Hijackthis log, søsters computer er i kludr

Fy for den da...

Kigger på den..

1. Hent Vundofix her http://www.atribune.org/ccount/click.php?id=4

2. Genstart i fejlsikret tilstand. Hvis du ikke ved hvordan, så kig her (Scroll ned til "Sådan får du adgang til fejlsikret tilstand") http://kimludvigsen.dk/tips-windows-fejlsikret.html

3. Kør Vundofix, og klik "Scan for Vundo".

4. Når den er færdig med at scanne, skal du klikke på "Remove Vundo"-knappen.

Du vil så blive spurgt om du er sikker på, at du vil fjerne filerne. Her skal du klikke på "Yes". Herefter bliver dit skrivebord blankt, og fixet vil forsøge at fjerne Vundo. Når den er færdig, vil værktøjet have lov til at lukke computeren ned. Det skal du acceptere.

Hvis der er en fil som fixet ikke kan fjerne, vil det køre ved genstart, og så skal du klikke på "Scan for Vundo", og følge ovenstående vejledning igen.

Hent nyeste version af hijackthis herfra:
http://sptlarsenserious.googlepages.com/HJT-sfx.exe og læg loggen ind

tak. jeg prøver

så har jeg kørt vundu og den fandt 5 forekomster og slettede dem første gang. 2. gang fandt den en forekomst.
jeg har derefter kørt NOD32 full system scan, og den fandt en sand skov af trojanske heste og andet ubehagligt...
her kommer en ny log fra hijack - på forhånd tak:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:50:21, on 01-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programmer\Eset\nod32krn.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Programmer\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmer\QBU\QtZwLMng.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\Programmer\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe
C:\WINDOWS\system32\semwltray.exe
C:\Programmer\Java\jre1.5.0_03\bin\jusched.exe
C:\Programmer\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bmobile.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {f356f6b8-c4a8-f56a-7204-7da421770b23} - {32b07712-4ad7-4027-a65f-8a4c8b6f653f} - C:\WINDOWS\system32\iygnrydt.dll
O2 - BHO: (no name) - {8D948E8D-4764-408A-9731-E3164F93BB33} - C:\WINDOWS\system32\ddayy.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BC3CD7DA-5FAB-4CBA-BAB2-C818A0F63282} - C:\WINDOWS\system32\rqrqp.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmer\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QtZwLMng] C:\Programmer\QBU\QtZwLMng.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Programmer\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [Sony Ericsson Wireless Manager UI] C:\WINDOWS\system32\semwltray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [98e1ce37] rundll32.exe "C:\WINDOWS\system32\uvnunvmy.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Programmer\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmer\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.bmobile.dk
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0032222.dat
O20 - Winlogon Notify: byxvutu - byxvutu.dll (file missing)
O20 - Winlogon Notify: cbxvw - C:\WINDOWS\system32\cbxvw.dll
O20 - Winlogon Notify: cbxyx - C:\WINDOWS\system32\cbxyx.dll
O20 - Winlogon Notify: ddayy - C:\WINDOWS\system32\ddayy.dll (file missing)
O20 - Winlogon Notify: efcbcdc - efcbcdc.dll (file missing)
O20 - Winlogon Notify: hgdax - C:\WINDOWS\system32\hgdax.dll
O20 - Winlogon Notify: nnljj - C:\WINDOWS\system32\nnljj.dll
O20 - Winlogon Notify: urqrp - C:\WINDOWS\system32\urqrp.dll
O20 - Winlogon Notify: urqrq - C:\WINDOWS\system32\urqrq.dll (file missing)
O20 - Winlogon Notify: urstu - C:\WINDOWS\system32\urstu.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Programmer\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Programmer\Eset\nod32krn.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 8829 bytes

Og så skal vi også lige have denne scanner:

Hent og dobbeltklik denne fil. Den pakker sig ud til C:\SDFix:
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Genstart i fejlsikret, hvis du ikke ved hvordan så kig her (Scroll ned til "Sådan får du adgang til fejlsikret tilstand") http://kimludvigsen.dk/tips-windows-fejlsikret.html


Gå så ind i mappen SDFix på C drevet. Dobbeltklik på filen RunThis.bat, for at starte værktøjet. Tryk "y" for at bekræfte, at du kører værktøjet på egen risiko. Så vil værktøjet gå i gang med at fjerne trojanservicen, og lave et par reparationer af registreringsdatabasen. På et tidspunkt vil det bede dig om at trykke en taste for at genstarte computeren. Det skal du gøre, hvorefter computeren vil genstarte efter 15 sekunder.

Genstarten vil tage lidt længere end sædvanligt, idet værktøjet skal have tid til at udføre sit arbejde. Når skrivebordet dukker op, vil værktøjet skrive "Finished". Tryk herefter en taste for at indlæse dine skrivebordsikoner igen.

Åben så SDFix-mappen, find filen Report.txt, og kopier indholdet af denne fil herind.

ok, det har jeg så kørt nu. den lader ikke til den har fundet det store. NOD32 gennemtrawlede også sys-reg'en og slettede en masse... her kommer rapport:


SDFix: Version 1.113

Run by Loa Baastrup on 01-11-2007 at 22:07

Microsoft Windows XP [version 5.1.2600]

Running From: C:\sdfix\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                Final Check:

catchme 0.3.1253 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 22:15:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programmer\\Macromedia\\FreeHand 10\\FreeHand 10.exe"="C:\\Programmer\\Macromedia\\FreeHand 10\\FreeHand 10.exe:*:Disabled:FreeHand 10"
"C:\\Programmer\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"="C:\\Programmer\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe:*:Enabled:Dreamweaver MX"
"C:\\Programmer\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"="C:\\Programmer\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2"
"C:\\Programmer\\Chami\\HTML-Kit\\Bin\\HTMLKit.exe"="C:\\Programmer\\Chami\\HTML-Kit\\Bin\\HTMLKit.exe:*:Enabled:HTML-Kit"
"C:\\Programmer\\MSN Messenger\\msnmsgr.exe"="C:\\Programmer\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Programmer\\MSN Messenger\\msncall.exe"="C:\\Programmer\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Programmer\\Macromedia\\Flash MX\\Flash.exe"="C:\\Programmer\\Macromedia\\Flash MX\\Flash.exe:*:Enabled:Flash 6.0 r25"
"C:\\Programmer\\iTunes\\iTunes.exe"="C:\\Programmer\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Programmer\\LimeWire\\LimeWire.exe"="C:\\Programmer\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programmer\\MSN Messenger\\msnmsgr.exe"="C:\\Programmer\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Programmer\\MSN Messenger\\msncall.exe"="C:\\Programmer\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Tue 11 Sep 2007          365 ..SH. --- "C:\WINDOWS\system32\bdeeg.tmp"
Sat  8 Sep 2007        6,720 ..SH. --- "C:\WINDOWS\system32\jjlnn.tmp"
Sat  8 Sep 2007        6,480 ..SH. --- "C:\WINDOWS\system32\jjlnn.bak1"
Mon 10 Sep 2007        6,704 ..SH. --- "C:\WINDOWS\system32\jjlnn.bak2"
Tue  2 Oct 2007        6,381 ..SH. --- "C:\WINDOWS\system32\oqtwa.tmp"
Tue  9 Oct 2007        6,363 ..SH. --- "C:\WINDOWS\system32\pqrqr.bak1"
Thu  1 Nov 2007        54,053 ..SH. --- "C:\WINDOWS\system32\pqrqr.bak2"
Wed 19 Sep 2007        6,549 ..SH. --- "C:\WINDOWS\system32\prqru.tmp"
Wed 19 Sep 2007        6,480 ..SH. --- "C:\WINDOWS\system32\prqru.bak1"
Wed 12 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\prqss.tmp"
Sat 22 Sep 2007        6,526 ..SH. --- "C:\WINDOWS\system32\prtss.tmp"
Sun 23 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\qrqru.tmp"
Sun 23 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\qrqru.bak1"
Sun  9 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\tutss.tmp"
Mon 24 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\utsru.bak1"
Sun  9 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\uwvyb.tmp"
Mon 10 Sep 2007        6,570 ..SH. --- "C:\WINDOWS\system32\uwyay.tmp"
Fri 28 Sep 2007        6,623 ..SH. --- "C:\WINDOWS\system32\wvxbc.tmp"
Fri 28 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\wvxbc.bak1"
Thu 20 Sep 2007        6,644 ..SH. --- "C:\WINDOWS\system32\xadgh.tmp"
Wed 19 Sep 2007        6,480 ..SH. --- "C:\WINDOWS\system32\xadgh.bak1"
Tue 18 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\xyxbc.tmp"
Tue 18 Sep 2007        6,440 ..SH. --- "C:\WINDOWS\system32\xyxbc.bak1"
Sat 22 Sep 2007        6,747 ..SH. --- "C:\WINDOWS\system32\xyxbc.bak2"
Tue 18 Sep 2007            0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a54552c3e3f31d6311e4cbaf96d9f00c\BIT1.tmp"

