CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg
Cookie ikon
Avatar billede snifx Nybegynder
07. februar 2008 - 12:44 Der er 21 kommentarer og
1 løsning

Spyware/adware-problem [måske VirtuMonde.dll]

Hejsa

Jeg er røget ind i et problem. I.flg. Spybot drejer det sig om VirtuMonde.dll, men Spybot er ikke i stand til at slette denne.
Derfor vil jeg høre jer om det i det hele taget er mit problem, og hvordan det løses?

Her er en log fra HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:38:24, on 07-02-2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\rundll32.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Mads Lykke\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Memory Allocation Services] cisrv.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\qomli.dll,#1
O4 - HKLM\..\RunOnce: [SpybotDeletingA8888] command /c del "C:\Windows\System32\gebbc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8078] cmd /c del "C:\Windows\System32\gebbc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6492] command /c del "C:\Windows\System32\ljheb.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4042] cmd /c del "C:\Windows\System32\ljheb.dll_old"
O4 - HKCU\..\Run: [PhaseFireWireService] "C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2912] command /c del "C:\Windows\System32\gebbc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD154] cmd /c del "C:\Windows\System32\gebbc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1522] command /c del "C:\Windows\System32\ljheb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9364] cmd /c del "C:\Windows\System32\ljheb.dll_old"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/lib/stats/support/plugins/ebraryRdr.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 8894 bytes

:::::::::::::::::::::::::::

Jeg ser meget frem til at høre fra jer
- på forhånd tak!
Avatar billede reginho Nybegynder
07. februar 2008 - 12:50 #1
Spørg evt. på forum på www.spywarefri.dk Det er også gratis og fungerer perfekt.
Avatar billede fromsej Praktikant
07. februar 2008 - 12:55 #2
Der er vist ingen tvivl om at Spybot har ret, men der skal andre midler til.
Om du gør det her, eller på Spywarefri gør ikke den store forskel for mig, jeg er begge steder, bare du nøjes med det ene sted. ;-)
Skal det være herinde, så følg vejledningen i denne artikel:
http://www.eksperten.dk/artikler/1123
Husk, at når du kører Combofix, skal du højreklikke på den og vælge at køre den som Administrator.
Avatar billede snifx Nybegynder
07. februar 2008 - 14:42 #3
Det lyder godt - vi fortsætter bare her så.
Jeg har nu fulgt "opskriften" fra linket. Det er desværre ikke lykkedes mig at få en log fra Combifix. Skrivebordet forsvandt under processen, og computeren stod stille i meget lang tid - ca. en time. Herefter slukkede jeg og tændte igen, og ved opstart vistes kun en tom log-fil. Skal jeg forsøge at køre Combofix igen?

Her er resultatet af de andre logs:

:::::::::::::::::::::::::::::::::::::::::::::
Logfile of HijackThis v1.99.1
Scan saved at 14:08:53, on 07-02-2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\cisrv.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Mads Lykke\Desktop\clean\alternativ.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4F8F8CDD-E0B9-45B1-84AE-2C16B48DB608} - C:\Windows\system32\wvusr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7AF268D9-5ABE-40C6-A923-14418865A835} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A3703CD5-0401-4BBF-969F-CD01B6EE45E0} - C:\Windows\system32\gebbc.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BFF13CF6-BB9A-4D73-BDEB-4DEC2CE75171} - [SASInprocServer32] (file missing)
O2 - BHO: (no name) - {C079AFE5-AC16-4F43-809E-C496AC8BFA35} - [SASInprocServer32] (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Memory Allocation Services] cisrv.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ssqpo.dll,#1
O4 - HKCU\..\Run: [PhaseFireWireService] "C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/lib/stats/support/plugins/ebraryRdr.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

:::::::::::::::::::::::::::::::::::::::::::::::

********************************* ROOTCHK-(28-12-07)-LOG, by ejvindh
07-02-2008 14:10:42,95

NOTICE!! Rootchk is not being updated anymore, and is thus gradually getting outdated.
Last update was made 28-12-07

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 14:10:46
Windows 6.0.6000
scanning hidden processes ...
IPC error: 2 The system cannot find the file specified.

scanning hidden services & system hive ...
IPC error: 2 The system cannot find the file specified.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:37,6e,da,57,0c,2f,d1,0c,27,48,92,1f,6c,8d,32,48,5b,9a,df,40,95,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d5,31,f8,39,e4,d7,24,f7,8b,41,5b,98,e6,67,9f,55,74,b2,29,dd,83,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:37,6e,da,57,0c,2f,d1,0c,27,48,92,1f,6c,8d,32,48,5b,9a,df,40,95,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d5,31,f8,39,e4,d7,24,f7,8b,41,5b,98,e6,67,9f,55,74,b2,29,dd,83,..

scanning hidden registry entries ...

scanning hidden files ...
IPC error: 2 The system cannot find the file specified.

hidden processes: 0
hidden services: 0
hidden files: 0


:::::::::::::::::::::::::::::::::::::::::::::::
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/07/2008 at 01:48 PM

Application Version : 3.7.1018

Core Rules Database Version : 3330
Trace Rules Database Version: 1331

Scan type      : Complete Scan
Total Scan Time : 00:36:26

Memory items scanned      : 282
Memory threats detected  : 1
Registry items scanned    : 7500
Registry threats detected : 0
File items scanned        : 81328
File threats detected    : 44

Adware.Vundo Variant/Resident
    C:\WINDOWS\SYSTEM32\GEBBC.DLL
    C:\WINDOWS\SYSTEM32\GEBBC.DLL

