http://www.megaclick.com - error lande? virus eller?

... for en go' ordens skyld; stik os/mig en HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis.exe

(Jooo - jeg har 'virus' på hjernen...)

------------------

hej,

stik jer en hijackthis? :) altså giver jer logfil eller? bare så jeg er helt sikker, og jeg er ikke hjemme lige nu, men når jeg kommer hjem så kigger jeg på det! :)

- nemlig - Hele Logfilteksten... i første omgang...

hej igen! :)

den vil være lidt træls at have herinde, så jeg uploade lige til mit server! :)
http://kurdo.dk/hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:09:24, on 22-01-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe
C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmer\CyberLink\PCM4Everio\EverioService.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\Programmer\Fælles filer\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\programmer\steam\steam.exe
C:\Programmer\Veoh Networks\Veoh\VeohClient.exe
C:\Programmer\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Ejer\Skrivebord\Ny mappe\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1030
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmer\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe
O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [UVS11 Preload] C:\Programmer\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EverioService] "C:\Programmer\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [LaunchList] C:\Programmer\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKCU\..\Run: [Veoh] "C:\Programmer\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Ejer\Menuen Start\Programmer\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe (file missing)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programmer/Chessmaster%20Challenge/Images/stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Programmer/Chessmaster%20Challenge/Images/armhelper.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Programmer\Fælles filer\InterVideo\DeviceService\DevSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmer\Fælles filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Programmer\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmer\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10411 bytes

... Nu er det ikke alle (u)ønskede elementer som viser sig med en HiJackThis Log; hvis du har 'mod' på det så gennemfør proceduren herfra -> http://www.eksperten.dk/artikler/1123

jeg er lidt bagud lige nu! :) hvorfor postede du mit logfil igen? :b er det meningen jeg skal se noget i den eller? og i den link du har givet, det eneste han gør er at downloade de 4-5 programmer og kører dem? :)

... så andre/alle ka' se den. Og så kunne _jeg_ også bedre overskue det...

- nemlig -

okay, jeg prøver lige de andre programmer også, men ellers?

vis den heller ikke viser noget brugbart? :)

- nemlig -> http://www.eksperten.dk/artikler/1123

mange tak for hjælpen, jeg tror faktisk det var combo der fixede det, men jeg er ikke sikker! :) smid et svar..


altid fedt med nogle der gider at hjælpe! :b

... vil (=skal) lige se ComboFix loggen ...

hvorfor det? :)

her er den, jeg ved ikke om det var combofix der fixede den, :)
jeg gætte på det var det fordi jeg prøvede ikke den antispyware pro eller hvad den hedde, og den ene virkede slet ikke. og hijacklog virkede heller ikke, så jeg gætte på combofix! :)


ComboFix 08-01-23.1C - Ejer 2008-01-26 13:20:09.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1030.18.450 [GMT 1:00]
Running from: C:\Documents and Settings\Ejer\Skrivebord\Downloads\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://dl.google.com
.
(((((((((((((((((((((((((  Files Created from 2007-12-26 to 2008-01-26  )))))))))))))))))))))))))))))))
.