Finished!

VundoFix bliver ved med at finde snavs hver gang jeg genstarter:
ddayy.dll placeret system-mappen i windows
har prøvet flere gange at bede vundo fjerne det, men det er der stadig når jeg har genstartet...
er gode dyr rådne?

Okay, sidste værktøj på banen, så må vi tage resten manuelt..

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

-- Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

BEMÆRK at Combofix af nogle virusscannere bliver detekteret som inficeret. Dette har dog intet på sig.

Tak, nu har jeg ikke lige maskinen her, men jeg får hende til at køre det, så ser vi.
mvh
Rune

Det er bare i orden..

Nu er det søsteren selv der prøver???
Hva stiller jeg så op nu???
Søsteren

ComboFix 07-11-01.1** - Loa Baastrup 2007-11-02 13:08:43.1 - NTFSx86
Running from: C:\Documents and Settings\Loa Baastrup\Lokale indstillinger\Temporary Internet Files\Content.IE5\OH6V8TMN\ComboFix[1].exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006
C:\Documents and Settings\Loa Baastrup\Application Data\WinAntiVirus Pro 2006
C:\Programmer\Fælles filer\winantivirus pro 2006
C:\Programmer\Fælles filer\WinAntiVirus Pro 2006\WapCHK.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c0032222.dat
C:\WINDOWS\system32\__c004F90C.dat
C:\WINDOWS\system32\__c00A3900.dat
C:\WINDOWS\system32\__c00DA400.dat
C:\WINDOWS\system32\affbeeyj.dll
C:\WINDOWS\system32\gvxqqkgn.dll
C:\WINDOWS\system32\iusqugda.dll
C:\WINDOWS\system32\iygnrydt.dll
C:\WINDOWS\system32\jhicpuqk.dll
C:\WINDOWS\system32\jjlnn.bak1
C:\WINDOWS\system32\jjlnn.bak2
C:\WINDOWS\system32\jjlnn.ini
C:\WINDOWS\system32\jjlnn.ini2
C:\WINDOWS\system32\jjlnn.tmp
C:\WINDOWS\system32\oddjavhe.dll
C:\WINDOWS\system32\pqrqr.bak1
C:\WINDOWS\system32\pqrqr.bak2
C:\WINDOWS\system32\pqrqr.ini
C:\WINDOWS\system32\prqru.bak1
C:\WINDOWS\system32\prqru.ini
C:\WINDOWS\system32\prqru.ini2
C:\WINDOWS\system32\prqru.tmp
C:\WINDOWS\system32\qrqru.bak1
C:\WINDOWS\system32\qrqru.ini
C:\WINDOWS\system32\qrqru.ini2
C:\WINDOWS\system32\qrqru.tmp
C:\WINDOWS\system32\rqrqp.dll
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\ttbytyfm.dll
C:\WINDOWS\system32\utsru.bak1
C:\WINDOWS\system32\utsru.ini
C:\WINDOWS\system32\uvnunvmy.dll
C:\WINDOWS\system32\wvxbc.bak1
C:\WINDOWS\system32\wvxbc.ini
C:\WINDOWS\system32\wvxbc.ini2
C:\WINDOWS\system32\wvxbc.tmp
C:\WINDOWS\system32\xadgh.bak1
C:\WINDOWS\system32\xadgh.tmp
C:\WINDOWS\system32\xyxbc.bak1
C:\WINDOWS\system32\xyxbc.bak2
C:\WINDOWS\system32\xyxbc.ini
C:\WINDOWS\system32\xyxbc.ini2
C:\WINDOWS\system32\xyxbc.tmp
C:\WINDOWS\system32\ymvnunvu.ini