Adware.Tracking Cookie
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@edsa.122.2o7[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@rocku.adbureau[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@serving-sys[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ilead.itrack[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ads.techguy[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@zbox.zanox[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@gms.adbureau[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@doubleclick[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@tribalfusion[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@divx.112.2o7[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ads2.jubii[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ad.yieldmanager[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@advertising[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@track.adform[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@d0004.77tracking[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@2o7[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@adopt.euroclick[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@eas.apm.emediate[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@www.zanox-affiliate[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@3.adbrite[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ads2.gamereactor[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@mallingbeck.mediaxtor[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ads.adbrite[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@atdmt[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@riptownmedia.122.2o7[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@partygaming.122.2o7[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@adtech[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@track.webtrekk[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@shop.zanox[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@imrworldwide[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@bs.serving-sys[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@server.iad.liveperson[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ad1.emediate[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@clicktorrent[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@www.googleadservices[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@overture[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@e2.emediate[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@adbrite[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@partypoker[1].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@ad.zanox[2].txt
    C:\Users\Mads Lykke\AppData\Roaming\Microsoft\Windows\Cookies\mads_lykke@bestsellerantivirus[1].txt
    D:\Documents and Settings\Mads Lykke\Cookies\mads_lykke@adtech[1].txt
    D:\Documents and Settings\Mads Lykke\Cookies\mads_lykke@www6.addfreestats[1].txt

:::::::::::::::::::::::::::::::::::::::::::::

Jeg ser frem til at at høre fra dig igen, fromsej
Avatar billede fromsej Praktikant
07. februar 2008 - 15:12 #4
Prøv lige Combofix fra fejlsikret tilstand, stadig med højreklik->kør som administrator.

Af uransagelige årsager modtager jeg ikke mails fra Eksperten i øjeblikket, men jeg skal nok holde øje med tråden.
Avatar billede snifx Nybegynder
07. februar 2008 - 15:29 #5
Så lykkedes det at lave en log fra Combofix i fejlsikret tilstand:

ComboFix 08-02.05.3 - Mads Lykke 2008-02-07 15:24:06.2 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Business  6.0.6000.0.1252.1.1033.18.2899 [GMT 1:00]
Running from: C:\Users\Mads Lykke\Desktop\clean\ComboFix.exe
.

(((((((((((((((((((((((((  Files Created from 2008-01-07 to 2008-02-07  )))))))))))))))))))))))))))))))
.

2008-02-07 14:11 . 2006-11-02 10:44    320,000    --a------    C:\kmd.exe
2008-02-07 14:10 . 2008-02-07 14:10    244    --ah-----    C:\sqmnoopt12.sqm
2008-02-07 14:10 . 2008-02-07 14:10    232    --ah-----    C:\sqmdata12.sqm
2008-02-07 14:04 . 2008-02-07 14:04    244    --ah-----    C:\sqmnoopt11.sqm
2008-02-07 14:04 . 2008-02-07 14:04    232    --ah-----    C:\sqmdata11.sqm
2008-02-07 13:05 . 2008-02-07 14:35    <DIR>    d--------    C:\Program Files\SUPERAntiSpyware
2008-02-07 13:02 . 2008-02-07 13:02    <DIR>    d--------    C:\Program Files\CCleaner
2008-02-07 12:07 . 2008-02-07 12:07    244    --ah-----    C:\sqmnoopt10.sqm
2008-02-07 12:07 . 2008-02-07 12:07    232    --ah-----    C:\sqmdata10.sqm
2008-02-07 11:52 . 2008-02-07 11:52    244    --ah-----    C:\sqmnoopt09.sqm
2008-02-07 11:52 . 2008-02-07 11:52    232    --ah-----    C:\sqmdata09.sqm
2008-02-07 11:48 . 2008-02-07 12:32    245    --a------    C:\Windows\wininit.ini
2008-02-07 11:26 . 2008-02-07 11:26    <DIR>    d--------    C:\Program Files\Spybot - Search & Destroy
2008-02-07 11:05 . 2008-02-07 11:05    244    --ah-----    C:\sqmnoopt08.sqm
2008-02-07 11:05 . 2008-02-07 11:05    232    --ah-----    C:\sqmdata08.sqm
2008-01-31 11:28 . 2008-02-06 12:18    844    --a------    C:\Windows\bookcase.ini
2008-01-31 11:27 . 2008-02-06 12:18    <DIR>    d--------    C:\Program Files\Ordbog
2008-01-26 14:16 . 2008-01-26 14:16    <DIR>    d--------    C:\Program Files\DivX
2008-01-22 12:55 . 2008-01-22 12:55    <DIR>    d--------    C:\Program Files\SystemRequirementsLab
2008-01-19 11:08 . 2008-01-19 11:08    621,056    --a------    C:\Windows\System32\drivers\dxgkrnl.sys
2008-01-19 11:08 . 2008-01-19 11:08    36,864    --a------    C:\Windows\System32\cdd.dll
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Windows\System32\drivers\PnkBstrK.sys
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Users\Mads Lykke\AppData\Roaming\PnkBstrK.sys
2008-01-19 11:05 . 2007-07-19 18:14    1,358,192    --a------    C:\Windows\System32\D3DCompiler_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    669,184    --a------    C:\Windows\System32\pbsvc.exe
2008-01-19 11:05 . 2007-07-19 18:14    444,776    --a------    C:\Windows\System32\d3dx10_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    103,736    --a------    C:\Windows\System32\PnkBstrB.exe
2008-01-19 11:05 . 2008-01-19 11:05    66,872    --a------    C:\Windows\System32\PnkBstrA.exe
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\Users\All Users\Media Center Programs
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\ProgramData\Media Center Programs
2008-01-15 01:17 . 2008-01-15 01:17    305    --a------    C:\Windows\game.ini
2008-01-15 01:02 . 2008-01-15 01:02    <DIR>    d--hs----    C:\Windows\ftpcache
2008-01-15 00:53 . 2008-01-15 00:53    <DIR>    d--------    C:\Program Files\Alcohol Soft
2008-01-08 21:44 . 2008-01-08 21:44    802,816    --a------    C:\Windows\System32\drivers\tcpip.sys
2008-01-08 21:44 . 2008-01-08 21:44    216,760    --a------    C:\Windows\System32\drivers\netio.sys
2008-01-08 21:44 . 2008-01-08 21:44    167,424    --a------    C:\Windows\System32\tcpipcfg.dll
2008-01-08 21:44 . 2008-01-08 21:44    24,064    --a------    C:\Windows\System32\netcfg.exe
2008-01-08 21:44 . 2008-01-08 21:44    22,016    --a------    C:\Windows\System32\netiougc.exe
2008-01-08 21:43 . 2008-01-08 21:43    4,247,552    --a------    C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,686,016    --a------    C:\Windows\System32\gameux.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,060,920    --a------    C:\Windows\System32\drivers\ntfs.sys
2008-01-08 21:43 . 2008-01-08 21:43    211,000    --a------    C:\Windows\System32\drivers\volsnap.sys
2008-01-08 21:43 . 2008-01-08 21:43    154,624    --a------    C:\Windows\System32\drivers\nwifi.sys
2008-01-08 21:43 . 2008-01-08 21:43    109,624    --a------    C:\Windows\System32\drivers\ataport.sys
2008-01-08 21:43 . 2008-01-08 21:43    45,112    --a------    C:\Windows\System32\drivers\pciidex.sys
2008-01-08 21:43 . 2008-01-08 21:43    21,560    --a------    C:\Windows\System32\drivers\atapi.sys
2008-01-08 21:43 . 2008-01-08 21:43    15,928    --a------    C:\Windows\System32\drivers\pciide.sys
2008-01-08 21:43 . 2008-01-08 21:43    11,776    --a------    C:\Windows\System32\sbunattend.exe

