Printer.exe har jeg en virus og hvem kan fjerne den.

Følg denne artikel:
http://www.eksperten.dk/artikler/1123

Der skal nok den 'store' pakke til ->
http://www.eksperten.dk/artikler/1123
Følg proceduren ...

OK - <Fromsej> kom 'først' *S* ...

Du eller en anden følger bare op, jeg får ikke meget onlinetid de næste dage.

Nu har jeg fulgt anvisningerne i jeres artikel 1123, og det var da en ordentlig smøre,
her kommer logfilerne

Hi Jack this
Logfile of HijackThis v1.99.1
Scan saved at 21:03:52, on 11-09-2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\IreIKE.exe
C:\Programmer\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Eset\nod32krn.exe
C:\Programmer\Eset\nod32kui.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Launch Manager\CtrlVol.exe
C:\Programmer\Launch Manager\Wbutton.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\tsnp2std.exe
C:\WINDOWS\vsnp2std.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Brother\ControlCenter3\brccMCtl.exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Brother\Brmfcmon\BrMfcmon.exe
C:\Programmer\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Administrator\Skrivebord\virus\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOKALE~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "C:\Programmer\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SpyAxe] C:\Programmer\SpyAxe\spyaxe.exe /h
O4 - HKLM\..\Run: [LaunchAp] C:\Programmer\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Programmer\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Programmer\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Programmer\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\RunServices: [Microsoft Internel Corporat ] smbvhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [updateMgr] C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Acrobat Hurtigstart.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ZyWALL VPN Client.lnk = C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Konverter hyperlinkdestination til Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter hyperlinkdestination til eksisterende PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter markering til Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter markering til eksisterende PDF-fil - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter til Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Konverter til eksisterende PDF-fil - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Konverter valgte hyperlinks til Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Konverter valgte hyperlinks til eksisterende PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Opret Foretrukken på mobil enhed - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på mobil enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://www.fujitsu-siemens.com
O15 - Trusted Zone: http://www.vestjyskbank.dk
O15 - Trusted Zone: http://www.vuc-hls.dk
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {AE3D645F-1764-4942-8980-1B719C497E17} - (no file)
O18 - Filter: text/plain - {AE3D645F-1764-4942-8980-1B719C497E17} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\System32\systems.txt
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Programmer\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Programmer\ZyXEL\ZyWALL VPN Client\IreIKE.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Programmer\Eset\nod32krn.exe
O23 - Service: Odyssey Client (odClientService) - Funk Software, Inc. - C:\Programmer\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Root log

********************************* ROOTCHK-(22-08-07)-LOG, by ejvindh
11-09-2007 21:10:23,06

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-11 21:10:25
Windows 5.1.2600 Service Pack 1
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden files: 0

Super Anti spyware

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/11/2007 at 08:54 PM

Application Version : 3.7.1018

Core Rules Database Version : 3303
Trace Rules Database Version: 1309

Scan type      : Complete Scan
Total Scan Time : 01:14:01

Memory items scanned      : 444
Memory threats detected  : 0
Registry items scanned    : 5196
Registry threats detected : 164
File items scanned        : 39098
File threats detected    : 18

Trojan.Net-AVP/AVT
    [WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
    C:\WINDOWS\SYSTEM32\WINAVXX.EXE
    [WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
    [WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
    [WinAVX] C:\WINDOWS\SYSTEM32\WINAVXX.EXE
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
    HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run#WinAVX [ C:\WINDOWS\System32\WinAvXX.exe ]
    C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\MENUEN START\PROGRAMMER\START\SYSTEM.EXE
    C:\DOCUMENTS AND SETTINGS\ALL USERS\MENUEN START\PROGRAMMER\START\AUTORUN.EXE
    C:\WINDOWS\SYSTEM32\PRINTER.EXE
    C:\WINDOWS\Prefetch\AUTORUN.EXE-1CCF59D2.pf
    C:\WINDOWS\Prefetch\PRINTER.EXE-0E099EB1.pf
    C:\WINDOWS\Prefetch\SYSTEM.EXE-027C1D18.pf
    C:\WINDOWS\Prefetch\WINAVXX.EXE-050EF48B.pf