.
(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN


(((((((((((((((((((((((((  Files Created from 2007-10-02 to 2007-11-02  )))))))))))))))))))))))))))))))
.

2007-11-02 13:01    51,200    --a------    C:\WINDOWS\NirCmd.exe
2007-11-01 23:09    <DIR>    d--------    C:\WINDOWS\system32\da-dk
2007-11-01 22:59    6,058,496    -----c---    C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-01 22:59    2,455,488    -----c---    C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-01 22:59    459,264    -----c---    C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-01 22:59    383,488    -----c---    C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-01 22:59    267,776    -----c---    C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-01 22:59    63,488    -----c---    C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-01 22:59    52,224    -----c---    C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-01 22:59    33,792    --a--c---    C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-01 22:59    13,824    -----c---    C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-01 22:06    <DIR>    d--------    C:\WINDOWS\ERUNT
2007-11-01 21:23    401,720    --a------    C:\Programmer\HJTrenamed.exe
2007-11-01 20:59    <DIR>    d--------    C:\VundoFix Backups
2007-10-21 20:44    62,560    --a------    C:\WINDOWS\system32\wtlytjpy.dll
2007-10-17 16:54    584,192    -----c---    C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-10 10:22    512,096    --a------    C:\WINDOWS\system32\drivers\amon.sys
2007-10-10 10:22    298,104    --a------    C:\WINDOWS\system32\imon.dll
2007-10-10 10:22    15,424    --a------    C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-10 09:22    <DIR>    d--------    C:\WINDOWS\pss

