Nu har jeg fulgt anvisningerne i jeres artikel 1123, og det var da en ordentlig smøre,
her kommer logfilerne
Hi Jack this
Logfile of HijackThis v1.99.1
Scan saved at 21:03:52, on 11-09-2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\IreIKE.exe
C:\Programmer\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Eset\nod32krn.exe
C:\Programmer\Eset\nod32kui.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Launch Manager\CtrlVol.exe
C:\Programmer\Launch Manager\Wbutton.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Brother\ControlCenter3\brccMCtl.exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Brother\Brmfcmon\BrMfcmon.exe
C:\Programmer\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Administrator\Skrivebord\virus\alternativ.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.ni.dk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\DOCUME~1\ADMINI~1\LOKALE~1\Temp\se.dll/spage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "C:\Programmer\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SpyAxe] C:\Programmer\SpyAxe\spyaxe.exe /h
O4 - HKLM\..\Run: [LaunchAp] C:\Programmer\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Programmer\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Programmer\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Programmer\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\RunServices: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [updateMgr] C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Acrobat Hurtigstart.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ZyWALL VPN Client.lnk = C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&ksporter til Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Konverter hyperlinkdestination til Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter hyperlinkdestination til eksisterende PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter markering til Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter markering til eksisterende PDF-fil -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter til Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter til eksisterende PDF-fil -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter valgte hyperlinks til Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Konverter valgte hyperlinks til eksisterende PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Opret Foretrukken på mobil enhed - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på mobil enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O15 - Trusted Zone:
http://www.fujitsu-siemens.comO15 - Trusted Zone:
http://www.vestjyskbank.dkO15 - Trusted Zone:
http://www.vuc-hls.dkO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {AE3D645F-1764-4942-8980-1B719C497E17} - (no file)
O18 - Filter: text/plain - {AE3D645F-1764-4942-8980-1B719C497E17} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\System32\systems.txt
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Programmer\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Programmer\ZyXEL\ZyWALL VPN Client\IreIKE.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmer\Eset\nod32krn.exe
O23 - Service: Odyssey Client (odClientService) - Funk Software, Inc. - C:\Programmer\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Root log
********************************* ROOTCHK-(22-08-07)-LOG, by ejvindh
11-09-2007 21:10:23,06
The rootkits that are detected by this tool were not found.
********************************* ROOTCHK-LOG-end
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2007-09-11 21:10:25
Windows 5.1.2600 Service Pack 1
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
hidden processes: 0
hidden files: 0
Super Anti spyware