Trojan.Net-VTROLL
    HKLM\Software\Classes\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32#ThreadingModel
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\InprocServer32#Enable Browser Extensions
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\ProgID
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\Programmable
    HKCR\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID
    C:\WINDOWS\SYSTEM32\VTR.DLL

Adware.ZToolbar
    HKLM\Software\Microsoft\Internet Explorer\Toolbar#{a19ef336-01d4-48e6-926a-fe7e1c747aed}
    HKLM\Software\AZESearchCo
    HKLM\Software\AZESearchCo\AZESearch
    HKLM\Software\AZESearchCo\AZESearch#GUID
    HKLM\Software\AZESearchCo\AZESearch#UninstallString
    HKLM\Software\AZESearchCo\AZESearch#DateTimeHigh
    HKLM\Software\AZESearchCo\AZESearch#DateTimeLow
    HKLM\Software\AZESearchCo\AZESearch#xml_file
    HKLM\Software\AZESearchCo\AZESearch#UPDATE_EVERY
    HKLM\Software\AZESearchCo\AZESearch\popup
    HKLM\Software\AZESearchCo\AZESearch\popup#1041_300
    HKLM\Software\AZESearchCo\AZESearch\times
    HKLM\Software\AZESearchCo\AZESearch\times#1041_300High
    HKLM\Software\AZESearchCo\AZESearch\times#1041_300Low
    HKLM\Software\LoaderCo
    HKLM\Software\LoaderCo\Loader
    HKLM\Software\LoaderCo\Loader#DateTimeHigh
    HKLM\Software\LoaderCo\Loader#DateTimeLow
    HKCR\AddressBar.Loader
    HKCR\AddressBar.Loader\CLSID
    HKCR\AddressBar.Loader\CurVer
    HKCR\AddressBar.Loader.1
    HKCR\AddressBar.Loader.1\CLSID
    HKCR\ZToolbar.activator
    HKCR\ZToolbar.activator\CLSID
    HKCR\ZToolbar.activator\CurVer
    HKCR\ZToolbar.activator.1
    HKCR\ZToolbar.activator.1\CLSID
    HKCR\ZToolbar.ParamWr
    HKCR\ZToolbar.ParamWr\CLSID
    HKCR\ZToolbar.ParamWr\CurVer
    HKCR\ZToolbar.ParamWr.1
    HKCR\ZToolbar.ParamWr.1\CLSID
    HKCR\ZToolbar.StockBar
    HKCR\ZToolbar.StockBar\CLSID
    HKCR\ZToolbar.StockBar\CurVer
    HKCR\ZToolbar.StockBar.1
    HKCR\ZToolbar.StockBar.1\CLSID
    HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}
    HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\ProxyStubClsid
    HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\ProxyStubClsid32
    HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\TypeLib
    HKCR\Interface\{EF77D50B-5767-4E0E-A3A4-098670025F1D}\TypeLib#Version
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\0
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\0\win32
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\FLAGS
    HKCR\TypeLib\{42FC3840-020C-4E93-A34C-4DF1A6330FBB}\1.0\HELPDIR
    HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}
    HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\ProxyStubClsid
    HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\ProxyStubClsid32
    HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\TypeLib
    HKCR\Interface\{A55C3BA7-DB1E-4652-867E-055CEAFE8018}\TypeLib#Version
    HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}
    HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\ProxyStubClsid
    HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\ProxyStubClsid32
    HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\TypeLib
    HKCR\Interface\{636FF82A-830A-42EA-938B-6DC78B2AC30C}\TypeLib#Version
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\0
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\0\win32
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\FLAGS
    HKCR\TypeLib\{DEA43CE3-D57B-45F6-A4D1-110E652CED11}\1.0\HELPDIR
    HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}
    HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\ProxyStubClsid
    HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\ProxyStubClsid32
    HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\TypeLib
    HKCR\Interface\{38252777-2500-456E-8B3D-A55850306DA2}\TypeLib#Version