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 20:50    8,830    ----a-w    C:\Programmer\hijackthis.log
2007-10-17 11:50    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
2007-09-08 14:12    ---------    d-----w    C:\Programmer\Fælles filer\Adobe
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D948E8D-4764-408A-9731-E3164F93BB33}]
            C:\WINDOWS\system32\ddayy.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 07:29 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-15 04:59 C:\WINDOWS\AGRSMMSG.exe]
"QtZwLMng"="C:\Programmer\QBU\QtZwLMng.EXE" [2003-04-03 07:14]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 10:40]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 02:34]
"PRONoMgr.exe"="C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-10 01:36]
"Adobe Version Cue CS2"="C:\Programmer\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-06 15:53]
"GCXX-Manager-Class"="C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41]
"Sony Ericsson Wireless Manager UI"="C:\WINDOWS\system32\semwltray" []
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 02:48]
"nod32kui"="C:\Programmer\Eset\nod32kui.exe" [2007-10-10 10:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 01:53]
"updateMgr"="C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-29 21:01]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Gamma.lnk - C:\Programmer\Fælles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-09 21:47:53]
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
InterVideo WinCinema Manager.lnk - C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-12-18 17:37:08]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2006-05-28 12:43:14]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxvutu]
byxvutu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxvw]
C:\WINDOWS\system32\cbxvw.dll 2007-09-28 09:29 283232 C:\WINDOWS\system32\cbxvw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyx]
C:\WINDOWS\system32\cbxyx.dll 2007-09-18 20:45 283232 C:\WINDOWS\system32\cbxyx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddayy]
C:\WINDOWS\system32\ddayy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcbcdc]
efcbcdc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgdax]
C:\WINDOWS\system32\hgdax.dll 2007-09-19 09:22 282720 C:\WINDOWS\system32\hgdax.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnljj]
C:\WINDOWS\system32\nnljj.dll 2007-09-08 16:26 282720 C:\WINDOWS\system32\nnljj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\System32\LgNotify.dll 2003-12-16 15:49 110592 C:\WINDOWS\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrp]
C:\WINDOWS\system32\urqrp.dll 2007-09-19 20:43 282720 C:\WINDOWS\system32\urqrp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrq]
C:\WINDOWS\system32\urqrq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urstu]
C:\WINDOWS\system32\urstu.dll 2007-09-24 07:28 283232 C:\WINDOWS\system32\urstu.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\rqrqp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Programmer\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Programmer\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Programmer\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R2 setrysvc;Sony Ericsson Wireless LAN Tray Service;C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
S3 SEM43XX;Driver til Sony Ericsson 802.11 trådløs LAN-adapter SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys
S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys
S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-25 17:50:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
"2007-11-02 11:42:00 C:\WINDOWS\Tasks\Søg efter opdateringer til Windows Live Toolbar.job"
- C:\Programmer\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 13:17:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-02 13:18:24 - machine was rebooted
.
    --- E O F ---

Hej søsteren..
Kopiér indholdet mellem de stiplede linier ind i et notepad-vindue, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt.
Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

-------------------------
File::
C:\WINDOWS\system32\wtlytjpy.dll
-------------------------

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen. - http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.

Kopier indholdet af Combofix.txt her ind sammen med en ny hijackthis log

Tror nok jeg har gjort som du har sagt?
Hvordan synes du nu det ser ud???
Så langt så godt... tak for hjælpen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:39:15, on 02-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\setrysvc.exe
C:\WINDOWS\System32\semwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programmer\Eset\nod32krn.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\Programmer\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmer\QBU\QtZwLMng.EXE

ComboFix 07-11-01.1** - Loa Baastrup 2007-11-02 16:26:45.2 - NTFSx86
Running from: C:\Documents and Settings\Loa Baastrup\Skrivebord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Loa Baastrup\Skrivebord\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\wtlytjpy.dll
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\wtlytjpy.dll

.
(((((((((((((((((((((((((  Files Created from 2007-10-02 to 2007-11-02  )))))))))))))))))))))))))))))))
.

2007-11-02 13:01    51,200    --a------    C:\WINDOWS\NirCmd.exe
2007-11-01 23:09    <DIR>    d--------    C:\WINDOWS\system32\da-dk
2007-11-01 22:59    6,058,496    -----c---    C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-01 22:59    2,455,488    -----c---    C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-01 22:59    459,264    -----c---    C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-01 22:59    383,488    -----c---    C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-01 22:59    267,776    -----c---    C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-01 22:59    63,488    -----c---    C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-01 22:59    52,224    -----c---    C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-01 22:59    33,792    --a--c---    C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-01 22:59    13,824    -----c---    C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-01 22:06    <DIR>    d--------    C:\WINDOWS\ERUNT
2007-11-01 21:23    401,720    --a------    C:\Programmer\HJTrenamed.exe
2007-11-01 20:59    <DIR>    d--------    C:\VundoFix Backups
2007-10-17 16:54    584,192    -----c---    C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-10 10:22    512,096    --a------    C:\WINDOWS\system32\drivers\amon.sys
2007-10-10 10:22    298,104    --a------    C:\WINDOWS\system32\imon.dll
2007-10-10 10:22    15,424    --a------    C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-10 09:22    <DIR>    d--------    C:\WINDOWS\pss

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 20:50    8,830    ----a-w    C:\Programmer\hijackthis.log
2007-10-17 11:50    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
2007-09-08 14:12    ---------    d-----w    C:\Programmer\Fælles filer\Adobe
.