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 14:18    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\uTorrent
2008-02-07 12:10    ---------    d-----w    C:\ProgramData\FLEXnet
2008-02-07 12:04    ---------    d-----w    C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 10:48    ---------    d-----w    C:\ProgramData\Spybot - Search & Destroy
2008-02-06 14:10    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\foobar2000
2008-01-22 12:14    ---------    d-----w    C:\ProgramData\NVIDIA
2008-01-17 19:23    ---------    d-----w    C:\Program Files\Common Files\Steam
2008-01-15 00:17    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-01-14 23:52    715,248    ----a-w    C:\Windows\system32\drivers\sptd.sys
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Sidebar
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Mail
2008-01-08 20:43    537,600    ----a-w    C:\Windows\AppPatch\AcLayers.dll
2008-01-08 20:43    449,024    ----a-w    C:\Windows\AppPatch\AcSpecfc.dll
2008-01-08 20:43    2,143,744    ----a-w    C:\Windows\AppPatch\AcGenral.dll
2008-01-08 20:43    173,056    ----a-w    C:\Windows\AppPatch\AcXtrnal.dll
2008-01-05 18:34    ---------    d-----w    C:\Program Files\PowerISO
2008-01-03 15:21    ---------    d-----w    C:\Program Files\Cisco Systems
2008-01-03 15:17    ---------    d-----w    C:\Program Files\Common Files\Deterministic Networks
2008-01-01 18:02    ---------    d-----w    C:\Program Files\Common Files\Adobe
2008-01-01 17:39    ---------    d-----w    C:\Program Files\Bonjour
2008-01-01 17:33    ---------    d-----w    C:\Program Files\Common Files\Macrovision Shared
2007-12-29 10:45    306,432    ----a-w    C:\Windows\System32\TuneUpDefragService.exe
2007-12-29 10:45    ---------    d-----w    C:\ProgramData\TuneUp Software
2007-12-29 10:45    ---------    d-----w    C:\Program Files\TuneUp Utilities 2008
2007-12-20 09:44    16,640    ----a-w    C:\Windows\System32\authuitu.dll
2007-12-20 09:41    29,440    ----a-w    C:\Windows\System32\uxtuneup.dll
2007-12-14 19:17    ---------    d-----w    C:\Program Files\VirtualDub 1.7.7
2007-12-14 17:19    ---------    d-----w    C:\ProgramData\Minnetonka Audio Software
2007-12-14 12:48    ---------    d-----w    C:\ProgramData\Microsoft Help
2007-12-13 21:07    9,728    ----a-w    C:\Windows\System32\LAPRXY.DLL
2007-12-13 21:07    824,832    ----a-w    C:\Windows\System32\wininet.dll
2007-12-13 21:07    56,320    ----a-w    C:\Windows\System32\iesetup.dll
2007-12-13 21:07    52,736    ----a-w    C:\Windows\AppPatch\iebrshim.dll
2007-12-13 21:07    26,624    ----a-w    C:\Windows\System32\ieUnatt.exe
2007-12-13 21:07    223,232    ----a-w    C:\Windows\System32\WMASF.DLL
2007-12-13 21:07    1,327,104    ----a-w    C:\Windows\System32\quartz.dll
2007-12-13 21:06    84,992    ----a-w    C:\Windows\system32\drivers\srvnet.sys
2007-12-13 21:06    58,368    ----a-w    C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-13 21:06    3,504,824    ----a-w    C:\Windows\System32\ntkrnlpa.exe
2007-12-13 21:06    3,470,520    ----a-w    C:\Windows\System32\ntoskrnl.exe
2007-12-13 21:06    130,048    ----a-w    C:\Windows\system32\drivers\srv2.sys
2007-12-13 21:06    101,888    ----a-w    C:\Windows\system32\drivers\mrxsmb.sys
2007-12-13 16:59    ---------    d-----w    C:\Program Files\LD-Anime
2007-12-11 17:52    356,352    ----a-w    C:\Windows\System32\nvuninst.exe
2007-12-11 16:06    86,016    ----a-w    C:\Windows\System32\nvsvc.dll
2007-12-11 16:06    81,920    ----a-w    C:\Windows\System32\nvmctray.dll
2007-12-11 16:06    8,530,464    ----a-w    C:\Windows\System32\nvcpl.dll
2007-12-11 16:06    8,238,688    ----a-w    C:\Windows\system32\drivers\nvlddmkm.sys
2007-12-11 16:06    795,104    ----a-w    C:\Windows\System32\dpinst.exe
2007-12-11 16:06    753,664    ----a-w    C:\Windows\System32\nvcplui.exe
2007-12-11 16:06    7,098,368    ----a-w    C:\Windows\System32\nvoglv32.dll
2007-12-11 16:06    6,549,504    ----a-w    C:\Windows\System32\nvdisps.dll
2007-12-11 16:06    5,263,360    ----a-w    C:\Windows\System32\nvd3dum.dll
2007-12-11 16:06    45,056    ----a-w    C:\Windows\System32\nvmccsrs.dll
2007-12-11 16:06    385,024    ----a-w    C:\Windows\System32\nvapi.dll
2007-12-11 16:06    356,352    ----a-w    C:\Windows\System32\nvudisp.exe
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod100.dll
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod.dll
2007-12-11 16:06    307,200    ----a-w    C:\Windows\System32\nvexpbar.dll
2007-12-11 16:06    3,710,976    ----a-w    C:\Windows\System32\nvvitvs.dll
2007-12-11 16:06    3,420,160    ----a-w    C:\Windows\System32\nvgames.dll
2007-12-11 16:06    229,376    ----a-w    C:\Windows\System32\nvmccs.dll
2007-12-11 16:06    2,498,560    ----a-w    C:\Windows\System32\nvwss.dll
2007-12-11 16:06    188,416    ----a-w    C:\Windows\System32\nvmccss.dll
2007-12-11 16:06    147,456    ----a-w    C:\Windows\System32\nvcolor.exe
2007-12-11 16:06    1,830,912    ----a-w    C:\Windows\System32\nvwgf2um.dll
2007-12-11 16:06    1,228,800    ----a-w    C:\Windows\System32\nvmobls.dll
2007-12-04 13:04    837,496    ----a-w    C:\Windows\System32\aswBoot.exe
2007-12-04 12:54    95,608    ----a-w    C:\Windows\System32\AvastSS.scr
2007-11-29 22:30    200,704    ----a-w    C:\Windows\System32\ssldivx.dll
2007-11-29 22:30    1,044,480    ----a-w    C:\Windows\System32\libdivx.dll
2007-11-20 18:17    107,888    ----a-w    C:\Windows\System32\CmdLineExt.dll