Adware.IST/SideFind
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7}
    HKCR\SideFind.Finder
    HKCR\SideFind.Finder\CLSID
    HKCR\SideFind.Finder\CurVer
    HKCR\SideFind.Finder.1
    HKCR\SideFind.Finder.1\CLSID
    HKLM\Software\SideFind
    HKLM\Software\SideFind#account_id
    HKLM\Software\SideFind#PathBHO
    HKLM\Software\SideFind#PathDLL
    HKLM\Software\SideFind#PathXML
    HKLM\Software\SideFind#PathEXE
    HKLM\Software\SideFind#InstallDate
    HKLM\Software\SideFind#SearchSite
    HKLM\Software\SideFind#update
    HKLM\Software\SideFind#ver
    HKLM\Software\SideFind#IntervalBetweenShows
    HKLM\Software\SideFind#show
    HKLM\Software\SideFind#NextShow
    HKLM\Software\SideFind\History
    HKLM\Software\SideFind\History#0
    HKLM\Software\SideFind\History#1
    HKLM\Software\SideFind\History#2
    HKLM\Software\SideFind\History#3

Browser Hijacker.Internet Explorer Zone Hijack
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny#http
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\contentmatch.net\ny#https

Adware.IST/ISTBar (Slotch Bar)
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\IST
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\Software\Microsoft\Internet Explorer\Main#BandRest [ Never ]
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Main#BandRest [ Never ]

Trojan.MalwareWipe
    HKCR\AppId\{70F17C8C-1744-41B6-9D07-575DB448DCC5}

Adware.Avenue Media/Internet Optimizer
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout#Comment
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout#DComment
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt
    HKU\S-1-5-21-1060284298-1957994488-2147030931-500\SOFTWARE\Policies\Avenue Media
    HKLM\SOFTWARE\Policies\Avenue Media

Trojan.Painter
    HKCR\winapi32.MyBHO
    HKCR\winapi32.MyBHO\Clsid

Parasite.SpyAxe
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\crzccxaRiXvC
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\FFMnkXvZx
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\FkiEfrdycdpm
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\InprocServer32
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\InprocServer32#ThreadingModel
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\JzWHdoXXxLldZ
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\maqeqyme
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\nSzXhX
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\QarvUwzYSnjN
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\sfvMTbdXh
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\sqljj
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\uhgrktdo
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\utFll
    HKCR\CLSID\{957BAB51-81FF-8195-F273-D7E286EA702F}\yhMuF
    HKCR\AppId\SpyAxe.EXE
    HKCR\AppId\SpyAxe.EXE#AppID

Adware.Admess
    HKCR\AppId\{F6BDB4E5-D6AA-4D1F-8B67-BCB0F2246E21}
    HKCR\AppId\WStart.DLL
    HKCR\AppId\WStart.DLL#WStart
    HKLM\Software\WSoft
    HKLM\Software\WSoft#WSoft

Adware.Media Access
    HKLM\Software\Media Access

Trojan.Homepage/Puper
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#wininet.dll [ mscornet.exe ]

Malware.AntiVirusGolden
    HKCR\Engine.IgnoreList
    HKCR\Engine.IgnoreList\CLSID
    HKCR\Engine.IgnoreList\CurVer
    HKCR\Engine.IgnoreList.1
    HKCR\Engine.IgnoreList.1\CLSID
    HKCR\Engine.Threat
    HKCR\Engine.Threat\CLSID
    HKCR\Engine.Threat\CurVer
    HKCR\Engine.Threat.1
    HKCR\Engine.Threat.1\CLSID

Trojan.RUNSRV32/System
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run#Adware.Srv32 [ C:\WINDOWS\System32\runsrv32.exe ]

Trojan.SUSP/Transponder
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run#Transponder [ C:\WINDOWS\System32\susp.exe ]

