Hjælp til at få fjernet spyware, browser hijacker - zlob-dnschang

(Jeg ser på den...)

Afinstaller
* BearShare
via
[Start][Indstilninger][Kontrolpanel][Tilføj/fjern programmer]

Genstart for at fuldføre afinstalationen...

---------------------------------------

Følg proceduren herfra ->
http://www.eksperten.dk/artikler/1123

NB: Bemærk at HiJackThis bør (=Skal) gemmes fra nettet i dertil beregnet mappe og køres DERFRA...

Logfile of HijackThis v1.99.1
Scan saved at 04:27:04, on 04-09-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\DOCUME~1\BJARNE~1\LOCALS~1\Temp\SSUPDATE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bjarne Buch Larsen\Desktop\spywareværktøjer\hjackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{646CFBEB-1F9F-4434-9744-75E3E9C65A85}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C8BAE8E-5217-49F6-9D17-180A95746E90}: NameServer = 85.255.115.237,85.255.112.78
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{646CFBEB-1F9F-4434-9744-75E3E9C65A85}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{646CFBEB-1F9F-4434-9744-75E3E9C65A85}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

-------------

********************************* ROOTCHK-(22-08-07)-LOG, by ejvindh
04-09-2007  4:27:51,73

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 04:27:52
Windows 5.1.2600 Service Pack 2
detected NTDLL code modification:
ZwQueryDirectoryFile
scanning hidden processes ...

detected NTDLL code modification:
ZwQueryDirectoryFile
scanning hidden services & system hive ...
disk error: C:\WINDOWS\system32\config\system

detected NTDLL code modification:
ZwQueryDirectoryFile
scanning hidden registry entries ...
disk error: C:\WINDOWS\system32\config\software
disk error: C:\Documents and Settings\Bjarne Buch Larsen\ntuser.dat

detected NTDLL code modification:
ZwQueryDirectoryFile
scanning hidden files ...

hidden processes: 0
hidden files: 0

--------------

ComboFix 07-08-30.3 - "Bjarne Buch Larsen" 2007-09-04  4:29:22.1 - FAT32x86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.46 [GMT -7:00]
* Created a new restore point


(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\kdxfq.exe


(((((((((((((((((((((((((  Files Created from 2007-08-04 to 2007-09-04  )))))))))))))))))))))))))))))))


2007-09-04 04:28    51,200    --a------    C:\WINDOWS\nircmd.exe
2007-09-04 02:27    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-04 02:26    <DIR>    d--------    C:\Program Files\SUPERAntiSpyware
2007-09-04 02:26    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2007-09-04 02:26    <DIR>    d--------    C:\DOCUME~1\BJARNE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-04 02:17    <DIR>    d--------    C:\Program Files\CCleaner
2007-09-01 05:15    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy


((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 19:19    92504    --a------    C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19    92504    --a------    C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19    549720    --a------    C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19    549720    --a------    C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19    53080    --a------    C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19    53080    --a------    C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19    43352    --a------    C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19    325976    --a------    C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19    325976    --a------    C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19    203096    --a------    C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19    203096    --a------    C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19    1712984    --a------    C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19    1712984    --a------    C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18    33624    --a------    C:\WINDOWS\system32\wups.dll
2007-07-30 19:18    33624    --a------    C:\WINDOWS\system32\dllcache\wups.dll
2007-07-28 09:28    ---------    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\e-Safekey
2007-07-02 22:50    2828    --ahs----    C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-02 16:10    88    -r-hs----    C:\WINDOWS\system32\7B7EB0D405.sys
2007-07-02 12:28    476752    --a------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\pswi_preloaded.exe
2007-06-26 08:13    851968    --a------    C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 07:09    658944    --a------    C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-25 23:08    1104896    --a------    C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08    1104896    --a------    C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31    282112    --a------    C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31    282112    --a------    C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-14 11:09    96256    --a------    C:\WINDOWS\system32\dllcache\inseng.dll
2007-06-14 11:09    615424    --a------    C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-14 11:09    55808    --a------    C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-14 11:09    532480    --a------    C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-14 11:09    474112    --a------    C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-06-14 11:09    449024    --a------    C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-14 11:09    39424    --a------    C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-06-14 11:09    357888    --a------    C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-06-14 11:09    3058688    --a------    C:\WINDOWS\system32\dllcache\mshtml.dll
2007-06-14 11:09    251392    --a------    C:\WINDOWS\system32\dllcache\iepeers.dll
2007-06-14 11:09    205312    --a------    C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-06-14 11:09    16384    --a------    C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-14 11:09    151040    --a------    C:\WINDOWS\system32\dllcache\cdfview.dll
2007-06-14 11:09    1494528    --a------    C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-06-14 11:09    146432    --a------    C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-14 11:09    1054208    --a------    C:\WINDOWS\system32\dllcache\danim.dll
2007-06-14 11:09    1023488    --a------    C:\WINDOWS\system32\dllcache\browseui.dll
2007-06-14 07:07    18432    --a------    C:\WINDOWS\system32\dllcache\iedw.exe
2007-06-13 03:23    1033216    --a------    C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 03:23    1033216    --a------    C:\WINDOWS\explorer.exe