2007-10-10 21:45    174    --sha-w    C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D371865-5AD3-480A-8CAC-4992E64BA70A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1043F31E-931E-4E2C-BBAD-35F4C715540A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19C7FA80-CFFB-4052-8A9A-176FD6AE5374}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1DD2E707-579E-402F-95CD-99AB71049B5F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2135C9A8-22FF-4BF7-8E0D-01833C775C8A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D5509C6-B160-4E0E-A756-42C9249D2FAA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DB6DB0D-FBB0-4F00-93C0-44CC87C5FD8F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DCD1CF4-8572-4BD3-8B44-D23400CD9A66}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FC74B0A-07E5-4173-96EC-6B218360C972}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FEF87D3-D62C-40F3-AFEA-00D674086437}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DB0876E-B069-454E-A637-156784C87162}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F8F8CDD-E0B9-45B1-84AE-2C16B48DB608}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5096F4A5-8454-4D96-90C3-DC6D26E948C1}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54381471-743A-4B3D-B61D-6D3E75BBED87}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58474119-7C8C-422E-AAC2-3FC9462E51D4}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9BC2C2-C6A1-4130-BAE9-681EC80C1010}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61FA5A5A-2D55-400F-A13B-7F29742C2845}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62FCB793-6A12-489F-AC67-4E1626D599B9}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A21A42E-5EE9-44F7-BDCA-88A5233FFF77}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7631C3C4-B2E6-4703-801C-4DA8FCD23310}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82D07083-A334-4935-8E8C-6270BF5D59A3}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8411C92A-0880-4C81-882A-7715A5CFBBDA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8890A90A-D27E-4699-A149-6C515CC3E09A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{895E31D2-D2F9-4401-A2AA-7743C65B947C}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CD4E28B-CAF4-472C-8B40-F512A52EDD51}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D35636B-24F3-403A-B575-D81DC11FD742}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E909C06-F7B0-4802-8C66-695F10C048D3}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{956F9EDE-149F-4BCC-91A4-4E8AFE077A01}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970547C0-2629-41B1-8EA6-44A45AF53C0B}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970585B2-E201-4951-8770-6F7AC2CFAD3A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9A3F6BED-5498-4987-9AE1-25598D6AB4FC}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E60AB92-E4C8-4257-A149-7C53472473DA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9EF214F0-B481-4D44-9D7C-0FF7D79CBE94}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A165B2B4-E264-458B-B1AF-D4BE09A9A88C}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3703CD5-0401-4BBF-969F-CD01B6EE45E0}]
            C:\Windows\system32\gebbc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5A09B4A-A8F9-4845-B54D-304897FE2F53}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9C3B349-FFBA-4DA9-818F-B0A7A4046039}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BFF13CF6-BB9A-4D73-BDEB-4DEC2CE75171}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C079AFE5-AC16-4F43-809E-C496AC8BFA35}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4C5C903-3102-4521-87E6-615B7ACCDE5F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E463D6A8-35D8-4933-9ECB-3277B03D2863}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhaseFireWireService"="C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe" [2007-04-13 12:03 110592]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46 1318128]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB2912"="command /c del C:\Windows\System32\gebbc.dll" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-10 22:30 1006264]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 22:48 479232]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 07:36 36864]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\Windows\KHALMNPR.Exe]
"Memory Allocation Services"="cisrv.exe" []
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A00CA75C-DEDD-4474-9088-5D6363D69338}"= C:\WINDOWS\SYSTEM32\SSQPO.DLL [ ]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\Windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\Windows\pss\Adobe Gamma.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=C:\Windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 22:46 624248 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 08:23 221568 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-09-20 14:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-09-20 08:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2007-04-02 17:32 1261568 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundTray]
--a------ 2007-04-01 11:44 49152 C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 22:04 1266936 I:\Programmer\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;C:\Windows\system32\DRIVERS\rtlprot.sys [2007-04-02 09:57]
S2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-05 23:44]
S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187.sys [2007-11-19 06:59]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\Windows\system32\DRIVERS\s125bus.sys [2007-04-24 08:33]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s125mdfl.sys [2007-04-24 08:33]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s125mdm.sys [2007-04-24 08:33]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s125mgmt.sys [2007-04-24 08:33]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s125obex.sys [2007-04-24 08:33]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-17 20:22]
S3 TTFWgsif;TTFWgsif;C:\Windows\system32\Drivers\TTFWgsif.sys [2005-11-29 17:33]
S3 TTPhase1394;TTPhase1394;C:\Windows\system32\Drivers\TTPhase1394.sys [2007-06-22 23:04]
S3 TTPhaseA;TTPhaseA;C:\Windows\system32\Drivers\TTPhaseA.sys [2007-06-22 23:03]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2007-12-29 11:45]
S3 viaagp;VIA AGP Bus Filter;C:\Windows\system32\drivers\viaagp.sys [2006-11-02 10:49]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork    REG_MULTI_SZ      PLA DPS BFE mpssvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Autoplay.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f977e545-7773-11dc-be70-806e6f6e6963}]
\shell\AutoRun\command - E:\.\Bin\Assetup.exe