Trojan.Aff-YourThumbs
    C:\PROGRAMMER\MICROSOFT SECURITY ADVISER\MSSADV.EXE
    C:\WINDOWS\MSSADV.DLL

Trojan.Downloader-Gen/NoMultiTask
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{E67A982B-4B8F-4E0D-A9FD-AB32A7E6466D}\RP549\A0081339.DLL

Adware.TrustInCash
    C:\WINDOWS\CASINO.ICO

Adware.Unknown Origin
    C:\WINDOWS\SHOPPING.ICO

Adware.CashDeluxe
    C:\WINDOWS\SYSTEM32\SHELLGUI32.DLL

Trojan.Downloader-Gen/Win
    C:\WINDOWS\SYSTEM32\SVCP.CSV

Trojan.Downloader-Gen
    C:\WINDOWS\SYSTEM32\WINSUB.XML

Trojan.TaskDir
    C:\WINDOWS\SYSTEM32\ZLBW.DLL

Combi FIX

ComboFix 07-09-10.6 - "Administrator" 2007-09-11 21:18:25.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.1.1252.1.1030.18.613 [GMT 2:00]
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Programmer\Microsoft Security Adviser
C:\WINDOWS\alexaie.dll
C:\WINDOWS\alxie328.dll
C:\WINDOWS\alxtb1.dll
C:\WINDOWS\system32\_003952_.tmp.dll
C:\WINDOWS\system32\_003955_.tmp.dll
C:\WINDOWS\system32\_003958_.tmp.dll
C:\WINDOWS\system32\_003986_.tmp.dll
C:\WINDOWS\system32\_003989_.tmp.dll
C:\WINDOWS\system32\_003992_.tmp.dll
C:\WINDOWS\system32\_004124_.tmp.dll
C:\WINDOWS\system32\_004125_.tmp.dll
C:\WINDOWS\system32\_004126_.tmp.dll
C:\WINDOWS\system32\_004127_.tmp.dll
C:\WINDOWS\system32\_004134_.tmp.dll
C:\WINDOWS\system32\_004135_.tmp.dll
C:\WINDOWS\system32\_004136_.tmp.dll
C:\WINDOWS\system32\_004137_.tmp.dll
C:\WINDOWS\system32\_004139_.tmp.dll
C:\WINDOWS\system32\_004140_.tmp.dll
C:\WINDOWS\system32\_004143_.tmp.dll
C:\WINDOWS\system32\_004144_.tmp.dll
C:\WINDOWS\system32\_004146_.tmp.dll
C:\WINDOWS\system32\_004147_.tmp.dll
C:\WINDOWS\system32\_004148_.tmp.dll
C:\WINDOWS\system32\_004150_.tmp.dll
C:\WINDOWS\system32\_004151_.tmp.dll
C:\WINDOWS\system32\_004153_.tmp.dll
C:\WINDOWS\system32\_004157_.tmp.dll
C:\WINDOWS\system32\_004158_.tmp.dll
C:\WINDOWS\system32\_004159_.tmp.dll
C:\WINDOWS\system32\_004160_.tmp.dll
C:\WINDOWS\system32\_004161_.tmp.dll
C:\WINDOWS\system32\_004168_.tmp.dll
C:\WINDOWS\system32\_004169_.tmp.dll
C:\WINDOWS\system32\_004170_.tmp.dll
C:\WINDOWS\system32\_004172_.tmp.dll
C:\WINDOWS\system32\_004173_.tmp.dll
C:\WINDOWS\system32\_004176_.tmp.dll
C:\WINDOWS\system32\_004177_.tmp.dll
C:\WINDOWS\system32\_004179_.tmp.dll
C:\WINDOWS\system32\_004180_.tmp.dll
C:\WINDOWS\system32\_004181_.tmp.dll
C:\WINDOWS\system32\_004183_.tmp.dll
C:\WINDOWS\system32\_004184_.tmp.dll
C:\WINDOWS\system32\_004186_.tmp.dll
C:\WINDOWS\system32\_004190_.tmp.dll
C:\WINDOWS\system32\_004191_.tmp.dll
C:\WINDOWS\system32\_004193_.tmp.dll
C:\WINDOWS\system32\_004194_.tmp.dll
C:\WINDOWS\system32\_004196_.tmp.dll
C:\WINDOWS\system32\_004198_.tmp.dll
C:\WINDOWS\system32\_004199_.tmp.dll
C:\WINDOWS\system32\_004200_.tmp.dll
C:\WINDOWS\system32\_004201_.tmp.dll
C:\WINDOWS\system32\_004204_.tmp.dll
C:\WINDOWS\system32\_004205_.tmp.dll
C:\WINDOWS\system32\_004206_.tmp.dll
C:\WINDOWS\system32\_004207_.tmp.dll
C:\WINDOWS\system32\_004208_.tmp.dll
C:\WINDOWS\system32\_004212_.tmp.dll