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 09/11/2007 at 08:54 PM
Application Version : 3.7.1018
Core Rules Database Version : 3303
Trace Rules Database Version: 1309
Scan type : Complete Scan
Total Scan Time : 01:14:01
Memory items scanned : 444
Memory threats detected : 0
Registry items scanned : 5196
Registry threats detected : 164
File items scanned : 39098
File threats detected : 18
Trojan.Net-AVP/AVT
[WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
C:\WINDOWS\SYSTEM32\WINAVXX.EXE
[WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
[WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
[WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\MENUEN START\PROGRAMMER\START\SYSTEM.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\MENUEN START\PROGRAMMER\START\AUTORUN.EXE
C:\WINDOWS\SYSTEM32\PRINTER.EXE
C:\WINDOWS\Prefetch\AUTORUN.EXE-1CCF59D2.pf
C:\WINDOWS\Prefetch\PRINTER.EXE-0E099EB1.pf
C:\WINDOWS\Prefetch\SYSTEM.EXE-027C1D18.pf
C:\WINDOWS\Prefetch\WINAVXX.EXE-050EF48B.pf
Trojan.Net-VTROLL
HKLM\Software\Classes\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32#ThreadingModel
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32#Enable Browser Extensions
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\ProgID
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\Programmable
HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID
C:\WINDOWS\SYSTEM32\VTR.DLL
Adware.ZToolbar
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{a19ef336-01d4-48e6-926a-fe7e1c747aed}
HKLM\Software\AZESearchCo
HKLM\Software\AZESearchCo\AZESearch
HKLM\Software\AZESearchCo\AZESearch#GUID
HKLM\Software\AZESearchCo\AZESearch#UninstallString
HKLM\Software\AZESearchCo\AZESearch#DateTimeHigh
HKLM\Software\AZESearchCo\AZESearch#DateTimeLow
HKLM\Software\AZESearchCo\AZESearch#xml_file
HKLM\Software\AZESearchCo\AZESearch#UPDATE_EVERY
HKLM\Software\AZESearchCo\AZESearch\popup
HKLM\Software\AZESearchCo\AZESearch\popup#1041_300
HKLM\Software\AZESearchCo\AZESearch\times
HKLM\Software\AZESearchCo\AZESearch\times#1041_300High
HKLM\Software\AZESearchCo\AZESearch\times#1041_300Low
HKLM\Software\LoaderCo
HKLM\Software\LoaderCo\Loader
HKLM\Software\LoaderCo\Loader#DateTimeHigh
HKLM\Software\LoaderCo\Loader#DateTimeLow
HKCR\AddressBar.Loader
HKCR\AddressBar.Loader\CLSID
HKCR\AddressBar.Loader\CurVer
HKCR\AddressBar.Loader.1
HKCR\AddressBar.Loader.1\CLSID
HKCR\ZToolbar.activator
HKCR\ZToolbar.activator\CLSID
HKCR\ZToolbar.activator\CurVer
HKCR\ZToolbar.activator.1
HKCR\ZToolbar.activator.1\CLSID
HKCR\ZToolbar.ParamWr
HKCR\ZToolbar.ParamWr\CLSID
HKCR\ZToolbar.ParamWr\CurVer
HKCR\ZToolbar.ParamWr.1
HKCR\ZToolbar.ParamWr.1\CLSID
HKCR\ZToolbar.StockBar
HKCR\ZToolbar.StockBar\CLSID
HKCR\ZToolbar.StockBar\CurVer
HKCR\ZToolbar.StockBar.1
HKCR\ZToolbar.StockBar.1\CLSID
HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}
HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\ProxyStubClsid
HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\ProxyStubClsid32
HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\TypeLib
HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\TypeLib#Version
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\0
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\0\win32
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\FLAGS
HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\HELPDIR
HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}
HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\ProxyStubClsid
HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\ProxyStubClsid32
HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\TypeLib
HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\TypeLib#Version
HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}
HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\ProxyStubClsid
HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\ProxyStubClsid32
HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\TypeLib
HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\TypeLib#Version
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\0
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\0\win32
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\FLAGS
HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\HELPDIR
HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}
HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\ProxyStubClsid
HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\ProxyStubClsid32
HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\TypeLib
HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\TypeLib#Version
Adware.IST/SideFind
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7}
HKCR\SideFind.Finder
HKCR\SideFind.Finder\CLSID
HKCR\SideFind.Finder\CurVer
HKCR\SideFind.Finder.1
HKCR\SideFind.Finder.1\CLSID
HKLM\Software\SideFind
HKLM\Software\SideFind#account_id
HKLM\Software\SideFind#PathBHO
HKLM\Software\SideFind#PathDLL
HKLM\Software\SideFind#PathXML
HKLM\Software\SideFind#PathEXE
HKLM\Software\SideFind#InstallDate
HKLM\Software\SideFind#SearchSite
HKLM\Software\SideFind#update
HKLM\Software\SideFind#ver
HKLM\Software\SideFind#IntervalBetweenShows
HKLM\Software\SideFind#show
HKLM\Software\SideFind#NextShow
HKLM\Software\SideFind\History
HKLM\Software\SideFind\History#0
HKLM\Software\SideFind\History#1
HKLM\Software\SideFind\History#2
HKLM\Software\SideFind\History#3
Browser Hijacker.Internet Explorer Zone Hijack
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny#http
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny#https
Adware.IST/ISTBar (Slotch Bar)
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\IST
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Internet Explorer\Main#BandRest [ Never ]
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main#BandRest [ Never ]
Trojan.MalwareWipe
HKCR\AppId\{70F17C8C-1744-41B6-9D07-575DB448DCC5}
Adware.Avenue Media/Internet Optimizer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout#Comment
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout#DComment
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt
HKU\S-1-5-21-1060284298-1957994488-2147030931-500\SOFTWARE\Policies\Avenue Media
HKLM\SOFTWARE\Policies\Avenue Media
Trojan.Painter
HKCR\winapi32.MyBHO
HKCR\winapi32.MyBHO\Clsid
Parasite.SpyAxe
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\crzccxaRiXvC
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\FFMnkXvZx
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\FkiEfrdycdpm
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\InprocServer32
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\InprocServer32#ThreadingModel
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\JzWHdoXXxLldZ
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\maqeqyme
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\nSzXhX
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\QarvUwzYSnjN
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\sfvMTbdXh
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\sqljj
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\uhgrktdo
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\utFll
HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\yhMuF
HKCR\AppId\SpyAxe.EXE
HKCR\AppId\SpyAxe.EXE#AppID
Adware.Admess
HKCR\AppId\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
HKCR\AppId\WStart.DLL
HKCR\AppId\WStart.DLL#WStart
HKLM\Software\WSoft
HKLM\Software\WSoft#WSoft