(((((((((((((((((((((((((((((  snapshot@2007-11-02_13.17.48.59  )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-02 12:16:02    12,955    ----a-w    C:\WINDOWS\system32\tablet.dat
+ 2007-11-02 15:32:41    12,955    ----a-w    C:\WINDOWS\system32\tablet.dat
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D948E8D-4764-408A-9731-E3164F93BB33}]
            C:\WINDOWS\system32\ddayy.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 07:29 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-15 04:59 C:\WINDOWS\AGRSMMSG.exe]
"QtZwLMng"="C:\Programmer\QBU\QtZwLMng.EXE" [2003-04-03 07:14]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 10:40]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 02:34]
"PRONoMgr.exe"="C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-10 01:36]
"Adobe Version Cue CS2"="C:\Programmer\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-06 15:53]
"GCXX-Manager-Class"="C:\Programmer\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41]
"Sony Ericsson Wireless Manager UI"="C:\WINDOWS\system32\semwltray" []
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 02:48]
"nod32kui"="C:\Programmer\Eset\nod32kui.exe" [2007-10-10 10:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 01:53]
"updateMgr"="C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-29 21:01]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Gamma.lnk - C:\Programmer\Fælles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-09 21:47:53]
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
InterVideo WinCinema Manager.lnk - C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-12-18 17:37:08]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2006-05-28 12:43:14]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxvutu]
byxvutu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxvw]
C:\WINDOWS\system32\cbxvw.dll 2007-09-28 09:29 283232 C:\WINDOWS\system32\cbxvw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyx]
C:\WINDOWS\system32\cbxyx.dll 2007-09-18 20:45 283232 C:\WINDOWS\system32\cbxyx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddayy]
C:\WINDOWS\system32\ddayy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcbcdc]
efcbcdc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgdax]
C:\WINDOWS\system32\hgdax.dll 2007-09-19 09:22 282720 C:\WINDOWS\system32\hgdax.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnljj]
C:\WINDOWS\system32\nnljj.dll 2007-09-08 16:26 282720 C:\WINDOWS\system32\nnljj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\System32\LgNotify.dll 2003-12-16 15:49 110592 C:\WINDOWS\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrp]
C:\WINDOWS\system32\urqrp.dll 2007-09-19 20:43 282720 C:\WINDOWS\system32\urqrp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrq]
C:\WINDOWS\system32\urqrq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urstu]
C:\WINDOWS\system32\urstu.dll 2007-09-24 07:28 283232 C:\WINDOWS\system32\urstu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Programmer\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Programmer\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Programmer\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

R2 setrysvc;Sony Ericsson Wireless LAN Tray Service;C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
S3 SEM43XX;Driver til Sony Ericsson 802.11 trådløs LAN-adapter SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys
S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys
S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-25 17:50:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
"2007-11-02 13:42:00 C:\WINDOWS\Tasks\Søg efter opdateringer til Windows Live Toolbar.job"
- C:\Programmer\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 16:33:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-02 16:34:41 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-02 13:18
.
    --- E O F ---

Så ser det bedre ud..

Hjalp kuren??

Kør lige trin 5 og 6 herfra: http://www.malwarecheck.dk/forum/viewtopic.php?t=11

Her kan du læse om vores skudsikre sikkerhedspakke: http://www.malwarecheck.dk/forum/viewtopic.php?t=156 .
Hvis du har nogle spørgsmål, så spørger du bare..

Du er som sendt fra himlen.....
Tak for hjælpen..... Nu kører jeg i højeste gear, MEGA hurtigt uden epo....
med evig respekt for eksperten.dk:)
Søsteren.

Velbekommen og tak for de pæne ord..