(((((((((((((((((((((((((  Files Created from 2007-08-11 to 2007-09-11  )))))))))))))))))))))))))))))))
.

2007-09-11 21:16    51,200    --a--c---    C:\WINDOWS\NirCmd.exe
2007-09-11 19:27    <DIR>    d----c---    C:\Programmer\SUPERAntiSpyware
2007-09-11 19:27    <DIR>    d----c---    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-11 19:27    <DIR>    d----c---    C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-11 19:23    <DIR>    d----c---    C:\Programmer\CCleaner
2007-08-27 22:05    79,360    --a--c---    C:\WINDOWS\system32\dpwsockx.dll
2007-08-27 22:05    79,360    --a--c---    C:\WINDOWS\system32\dllcache\dpwsockx.dll
2007-08-27 22:05    292,864    --a--c---    C:\WINDOWS\system32\dllcache\ddraw.dll
2007-08-27 22:05    292,864    --a--c---    C:\WINDOWS\system32\ddraw.dll
2007-08-27 22:05    230,400    --a--c---    C:\WINDOWS\system32\dplayx.dll
2007-08-27 22:05    230,400    --a--c---    C:\WINDOWS\system32\dllcache\dplayx.dll
2007-08-27 20:31    <DIR>    d----c---    C:\DOCUME~1\ADMINI~1\APPLIC~1\Joost

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-04 20:26    ---------    d----c---    C:\DOCUME~1\ADMINI~1\APPLIC~1\MSN6
2007-08-01 20:33    ---------    d----c---    C:\Programmer\easytemplates
    ---------        C:\Programmer\Fælles filer\Wise Installation Wizard
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Programmer\Eset\nod32kui.exe" [2007-03-18 19:21]
"SpyAxe"="C:\Programmer\SpyAxe\spyaxe.exe" []
"LaunchAp"="C:\Programmer\Launch Manager\LaunchAp.exe" [2002-12-02 11:22]
"HotkeyApp"="C:\Programmer\Launch Manager\HotkeyApp.exe" [2003-01-09 11:41]
"CtrlVol"="C:\Programmer\Launch Manager\CtrlVol.exe" [2002-10-23 18:18]
"Wbutton"="C:\Programmer\Launch Manager\Wbutton.exe" [2003-01-09 10:57]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 11:59 C:\WINDOWS\AGRSMMSG.exe]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 00:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 00:07]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2003-04-24 16:51]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2003-04-24 16:44]
"Microsoft Internel Corporat "="smbvhost.exe" []
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2005-06-05 14:38]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Acrobat Assistant 7.0"="C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 03:12]
"FixCamera"="C:\WINDOWS\FixCamera.exe" [2006-06-01 12:26]
"tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2006-05-22 11:37]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-07-10 10:33]
"SSBkgdUpdate"="C:\Programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" []
"PaperPort PTD"="C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-18 17:11]
"IndexSearch"="C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-18 17:22]
"BrMfcWnd"="C:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 16:48]
"SetDefPrt"="C:\Programmer\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 19:02]
"ControlCenter3"="C:\Programmer\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 15:58]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Programmer\Messenger\msmsgs.exe" [2004-11-15 17:18]
"MsnMsgr"="C:\Programmer\MSN Messenger\MsnMsgr.exe" [2005-12-14 11:02]
"H/PC Connection Agent"="C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:07]
"updateMgr"="C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Microsoft Internel Corporat "=smbvhost.exe