(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Preload"="C:\Windows\RUNXMLPL.exe" [2005-05-19 17:09]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 11:12]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 11:11]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-10-26 16:18]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-10-26 16:11]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 13:36]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-06-06 11:52]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-07-25 10:45]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-07-25 13:34]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-10-31 19:05]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 09:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-09-04 04:26]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R0 viaagp;VIA AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\viaagp.sys
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys
R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\system32\drivers\epm-psd.sys
R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\system32\drivers\epm-shd.sys
R2 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
R2 osaio;osaio;\??\C:\WINDOWS\system32\drivers\osaio.sys
R2 osanbm;osanbm;\??\C:\WINDOWS\system32\drivers\osanbm.sys
R3 POWERKEY;POWERKEY;\??\C:\Program Files\Launch Manager\POWERKEY.sys
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys

*Newly Created Service* - INT15.SYS
*Newly Created Service* - SASDIFSV

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 04:33:58
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\viaagp]
"ImagePath"="system32\DRIVERS\viaagp.sys"

Completion time: 2007-09-04  4:36:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-04 04:36

    --- E O F ---
-------------
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/04/2007 at 03:28 AM

Application Version : 3.7.1018

Core Rules Database Version : 3298
Trace Rules Database Version: 1306

Scan type      : Complete Scan
Total Scan Time : 00:52:27

Memory items scanned      : 160
Memory threats detected  : 0
Registry items scanned    : 4327
Registry threats detected : 0
File items scanned        : 21586
File threats detected    : 118

Adware.Tracking Cookie
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@tipsbladet.banneradministration[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@saxobfdk.122.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@st[14].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@edge.ru4[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@4.adbrite[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@porn365[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@67.15.239[3].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@1071644049[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@poker-tracker.flopturnriver[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@4stats[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@serving-sys[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@bs.serving-sys[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@dtr[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wfkoalcpido.stats.esomniture[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cgi-bin[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ad.bolddk[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@dating.sexbuddies[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ad1.emediate[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.porn365[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@realmedia[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cz11.clickzs[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@microsoftwga.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.pokertracker[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@specificclick[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wjkygjajmgo.stats.esomniture[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adopt.euroclick[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@3.adbrite[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adopt.specificclick[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@toplist[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@enhance[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e2.emediate[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@stat.dealtime[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ads.pointroll[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@teensvideonews.octopusgalls[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@1063906128[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cgi-bin[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@wt.sexsearch[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@image.masterstats[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@1066183696[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@vip2.clickzs[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ads2.jubii[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ncom.banneradministration[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ads.adbrite[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@eas.apm.emediate[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@jobzonen.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cbs.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.clickmanage[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@rb4.worldsex[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.psyporn[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.porn-reborn[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.sexy-access[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@67.15.239[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@server.iad.liveperson[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@eaccess.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wjkowpd5aap.stats.esomniture[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@realsexcash[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@stats[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@bfm.valueclick[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.sexlinien[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wfk4sncjmgp.stats.esomniture[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@metacafe.122.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@atdmt[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wgmysgd5iao.stats.esomniture[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@webpower[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@anad.tacoda[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adultadworld[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@1064234106[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@tds.teensexfans[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@hotxxxcollection[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.pornclipsclub[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@1072739759[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@2.adbrite[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adtech[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ad.iconadserver[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@4xxxtremepleasures[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@tribalfusion[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@keywordmax[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@girlwithaonetrackmind.blogspot[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.pornomoviesclips[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@partygaming.122.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cz9.clickzs[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@st[12].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wjlocgdjobp.stats.esomniture[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@valueclick[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@stepstone.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.viva-xxx[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@st1.eyestats[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@pornotube[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.sextasya[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@shopping.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@67.15.239[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@tacoda[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adbrite[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@partypoker[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cs.sexcounter[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@monstersandcritics.advertserve[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@m1.webstats.motigo[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@questionmarket[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.pornstarmoviezone[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wjlokod5obq.stats.esomniture[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@e-2dj6wjnyakd5sho.stats.esomniture[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@paypal.112.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.teeniepixxx[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@truitionnflauction.122.2o7[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cz5.clickzs[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@revsci[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@iqcounter[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@adultbouncer[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@overture[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@ad.adserverplus[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@hothotteens[2].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@atwola[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@cj[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@www.jointheporn[1].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@stats[3].txt
    C:\Documents and Settings\Bjarne Buch Larsen\Cookies\bjarne buch larsen@track.adform[1].txt

Adware.Casino Games (Golden Palace Casino)
    C:\PROGRAM FILES\EVEREST POKER\CASINO.EXE

Jooo - der blev 'fixet' et par ting - hvordan går det så nu ?

Umiddelbart kører det fint nu :) takker. Smider du et svar?
Kan jeg bare den samme procedure igennem på min anden computer og få lidt ryddet op på den også? :)

Mht. den anden putter... så opret helst en egen tråd dertil...

Du er velkommen en anden gang...

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.

Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Safe Surfing...