2008-01-26 13:19 . 2000-08-31 08:00    51,200    --a------    C:\WINDOWS\Nircmd.exe
2008-01-24 15:19 . 2008-01-24 15:19    <DIR>    d--------    C:\Programmer\iPod
2008-01-23 16:24 . 2008-01-23 16:24    <DIR>    dr-h-----    C:\MSOCache
2008-01-21 16:57 . 2008-01-21 16:58    <DIR>    d--------    C:\Programmer\ConTEXT
2008-01-16 20:44 . 2008-01-16 20:44    <DIR>    d--------    C:\WINDOWS\ShellNew
2008-01-16 20:44 .     <DIR>        C:\Programmer\Fælles filer\Designer
2008-01-16 20:44 . 2008-01-16 20:44    376    --a------    C:\WINDOWS\ODBC.INI
2008-01-13 21:36 . 2008-01-13 21:36    244    --ah-----    C:\sqmnoopt01.sqm
2008-01-13 21:36 . 2008-01-13 21:36    232    --ah-----    C:\sqmdata01.sqm
2008-01-13 16:11 . 2008-01-13 16:11    <DIR>    d--------    C:\Programmer\Skype
2008-01-13 16:11 .     <DIR>        C:\Programmer\Fælles filer\Skype
2008-01-11 19:56 . 2008-01-11 19:56    948    --a------    C:\index.php
2008-01-10 15:27 . 2008-01-10 15:27    90,112    --a------    C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27    57,344    --a------    C:\WINDOWS\system32\QuickTime.qts
2008-01-07 20:44 . 2008-01-07 20:44    <DIR>    d--------    C:\Programmer\Robster Productions
2008-01-05 17:25 . 2004-08-03 23:07    59,264    --a------    C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-05 17:25 . 2004-08-03 23:07    59,264    --a--c---    C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-02 08:54 . 2008-01-02 08:54    664    --a------    C:\WINDOWS\system32\d3d9caps.dat
2008-01-01 20:41 . 2008-01-01 20:41    <DIR>    d--------    C:\Programmer\vso
2008-01-01 20:41 . 2008-01-01 20:41    47,360    --a------    C:\WINDOWS\system32\drivers\pcouffin.sys
2008-01-01 20:22 . 2008-01-01 21:04    <DIR>    d--------    C:\MyWorks
2008-01-01 20:11 . 2008-01-01 20:11    <DIR>    d--------    C:\Programmer\Digital Photo Navigator 1.5
2008-01-01 13:51 . 2008-01-01 13:51    0    --a------    C:\WINDOWS\muveeapp.INI
2008-01-01 12:41 . 2008-01-01 12:41    <DIR>    d--------    C:\Programmer\muvee Technologies
2008-01-01 12:41 .     <DIR>        C:\Programmer\Fælles filer\muvee Technologies
2008-01-01 12:27 . 2008-01-01 12:27    <DIR>    d--------    C:\Programmer\X10 Hardware
2008-01-01 12:27 . 2008-01-01 12:27    <DIR>    d--------    C:\Programmer\Common Files
2008-01-01 12:27 . 1999-06-25 09:56    127,184    --a------    C:\WINDOWS\Unwise.exe
2008-01-01 12:26 . 2006-06-04 15:48    198,144    ---------    C:\WINDOWS\system32\_psisdecd.dll
2008-01-01 12:26 . 2006-02-09 19:02    44,544    --a------    C:\WINDOWS\system32\msxml4a.dll
2008-01-01 12:25 . 2008-01-01 20:25    <DIR>    d--------    C:\Programmer\CyberLink
2008-01-01 12:24 . 2008-01-01 14:03    <DIR>    d--------    C:\Programmer\Home Cinema
2008-01-01 12:01 . 2008-01-01 12:01    <DIR>    d--------    C:\Programmer\Microsoft Works Suite 2006
2008-01-01 11:54 . 2008-01-01 11:54    <DIR>    d--------    C:\Programmer\AL-Software
2008-01-01 11:50 . 2008-01-01 11:50    <DIR>    d--------    C:\Programmer\Saint Paint
2008-01-01 11:50 . 2008-01-01 11:50    213,504    --a------    C:\WINDOWS\system32\SpoonUninstall.exe
2008-01-01 11:50 . 2008-01-01 11:50    28,898    --a------    C:\WINDOWS\system32\SpoonUninstall-Saint Paint Studio.bmp
2008-01-01 11:50 . 2008-01-01 11:53    3,959    --a------    C:\WINDOWS\SaintPaint.INI
2008-01-01 11:50 . 2008-01-01 11:50    1,064    --a------    C:\WINDOWS\system32\SpoonUninstall-Saint Paint Studio.dat
2008-01-01 11:45 . 2008-01-01 11:45    1,682    --ahs----    C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-01 11:45 . 2008-01-01 11:45    56    -r-hs----    C:\WINDOWS\system32\F8A69C88CD.sys
2008-01-01 11:43 . 2008-01-01 11:45    10,356    --a------    C:\temp.avs
2008-01-01 11:43 . 2008-01-01 11:45    55    --a------    C:\WINDOWS\param.ini
2008-01-01 11:38 . 2008-01-01 11:38    <DIR>    d--------    C:\Programmer\Photo Movie Creator
2008-01-01 11:38 . 2004-02-23 21:41    719,872    --a------    C:\WINDOWS\system32\devil.dll
2008-01-01 11:38 . 2005-10-08 01:14    308,224    --a------    C:\WINDOWS\system32\avisynth.dll
2008-01-01 11:38 . 2006-05-11 09:43    163,496    --a------    C:\WINDOWS\system32\help.chm
2008-01-01 11:38 . 2006-05-11 09:53    78    --a------    C:\WINDOWS\system32\Home Page.url
2007-12-29 20:10 .     <DIR>        C:\Programmer\Fælles filer\xing shared
2007-12-27 20:49 . 2007-12-27 20:49    <DIR>    d--------    C:\WINDOWS\.jagex_cache_32
2007-12-26 11:20 .     <DIR>        C:\Programmer\Fælles filer\Real
2007-12-26 10:39 . 2007-12-26 10:39    <DIR>    d--------    C:\Programmer\KURU