C:\DOCUME~1\ALLUSE~1\MENUEN~1\PROGRA~1\Start\
Adobe Acrobat Hurtigstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1030-D700-BA7E-000000000002}\SC_Acrobat.exe [2007-01-09 15:15:18]
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
ZyWALL VPN Client.lnk - C:\Programmer\ZyXEL\ZyWALL VPN Client\SafeCfg.exe [2007-06-04 14:06:02]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"=1 (0x1)
"NoWindowsUpdate"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"=  scecli scecli

R1 Hotkey;Hotkey;C:\WINDOWS\System32\drivers\Hotkey.sys
R1 IPSECDRV;SafeNet IPSec Plugin;\??\C:\WINDOWS\System32\Drivers\IPSECDRV.sys
R1 Wbutton;Wbutton;C:\WINDOWS\System32\drivers\Wbutton.sys
R2 Crypto;Crypto;\??\C:\WINDOWS\System32\Drivers\Crypto.sys
R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\System32\DRIVERS\BrScnUsb.sys
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\System32\DRIVERS\dne2000.sys
R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\System32\DRIVERS\vap.sys
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\System32\DRIVERS\odysseyIM3.sys
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS\System32\Drivers\WBMS.SYS
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\System32\Drivers\WBSD.SYS
S2 XXSTQKMX;XXSTQKMX;\??\C:\WINDOWS\System32\xxstqkmx.bgm
S3 cwbwdm_device;Crystal WDM Audio Codec-driver;C:\WINDOWS\System32\drivers\cwbwdm.sys
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\System32\DRIVERS\snp2sxp.sys
S3 w70n51;Intel(R) PRO/Wireless 7100 Adapter - Driver;C:\WINDOWS\System32\DRIVERS\w70n51.sys

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-11 21:36:34
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-11 21:39:05 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-11 21:38
.
    --- E O F ---

Hold da fest fast - den er da helt ubruglig den PC ???
Månedens (eller årets?) rekord i inficeret PC!

Inden vi fortsætter - Er der nogen grund til at du ikke har opdateret til Microsoft ServicePack2 ?
"Ubeskyttede pc’er holder i 20 minutter":
http://www.comon.dk/index.php/news/show/id=18812

Jeg ved det godt, men det er et andet problem,
maskinen er født med windows xp home, og det er en gangsk lovlig betalt version, med cd labels pålimet og hele svineriet, men så er der en der har installeret en version af windows xp pro oveni, derfor kan jeg ikke installere service pack 2 endnu,
Jeg skal bare have maskinen renset, så jeg kan gemme alle vigtige data, og så skal hele L...... formateres, og installeres med det originale software. og JA den er rigtig træls rent softwaremæssigt. OG ja jeg har læst artiklen som du refererer til.

... så vil jeg allerede NU anbefale dig at copy/flytte DINE EGNE DATA over på et andet medie og SÅ begynde FORFRA med original softwaren!!!

Generelt ->
http://www.spywareinfo.dk/manualer/xp-installation.htm +
http://www.spywareinfo.dk/manualer/xp-installation-side2.htm +
http://www.spywareinfo.dk/manualer/xp-opsaetning.htm

http://www.eksperten.dk/artikler/1104

Altså INGEN FORM FOR INTERNETFORBINDELSE undervejs ...

Der er vist en enkelt af de svære infektioner der IKKE er til stede, medmindre den skjuler sig bag et rootkit.
Så jeg er fuldstændig enig med Dr1 Larry.

???

Okay tak for svaret, jeg har bidt i det sure æble, og formatteret maskinen,
geninstalleret hele balladen, reetableret alle data, opdateret windows, så nu kører den bare som en drøm hvem skal have de point jeg har ude ved jeg ikke, men fromsej har da gjort et godt forsøg, så mon ikke det er ham ???

Ping...

Vi deler alle sammen *S*

Det var den rigtige beslutning. :-)

Foreløbig TAK