*Newly Created Service* - ECACHE
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:16:45 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 15:25:55
Windows 6.0.6000  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-07 15:26:12
ComboFix-quarantined-files.txt  2008-02-07 14:26:10
ComboFix2.txt  2008-02-07 13:31:44
.
2008-02-06 07:28:01    --- E O F --- 

:::::::::::::::::::::::::::::::::::

Jeg modtager forresten heller ikke beskeder fra Eksperten.
Avatar billede fromsej Praktikant
08. februar 2008 - 09:54 #6
Åbn et Notesblokvindue, kopiér indholdet mellem de bølgede linier ind i dokumentet, og gem indholdet i samme mappe, som Combofix ligger med navnet CFScript.txt. Når du gemmer, skal du sikre, at der under "filtyper" står "alle filer".

~~~~~~~~~~~~~~~~~~~~~~~~~~

Killall::

File::
C:\WINDOWS\SYSTEM32\WVUSR.DLL
C:\Windows\system32\gebbc.dll
C:\WINDOWS\system32\cisrv.exe
C:\WINDOWS\SYSTEM32\SSQPO.DLL

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D371865-5AD3-480A-8CAC-4992E64BA70A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1043F31E-931E-4E2C-BBAD-35F4C715540A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19C7FA80-CFFB-4052-8A9A-176FD6AE5374}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1DD2E707-579E-402F-95CD-99AB71049B5F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2135C9A8-22FF-4BF7-8E0D-01833C775C8A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D5509C6-B160-4E0E-A756-42C9249D2FAA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DB6DB0D-FBB0-4F00-93C0-44CC87C5FD8F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DCD1CF4-8572-4BD3-8B44-D23400CD9A66}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FC74B0A-07E5-4173-96EC-6B218360C972}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FEF87D3-D62C-40F3-AFEA-00D674086437}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DB0876E-B069-454E-A637-156784C87162}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F8F8CDD-E0B9-45B1-84AE-2C16B48DB608}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5096F4A5-8454-4D96-90C3-DC6D26E948C1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54381471-743A-4B3D-B61D-6D3E75BBED87}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58474119-7C8C-422E-AAC2-3FC9462E51D4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9BC2C2-C6A1-4130-BAE9-681EC80C1010}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61FA5A5A-2D55-400F-A13B-7F29742C2845}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62FCB793-6A12-489F-AC67-4E1626D599B9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A21A42E-5EE9-44F7-BDCA-88A5233FFF77}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7631C3C4-B2E6-4703-801C-4DA8FCD23310}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82D07083-A334-4935-8E8C-6270BF5D59A3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8411C92A-0880-4C81-882A-7715A5CFBBDA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8890A90A-D27E-4699-A149-6C515CC3E09A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{895E31D2-D2F9-4401-A2AA-7743C65B947C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CD4E28B-CAF4-472C-8B40-F512A52EDD51}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D35636B-24F3-403A-B575-D81DC11FD742}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E909C06-F7B0-4802-8C66-695F10C048D3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{956F9EDE-149F-4BCC-91A4-4E8AFE077A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970547C0-2629-41B1-8EA6-44A45AF53C0B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970585B2-E201-4951-8770-6F7AC2CFAD3A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9A3F6BED-5498-4987-9AE1-25598D6AB4FC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E60AB92-E4C8-4257-A149-7C53472473DA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9EF214F0-B481-4D44-9D7C-0FF7D79CBE94}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A165B2B4-E264-458B-B1AF-D4BE09A9A88C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3703CD5-0401-4BBF-969F-CD01B6EE45E0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5A09B4A-A8F9-4845-B54D-304897FE2F53}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9C3B349-FFBA-4DA9-818F-B0A7A4046039}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BFF13CF6-BB9A-4D73-BDEB-4DEC2CE75171}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C079AFE5-AC16-4F43-809E-C496AC8BFA35}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4C5C903-3102-4521-87E6-615B7ACCDE5F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E463D6A8-35D8-4933-9ECB-3277B03D2863}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB2912"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Memory Allocation Services"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A00CA75C-DEDD-4474-9088-5D6363D69338}"=-

~~~~~~~~~~~~~~~~~~~~~~~~~~
Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
---------------------------------------
Vi skal se en frisk hijackthislog, samt den nye combofixlog der åbner.
Avatar billede snifx Nybegynder
08. februar 2008 - 10:11 #7
EFter at have kørt Combofix med den txt-fil genstartede Windows, men der dukkede ikke en log-fil frem. Widows kom også med en dialogboks, der omhandlede en forkert nedlukning... og spurgte om jeg ville sende en fejlrapport og se mulige løsninger.