Adware.Media Access
HKLM\Software\Media Access
Trojan.Homepage/Puper
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#wininet.dll [ mscornet.exe ]
Malware.AntiVirusGolden
HKCR\Engine.IgnoreList
HKCR\Engine.IgnoreList\CLSID
HKCR\Engine.IgnoreList\CurVer
HKCR\Engine.IgnoreList.1
HKCR\Engine.IgnoreList.1\CLSID
HKCR\Engine.Threat
HKCR\Engine.Threat\CLSID
HKCR\Engine.Threat\CurVer
HKCR\Engine.Threat.1
HKCR\Engine.Threat.1\CLSID
Trojan.RUNSRV32/System
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#Adware.Srv32 [ C:\WINDOWS\System32\runsrv32.exe ]
Trojan.SUSP/Transponder
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#Transponder [ C:\WINDOWS\System32\susp.exe ]
Trojan.Aff-YourThumbs
C:\PROGRAMMER\MICROSOFT SECURITY ADVISER\MSSADV.EXE
C:\WINDOWS\MSSADV.DLL
Trojan.Downloader-Gen/NoMultiTask
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E67A982B-4B8F-4E0D-A9FD-AB32A7E6466D}\RP549\A0081339.DLL
Adware.TrustInCash
C:\WINDOWS\CASINO.ICO
Adware.Unknown Origin
C:\WINDOWS\SHOPPING.ICO
Adware.CashDeluxe
C:\WINDOWS\SYSTEM32\SHELLGUI32.DLL
Trojan.Downloader-Gen/Win
C:\WINDOWS\SYSTEM32\SVCP.CSV
Trojan.Downloader-Gen
C:\WINDOWS\SYSTEM32\WINSUB.XML
Trojan.TaskDir
C:\WINDOWS\SYSTEM32\ZLBW.DLL
Combi FIX
ComboFix 07-09-10.6 - "Administrator" 2007-09-11 21:18:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1030.18.613 [GMT 2:00]
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Programmer\Microsoft Security Adviser
C:\WINDOWS\alexaie.dll
C:\WINDOWS\alxie328.dll
C:\WINDOWS\alxtb1.dll
C:\WINDOWS\system32\_003952_.tmp.dll
C:\WINDOWS\system32\_003955_.tmp.dll
C:\WINDOWS\system32\_003958_.tmp.dll
C:\WINDOWS\system32\_003986_.tmp.dll
C:\WINDOWS\system32\_003989_.tmp.dll
C:\WINDOWS\system32\_003992_.tmp.dll
C:\WINDOWS\system32\_004124_.tmp.dll
C:\WINDOWS\system32\_004125_.tmp.dll
C:\WINDOWS\system32\_004126_.tmp.dll
C:\WINDOWS\system32\_004127_.tmp.dll
C:\WINDOWS\system32\_004134_.tmp.dll
C:\WINDOWS\system32\_004135_.tmp.dll
C:\WINDOWS\system32\_004136_.tmp.dll
C:\WINDOWS\system32\_004137_.tmp.dll
C:\WINDOWS\system32\_004139_.tmp.dll
C:\WINDOWS\system32\_004140_.tmp.dll
C:\WINDOWS\system32\_004143_.tmp.dll
C:\WINDOWS\system32\_004144_.tmp.dll
C:\WINDOWS\system32\_004146_.tmp.dll
C:\WINDOWS\system32\_004147_.tmp.dll
C:\WINDOWS\system32\_004148_.tmp.dll
C:\WINDOWS\system32\_004150_.tmp.dll
C:\WINDOWS\system32\_004151_.tmp.dll
C:\WINDOWS\system32\_004153_.tmp.dll
C:\WINDOWS\system32\_004157_.tmp.dll
C:\WINDOWS\system32\_004158_.tmp.dll
C:\WINDOWS\system32\_004159_.tmp.dll
C:\WINDOWS\system32\_004160_.tmp.dll
C:\WINDOWS\system32\_004161_.tmp.dll
C:\WINDOWS\system32\_004168_.tmp.dll
C:\WINDOWS\system32\_004169_.tmp.dll
C:\WINDOWS\system32\_004170_.tmp.dll
C:\WINDOWS\system32\_004172_.tmp.dll
C:\WINDOWS\system32\_004173_.tmp.dll
C:\WINDOWS\system32\_004176_.tmp.dll
C:\WINDOWS\system32\_004177_.tmp.dll
C:\WINDOWS\system32\_004179_.tmp.dll
C:\WINDOWS\system32\_004180_.tmp.dll
C:\WINDOWS\system32\_004181_.tmp.dll
C:\WINDOWS\system32\_004183_.tmp.dll
C:\WINDOWS\system32\_004184_.tmp.dll
C:\WINDOWS\system32\_004186_.tmp.dll
C:\WINDOWS\system32\_004190_.tmp.dll
C:\WINDOWS\system32\_004191_.tmp.dll
C:\WINDOWS\system32\_004193_.tmp.dll
C:\WINDOWS\system32\_004194_.tmp.dll
C:\WINDOWS\system32\_004196_.tmp.dll
C:\WINDOWS\system32\_004198_.tmp.dll
C:\WINDOWS\system32\_004199_.tmp.dll
C:\WINDOWS\system32\_004200_.tmp.dll
C:\WINDOWS\system32\_004201_.tmp.dll
C:\WINDOWS\system32\_004204_.tmp.dll
C:\WINDOWS\system32\_004205_.tmp.dll
C:\WINDOWS\system32\_004206_.tmp.dll
C:\WINDOWS\system32\_004207_.tmp.dll
C:\WINDOWS\system32\_004208_.tmp.dll
C:\WINDOWS\system32\_004212_.tmp.dll
((((((((((((((((((((((((( Files Created from 2007-08-11 to 2007-09-11 )))))))))))))))))))))))))))))))
.
