSP;TSP;\??\C:\WINDOWS\system32\drivers\klif.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost  - netsvcs
crvdll


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-26 18:22:21
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aawservice]
"ImagePath"="\"C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\viaagp]
"ImagePath"="system32\DRIVERS\viaagp.sys"

Completion time: 2007-07-26 18:27:10 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-26 18:27

    --- E O F ---

Root Log:

********************************* ROOTCHK-(21-07-07)-LOG, by ejvindh
26-07-2007 18:06:02,03

Driver asc3550u (visible) is present. Run COMBOFIX by sUBs.
Driver NtmlSvc (visible) is present. Run COMBOFIX BY sUBs.
Driver Runtime (visible) is present. Run COMBOFIX by sUBs or SDFIX by AndyManchesta.

********************************* ROOTCHK-LOG-end


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-26 18:06:03
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...
disk error: C:\WINDOWS\system32\config\system

scanning hidden registry entries ...
disk error: C:\WINDOWS\system32\config\software
disk error: C:\Documents and Settings\Maria\ntuser.dat

scanning hidden files ...

hidden processes: 0
hidden files: 0

SUPERAntiSpyware Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/25/2007 at 02:03 AM

Application Version : 3.9.1008

Core Rules Database Version : 3273
Trace Rules Database Version: 1284

Scan type      : Complete Scan
Total Scan Time : 00:29:43

Memory items scanned      : 589
Memory threats detected  : 0
Registry items scanned    : 4834
Registry threats detected : 0
File items scanned        : 31688
File threats detected    : 14

Adware.Tracking Cookie
    C:\Documents and Settings\Maria\Cookies\maria@atdmt[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@eas.apm.emediate[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@track.adform[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@adtech[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@msnportal.112.2o7[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@ilead.itrack[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@ncom.banneradministration[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@stat.postdanmark[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@adfair[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@e2.emediate[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@cgi-bin[2].txt
    C:\Documents and Settings\Maria\Cookies\maria@adfarm1.adition[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Maria\Cookies\maria@2o7[2].txt

Ikke installeret Norton, der er Kaspersky på!
Det vil jo svare til at udskifte en Ferrari med en Trabant, at bytte Kaspersky ud med Norton.
Men det ser ud til at Combofix har gjort det meste af arbejdet.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret (tryk på <F8> under opstarten), slet filer og mapper listet nedenunder.

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

---------------------------------------
Sletning af \mapper\ og filer:
Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
-------------------
Mapper:
Ingen
-------------------
Filer:
C:\Documents and Settings\Maria\usyoyk.exe
C:\Documents and Settings\Maria\zezxnn.exe

---------------------------------------
Genstart normalt og kom med en frisk hijackthislog.

fromsej:
Jeg slettede faktisk Norton 2006 for at installere AntiVir, men slettede så det igen, for at smide trial-versionen af Kaspersky derind, fordi at jeg ved at det plejer at være god i sådanne situationer :)

Jeg slettede det du bad mig om i hijackthis, men kunne ikke finde denne:

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

Jeg satser på at en af mine mange scans har fjernet den..

Ny log!

Logfile of HijackThis v1.99.1
Scan saved at 20:41:51, on 29-07-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmer\Prevx2\PXConsole.exe
C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Documents and Settings\Maria\Skrivebord\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmer\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmer\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [AVP] "C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmer\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Åbn på ny baggrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/229?69d838f7913d43618abcf7b673f09453
O8 - Extra context menu item: Åbn på ny forgrundsfane - res://C:\Programmer\Windows Live Toolbar\Components\da-dk\msntabres.dll.mui/230?69d838f7913d43618abcf7b673f09453
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://newscanner.virus112.com/ols/fscax.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmer\CyberLink\Shared Files\RichVideo.exe

Loggen er ren.

Tjek i manualen, om i selv skal lave en recoveryDVD eller CDér.
Det har jeg heller ikke styr på, jeg vil hellere flække en arm på langs end købe noget med Recovery i stedet for fuldversioner. ;-)

Det skal jeg nok, når jeg når så langt :)..

Men ellers 1000 tak for hjælpen Fromsej.. Du har reddet mit venskab med hende :b

Men hov.. Hvorfor vil du have at jeg skal lave et recovery, hvis loggen er ren? :s

Tak for point.*S*

Fordi så har du den til en anden gang, der kan jo ske det uheldige at maskinen går uigenkaldeligt ned, derfor er det rart at have recoveryen.
Samt altid sørge for at have sine vigtige ting gemt på et andet medie også, dokumenter, skoleopgaver(hvis det er et emne), billeder osv.

Aaahh, okays.. Troede at det var fordi at der stadig var probs med computeren :)
Men der er én ting der irriterer mig.. Den er stadig super langsom under opstart af Windows.. altså efter jeg er logget på, tager den over 1 min. om at vise ikonerne på skrivebordet..

Prøv dette:
Klik på Start->Kør skriv SFC /scannow (bemærk mellemrum), klik OK.
Din XP-CD skal sidde i drevet.
Genstart, se om det hjalp.