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 11:46    ---------    d-----w    C:\Programmer\Steam
2008-01-24 14:19    ---------    d-----w    C:\Programmer\iTunes
2008-01-24 14:18    ---------    d-----w    C:\Programmer\QuickTime
2008-01-23 15:25    ---------    d-----w    C:\Programmer\Fælles filer\Microsoft Shared
2008-01-22 16:36    ---------    d-----w    C:\Programmer\Folder Lock
2008-01-20 20:16    ---------    d-----w    C:\Programmer\Fælles filer
2008-01-09 12:48    ---------    d-----w    C:\Programmer\BitComet
2008-01-03 11:14    ---------    d-----w    C:\Programmer\Google
2008-01-01 19:25    ---------    d--h--w    C:\Programmer\InstallShield Installation Information
2008-01-01 10:45    ---------    d-----w    C:\Programmer\DivX
2007-12-22 14:43    ---------    d-----w    C:\Programmer\Gabest
2007-12-18 22:07    ---------    d-----w    C:\Programmer\Chessmaster Challenge
2007-12-15 14:24    ---------    d-----w    C:\Programmer\Valve Hammer Editor
2007-12-14 15:35    ---------    d-----w    C:\Programmer\AMX Mod X
2007-12-12 17:16    35,363    ----a-w    C:\WINDOWS\system32\windrvNT.sys
2007-12-06 20:19    ---------    d-----w    C:\Programmer\Fælles filer\Blizzard Entertainment
2007-12-02 18:54    79,920    ----a-w    C:\WINDOWS\system32\FLKill.exe
2007-11-07 09:28    723,456    ----a-w    C:\WINDOWS\system32\lsasrv.dll
2007-10-31 16:15    73,728    ----a-w    C:\WINDOWS\ALCFDRTM.EXE
2007-10-29 22:44    1,291,776    ----a-w    C:\WINDOWS\system32\quartz.dll
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 13:00 15360]
"Steam"="c:\programmer\steam\steam.exe" [2007-11-30 11:50 1266936]
"LaunchList"="C:\Programmer\Pinnacle\Studio 11\LaunchList2.exe" [ ]
"Veoh"="C:\Programmer\Veoh Networks\Veoh\VeohClient.exe" [2007-12-03 13:21 3461120]
"SpybotSD TeaTimer"="C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-02 18:27 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 10:59 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 20:49 7286784]
"nwiz"="nwiz.exe" [2005-10-10 20:49 1519616 C:\WINDOWS\system32\nwiz.exe]
"CmUCRRun"="C:\WINDOWS\system32\CmUCReye.exe" [2006-06-22 18:17 237568]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-18 15:20 14820864 C:\WINDOWS\RTHDCPL.EXE]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"HP Software Update"="C:\Programmer\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12 49152]
"BigDogPath323VMSnap"="C:\WINDOWS\VMSnap23.exe" [2006-07-20 04:37 90112]
"BigDogPath323Domino"="C:\WINDOWS\Domino.exe" [2006-06-28 02:54 49152]
"Google Desktop Search"="C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-25 20:07 1838592]
"UVS11 Preload"="C:\Programmer\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-04-12 13:23 341488]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"EverioService"="C:\Programmer\CyberLink\PCM4Everio\EverioService.exe" [2006-11-22 21:10 151552]
"TkBellExe"="C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" [ ]
"QuickTime Task"="C:\Programmer\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-27 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 12:35 219136]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
HP Digital Imaging Monitor.lnk - C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 22:23:26 282624]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

R2 mi-raysat_3dsMax2008_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit;"C:\Programmer\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe" [2007-09-24 17:05]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-06 11:16]
R3 CMISTOR;CMIUCR.SYS CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS [2006-06-24 00:39]
S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys [2007-10-31 14:09]
S3 vmfilter323;323 filter service, Normal;C:\WINDOWS\system32\drivers\vmfilter323.sys [2006-08-08 11:25]
S3 ZSMC326;Vimicro USB2.0 PC Camera(VC0323);C:\WINDOWS\system32\Drivers\usbvm323.sys [2006-08-21 16:40]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\systems.com
\Shell\read\command - explorer.exe
\Shell\start\command - RECYCLER\systems.com

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 13:24:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: C:\WINDOWS\

**************************************************************************
.
Completion time: 2008-01-26 13:25:23
ComboFix-quarantined-files.txt  2008-01-26 12:24:26
.
2008-01-22 20:20:39    --- E O F ---

C:\Programmer\BitComet !!!
Når du 'leger' med P2P programmer så er du næstem selv ude om det...
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

Jeps - ComboFix har 'fixet' noget ...

Der er ikke mere 'snavs' ifølge din Log...

Du er velkommen en anden gang...

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.

Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Safe Surfing...

Registreringsdatabase oprydning kan anbefales ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Register]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller NEJ til den.

mange tak for hjælpen! :)

jeg har slettet p2p som jeg tror er bitcomet og lign. programmer..
og jeg prøver lige at kigge på det senere! :)

Hej, Vil næsten vædde med, at du har hentet megaupload browser værktøj.Den der hedder "Mega Manager" Hvis du fjerne den så er din problem over..!