Er det muligt at lave en ny log-fil, eller skal Combofix køres igen?
Avatar billede snifx Nybegynder
08. februar 2008 - 10:18 #8
Dialog-boksen siger følgende:

"Windows has recovered from an unexpected shutdown".

Under detaljer står der:

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.0.6000.2.0.0.256.6
  Locale ID:    1030

Additional information about the problem:
  BCCode:    c000021a
  BCP1:    A3D38CA0
  BCP2:    C0000001
  BCP3:    00000000
  BCP4:    00000000
  OS Version:    6_0_6000
  Service Pack:    0_0
  Product:    256_1

Files that help describe the problem:
  C:\Windows\Minidump\Mini020808-02.dmp
  C:\Users\Mads Lykke\AppData\Local\Temp\WER-39577-0.sysdata.xml
  C:\Users\Mads Lykke\AppData\Local\Temp\WERB46F.tmp.version.txt

Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
Avatar billede fromsej Praktikant
08. februar 2008 - 10:27 #9
Kør combofix igen.

Den log fra windows kan jeg ikke tyde alligevel. ;-)
Avatar billede snifx Nybegynder
08. februar 2008 - 10:33 #10
Har netop kørt Combofix igen. Samme resultat - ingen log!
Avatar billede snifx Nybegynder
08. februar 2008 - 10:35 #11
kan jeg evt. køre COmbofix i fejlsikret tilstand?
Avatar billede fromsej Praktikant
08. februar 2008 - 10:59 #12
Ja, det burde gøre tricket, husk at højreklikke og Kør som administrator.
Avatar billede snifx Nybegynder
08. februar 2008 - 12:15 #13
Hvordan kan jeg både køre Combofix med den valgte txt.fil, og samtidig højreklikke og køre som administrator?
Avatar billede fromsej Praktikant
08. februar 2008 - 12:20 #14
Nu var jeg ikke forberedt på lige netop det spørgsmål. ;-)

Du har prøvet med CFScript, hvor den kørte inden det gik galt, så prøv at lave en frisk Combofixlog uden at køre CFScriptet, så tager vi den derfra.
Avatar billede snifx Nybegynder
08. februar 2008 - 12:40 #15
Her en en Combofix-log kørt fra fejlsikret tilstand:
_____________________________________________________________


ComboFix 08-02.05.3 - Mads Lykke 2008-02-08 12:33:24.3 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Business  6.0.6000.0.1252.1.1033.18.2889 [GMT 1:00]
Running from: C:\Users\Mads Lykke\Desktop\clean\ComboFix.exe
.

(((((((((((((((((((((((((  Files Created from 2008-01-08 to 2008-02-08  )))))))))))))))))))))))))))))))
.

2008-02-08 10:06 . 2008-02-08 10:15    279,539,252    --a------    C:\Windows\MEMORY.DMP
2008-02-07 16:16 . 2008-02-07 16:16    54,156    --ah-----    C:\Windows\QTFont.qfn
2008-02-07 16:16 . 2008-02-07 16:16    1,409    --a------    C:\Windows\QTFont.for
2008-02-07 15:23 . 2006-11-02 10:44    320,000    --a------    C:\kmd.exe
2008-02-07 14:10 . 2008-02-07 14:10    244    --ah-----    C:\sqmnoopt12.sqm
2008-02-07 14:10 . 2008-02-07 14:10    232    --ah-----    C:\sqmdata12.sqm
2008-02-07 14:04 . 2008-02-07 14:04    244    --ah-----    C:\sqmnoopt11.sqm
2008-02-07 14:04 . 2008-02-07 14:04    232    --ah-----    C:\sqmdata11.sqm
2008-02-07 13:05 . 2008-02-07 14:35    <DIR>    d--------    C:\Program Files\SUPERAntiSpyware
2008-02-07 13:02 . 2008-02-07 13:02    <DIR>    d--------    C:\Program Files\CCleaner
2008-02-07 12:07 . 2008-02-07 12:07    244    --ah-----    C:\sqmnoopt10.sqm
2008-02-07 12:07 . 2008-02-07 12:07    232    --ah-----    C:\sqmdata10.sqm
2008-02-07 11:52 . 2008-02-07 11:52    244    --ah-----    C:\sqmnoopt09.sqm
2008-02-07 11:52 . 2008-02-07 11:52    232    --ah-----    C:\sqmdata09.sqm
2008-02-07 11:48 . 2008-02-07 12:32    245    --a------    C:\Windows\wininit.ini
2008-02-07 11:26 . 2008-02-07 11:26    <DIR>    d--------    C:\Program Files\Spybot - Search & Destroy
2008-02-07 11:05 . 2008-02-07 11:05    244    --ah-----    C:\sqmnoopt08.sqm
2008-02-07 11:05 . 2008-02-07 11:05    232    --ah-----    C:\sqmdata08.sqm
2008-01-31 11:28 . 2008-02-06 12:18    844    --a------    C:\Windows\bookcase.ini
2008-01-31 11:27 . 2008-02-06 12:18    <DIR>    d--------    C:\Program Files\Ordbog
2008-01-26 14:16 . 2008-01-26 14:16    <DIR>    d--------    C:\Program Files\DivX
2008-01-22 12:55 . 2008-01-22 12:55    <DIR>    d--------    C:\Program Files\SystemRequirementsLab
2008-01-19 11:08 . 2008-01-19 11:08    621,056    --a------    C:\Windows\System32\drivers\dxgkrnl.sys
2008-01-19 11:08 . 2008-01-19 11:08    36,864    --a------    C:\Windows\System32\cdd.dll
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Windows\System32\drivers\PnkBstrK.sys
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Users\Mads Lykke\AppData\Roaming\PnkBstrK.sys
2008-01-19 11:05 . 2007-07-19 18:14    1,358,192    --a------    C:\Windows\System32\D3DCompiler_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    669,184    --a------    C:\Windows\System32\pbsvc.exe
2008-01-19 11:05 . 2007-07-19 18:14    444,776    --a------    C:\Windows\System32\d3dx10_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    103,736    --a------    C:\Windows\System32\PnkBstrB.exe
2008-01-19 11:05 . 2008-01-19 11:05    66,872    --a------    C:\Windows\System32\PnkBstrA.exe
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\Users\All Users\Media Center Programs
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\ProgramData\Media Center Programs
2008-01-15 01:17 . 2008-01-15 01:17    305    --a------    C:\Windows\game.ini
2008-01-15 01:02 . 2008-01-15 01:02    <DIR>    d--hs----    C:\Windows\ftpcache
2008-01-15 00:53 . 2008-01-15 00:53    <DIR>    d--------    C:\Program Files\Alcohol Soft
2008-01-08 21:44 . 2008-01-08 21:44    802,816    --a------    C:\Windows\System32\drivers\tcpip.sys
2008-01-08 21:44 . 2008-01-08 21:44    216,760    --a------    C:\Windows\System32\drivers\netio.sys
2008-01-08 21:44 . 2008-01-08 21:44    167,424    --a------    C:\Windows\System32\tcpipcfg.dll
2008-01-08 21:44 . 2008-01-08 21:44    24,064    --a------    C:\Windows\System32\netcfg.exe
2008-01-08 21:44 . 2008-01-08 21:44    22,016    --a------    C:\Windows\System32\netiougc.exe
2008-01-08 21:43 . 2008-01-08 21:43    4,247,552    --a------    C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,686,016    --a------    C:\Windows\System32\gameux.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,060,920    --a------    C:\Windows\System32\drivers\ntfs.sys
2008-01-08 21:43 . 2008-01-08 21:43    211,000    --a------    C:\Windows\System32\drivers\volsnap.sys
2008-01-08 21:43 . 2008-01-08 21:43    154,624    --a------    C:\Windows\System32\drivers\nwifi.sys
2008-01-08 21:43 . 2008-01-08 21:43    109,624    --a------    C:\Windows\System32\drivers\ataport.sys
2008-01-08 21:43 . 2008-01-08 21:43    45,112    --a------    C:\Windows\System32\drivers\pciidex.sys
2008-01-08 21:43 . 2008-01-08 21:43    21,560    --a------    C:\Windows\System32\drivers\atapi.sys
2008-01-08 21:43 . 2008-01-08 21:43    15,928    --a------    C:\Windows\System32\drivers\pciide.sys
2008-01-08 21:43 . 2008-01-08 21:43    11,776    --a------    C:\Windows\System32\sbunattend.exe