2007-09-11 21:16 51,200 --a--c--- C:\WINDOWS\NirCmd.exe
2007-09-11 19:27 <DIR> d----c--- C:\Programmer\SUPERAntiSpyware
2007-09-11 19:27 <DIR> d----c--- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-11 19:27 <DIR> d----c--- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-11 19:23 <DIR> d----c--- C:\Programmer\CCleaner
2007-08-27 22:05 79,360 --a--c--- C:\WINDOWS\system32\dpwsockx.dll
2007-08-27 22:05 79,360 --a--c--- C:\WINDOWS\system32\dllcache\dpwsockx.dll
2007-08-27 22:05 292,864 --a--c--- C:\WINDOWS\system32\dllcache\ddraw.dll
2007-08-27 22:05 292,864 --a--c--- C:\WINDOWS\system32\ddraw.dll
2007-08-27 22:05 230,400 --a--c--- C:\WINDOWS\system32\dplayx.dll
2007-08-27 22:05 230,400 --a--c--- C:\WINDOWS\system32\dllcache\dplayx.dll
2007-08-27 20:31 <DIR> d----c--- C:\DOCUME~1\ADMINI~1\APPLIC~1\Joost
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-04 20:26 --------- d----c--- C:\DOCUME~1\ADMINI~1\APPLIC~1\MSN6
2007-08-01 20:33 --------- d----c--- C:\Programmer\easytemplates
--------- C:\Programmer\Fælles filer\Wise Installation Wizard
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Programmer\Eset\nod32kui.exe" [2007-03-18 19:21]
"SpyAxe"="C:\Programmer\SpyAxe\spyaxe.exe" []
"LaunchAp"="C:\Programmer\Launch Manager\LaunchAp.exe" [2002-12-02 11:22]
"HotkeyApp"="C:\Programmer\Launch Manager\HotkeyApp.exe" [2003-01-09 11:41]
"CtrlVol"="C:\Programmer\Launch Manager\CtrlVol.exe" [2002-10-23 18:18]
"Wbutton"="C:\Programmer\Launch Manager\Wbutton.exe" [2003-01-09 10:57]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 11:59 C:\WINDOWS\AGRSMMSG.exe]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2003-04-24 16:51]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2003-04-24 16:44]
"Microsoft Internel Corporat "="smbvhost.exe" []
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2005-06-05 14:38]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Acrobat Assistant 7.0"="C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 03:12]
"FixCamera"="C:\WINDOWS\FixCamera.exe" [2006-06-01 12:26]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2006-05-22 11:37]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-07-10 10:33]
"SSBkgdUpdate"="C:\Programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" []
"PaperPort PTD"="C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-18 17:11]
"IndexSearch"="C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-18 17:22]
"BrMfcWnd"="C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 16:48]
"SetDefPrt"="C:\Programmer\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 19:02]
"ControlCenter3"="C:\Programmer\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 15:58]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Programmer\Messenger\msmsgs.exe" [2004-11-15 17:18]
"MsnMsgr"="C:\Programmer\MSN Messenger\MsnMsgr.exe" [2005-12-14 11:02]
"H/PC Connection Agent"="C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:07]
"updateMgr"="C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Microsoft Internel Corporat "=smbvhost.exe
C:\DOCUME~1\ALLUSE~1\MENUEN~1\PROGRA~1\Start\
Adobe Acrobat Hurtigstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1030-D700-BA7E-000000000002}\SC_Acrobat.exe [2007-01-09 15:15:18]
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
ZyWALL VPN Client.lnk - C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe [2007-06-04 14:06:02]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"=1 (0x1)
"NoWindowsUpdate"=1 (0x1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli scecli
R1 Hotkey;Hotkey;C:\WINDOWS\System32\drivers\Hotkey.sys
R1 IPSECDRV;SafeNet IPSec Plugin;\??\C:\WINDOWS\System32\Drivers\IPSECDRV.sys
R1 Wbutton;Wbutton;C:\WINDOWS\System32\drivers\Wbutton.sys
R2 Crypto;Crypto;\??\C:\WINDOWS\System32\Drivers\Crypto.sys
R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\System32\DRIVERS\BrScnUsb.sys
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\System32\DRIVERS\dne2000.sys
R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\System32\DRIVERS\vap.sys
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\System32\DRIVERS\odysseyIM3.sys
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS\System32\Drivers\WBMS.SYS
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\System32\Drivers\WBSD.SYS
S2 XXSTQKMX;XXSTQKMX;\??\C:\WINDOWS\System32\xxstqkmx.bgm
S3 cwbwdm_device;Crystal WDM Audio Codec-driver;C:\WINDOWS\System32\drivers\cwbwdm.sys
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\System32\DRIVERS\snp2sxp.sys
S3 w70n51;Intel(R) PRO/Wireless 7100 Adapter - Driver;C:\WINDOWS\System32\DRIVERS\w70n51.sys
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2007-09-11 21:36:34
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-11 21:39:05 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-11 21:38
.
--- E O F ---