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 11:33    ---------    d-----w    C:\ProgramData\FLEXnet
2008-02-08 11:30    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\uTorrent
2008-02-07 12:04    ---------    d-----w    C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 10:48    ---------    d-----w    C:\ProgramData\Spybot - Search & Destroy
2008-02-06 14:10    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\foobar2000
2008-01-22 12:14    ---------    d-----w    C:\ProgramData\NVIDIA
2008-01-17 19:23    ---------    d-----w    C:\Program Files\Common Files\Steam
2008-01-15 00:17    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-01-14 23:52    715,248    ----a-w    C:\Windows\system32\drivers\sptd.sys
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Sidebar
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Mail
2008-01-08 20:43    537,600    ----a-w    C:\Windows\AppPatch\AcLayers.dll
2008-01-08 20:43    449,024    ----a-w    C:\Windows\AppPatch\AcSpecfc.dll
2008-01-08 20:43    2,143,744    ----a-w    C:\Windows\AppPatch\AcGenral.dll
2008-01-08 20:43    173,056    ----a-w    C:\Windows\AppPatch\AcXtrnal.dll
2008-01-05 18:34    ---------    d-----w    C:\Program Files\PowerISO
2008-01-03 15:21    ---------    d-----w    C:\Program Files\Cisco Systems
2008-01-03 15:17    ---------    d-----w    C:\Program Files\Common Files\Deterministic Networks
2008-01-01 18:02    ---------    d-----w    C:\Program Files\Common Files\Adobe
2008-01-01 17:39    ---------    d-----w    C:\Program Files\Bonjour
2008-01-01 17:33    ---------    d-----w    C:\Program Files\Common Files\Macrovision Shared
2007-12-29 10:45    306,432    ----a-w    C:\Windows\System32\TuneUpDefragService.exe
2007-12-29 10:45    ---------    d-----w    C:\ProgramData\TuneUp Software
2007-12-29 10:45    ---------    d-----w    C:\Program Files\TuneUp Utilities 2008
2007-12-20 09:44    16,640    ----a-w    C:\Windows\System32\authuitu.dll
2007-12-20 09:41    29,440    ----a-w    C:\Windows\System32\uxtuneup.dll
2007-12-14 19:17    ---------    d-----w    C:\Program Files\VirtualDub 1.7.7
2007-12-14 17:19    ---------    d-----w    C:\ProgramData\Minnetonka Audio Software
2007-12-14 12:48    ---------    d-----w    C:\ProgramData\Microsoft Help
2007-12-13 21:07    9,728    ----a-w    C:\Windows\System32\LAPRXY.DLL
2007-12-13 21:07    824,832    ----a-w    C:\Windows\System32\wininet.dll
2007-12-13 21:07    56,320    ----a-w    C:\Windows\System32\iesetup.dll
2007-12-13 21:07    52,736    ----a-w    C:\Windows\AppPatch\iebrshim.dll
2007-12-13 21:07    26,624    ----a-w    C:\Windows\System32\ieUnatt.exe
2007-12-13 21:07    223,232    ----a-w    C:\Windows\System32\WMASF.DLL
2007-12-13 21:07    1,327,104    ----a-w    C:\Windows\System32\quartz.dll
2007-12-13 21:06    84,992    ----a-w    C:\Windows\system32\drivers\srvnet.sys
2007-12-13 21:06    58,368    ----a-w    C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-13 21:06    3,504,824    ----a-w    C:\Windows\System32\ntkrnlpa.exe
2007-12-13 21:06    3,470,520    ----a-w    C:\Windows\System32\ntoskrnl.exe
2007-12-13 21:06    130,048    ----a-w    C:\Windows\system32\drivers\srv2.sys
2007-12-13 21:06    101,888    ----a-w    C:\Windows\system32\drivers\mrxsmb.sys
2007-12-13 16:59    ---------    d-----w    C:\Program Files\LD-Anime
2007-12-11 17:52    356,352    ----a-w    C:\Windows\System32\nvuninst.exe
2007-12-11 16:06    86,016    ----a-w    C:\Windows\System32\nvsvc.dll
2007-12-11 16:06    81,920    ----a-w    C:\Windows\System32\nvmctray.dll
2007-12-11 16:06    8,530,464    ----a-w    C:\Windows\System32\nvcpl.dll
2007-12-11 16:06    8,238,688    ----a-w    C:\Windows\system32\drivers\nvlddmkm.sys
2007-12-11 16:06    795,104    ----a-w    C:\Windows\System32\dpinst.exe
2007-12-11 16:06    753,664    ----a-w    C:\Windows\System32\nvcplui.exe
2007-12-11 16:06    7,098,368    ----a-w    C:\Windows\System32\nvoglv32.dll
2007-12-11 16:06    6,549,504    ----a-w    C:\Windows\System32\nvdisps.dll
2007-12-11 16:06    5,263,360    ----a-w    C:\Windows\System32\nvd3dum.dll
2007-12-11 16:06    45,056    ----a-w    C:\Windows\System32\nvmccsrs.dll
2007-12-11 16:06    385,024    ----a-w    C:\Windows\System32\nvapi.dll
2007-12-11 16:06    356,352    ----a-w    C:\Windows\System32\nvudisp.exe
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod100.dll
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod.dll
2007-12-11 16:06    307,200    ----a-w    C:\Windows\System32\nvexpbar.dll
2007-12-11 16:06    3,710,976    ----a-w    C:\Windows\System32\nvvitvs.dll
2007-12-11 16:06    3,420,160    ----a-w    C:\Windows\System32\nvgames.dll
2007-12-11 16:06    229,376    ----a-w    C:\Windows\System32\nvmccs.dll
2007-12-11 16:06    2,498,560    ----a-w    C:\Windows\System32\nvwss.dll
2007-12-11 16:06    188,416    ----a-w    C:\Windows\System32\nvmccss.dll
2007-12-11 16:06    147,456    ----a-w    C:\Windows\System32\nvcolor.exe
2007-12-11 16:06    1,830,912    ----a-w    C:\Windows\System32\nvwgf2um.dll
2007-12-11 16:06    1,228,800    ----a-w    C:\Windows\System32\nvmobls.dll
2007-12-04 13:04    837,496    ----a-w    C:\Windows\System32\aswBoot.exe
2007-12-04 12:54    95,608    ----a-w    C:\Windows\System32\AvastSS.scr
2007-11-29 22:30    200,704    ----a-w    C:\Windows\System32\ssldivx.dll
2007-11-29 22:30    1,044,480    ----a-w    C:\Windows\System32\libdivx.dll
2007-11-20 18:17    107,888    ----a-w    C:\Windows\System32\CmdLineExt.dll
2007-10-10 21:45    174    --sha-w    C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D371865-5AD3-480A-8CAC-4992E64BA70A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1043F31E-931E-4E2C-BBAD-35F4C715540A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19C7FA80-CFFB-4052-8A9A-176FD6AE5374}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1DD2E707-579E-402F-95CD-99AB71049B5F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2135C9A8-22FF-4BF7-8E0D-01833C775C8A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D5509C6-B160-4E0E-A756-42C9249D2FAA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DB6DB0D-FBB0-4F00-93C0-44CC87C5FD8F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2DCD1CF4-8572-4BD3-8B44-D23400CD9A66}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FC74B0A-07E5-4173-96EC-6B218360C972}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FEF87D3-D62C-40F3-AFEA-00D674086437}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4DB0876E-B069-454E-A637-156784C87162}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F8F8CDD-E0B9-45B1-84AE-2C16B48DB608}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5096F4A5-8454-4D96-90C3-DC6D26E948C1}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54381471-743A-4B3D-B61D-6D3E75BBED87}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58474119-7C8C-422E-AAC2-3FC9462E51D4}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A9BC2C2-C6A1-4130-BAE9-681EC80C1010}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61FA5A5A-2D55-400F-A13B-7F29742C2845}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62FCB793-6A12-489F-AC67-4E1626D599B9}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A21A42E-5EE9-44F7-BDCA-88A5233FFF77}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7631C3C4-B2E6-4703-801C-4DA8FCD23310}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7AF268D9-5ABE-40C6-A923-14418865A835}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82D07083-A334-4935-8E8C-6270BF5D59A3}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8411C92A-0880-4C81-882A-7715A5CFBBDA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8890A90A-D27E-4699-A149-6C515CC3E09A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{895E31D2-D2F9-4401-A2AA-7743C65B947C}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CD4E28B-CAF4-472C-8B40-F512A52EDD51}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D35636B-24F3-403A-B575-D81DC11FD742}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E909C06-F7B0-4802-8C66-695F10C048D3}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{956F9EDE-149F-4BCC-91A4-4E8AFE077A01}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970547C0-2629-41B1-8EA6-44A45AF53C0B}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{970585B2-E201-4951-8770-6F7AC2CFAD3A}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9A3F6BED-5498-4987-9AE1-25598D6AB4FC}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E60AB92-E4C8-4257-A149-7C53472473DA}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9EF214F0-B481-4D44-9D7C-0FF7D79CBE94}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A165B2B4-E264-458B-B1AF-D4BE09A9A88C}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3703CD5-0401-4BBF-969F-CD01B6EE45E0}]
            C:\Windows\system32\gebbc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B5A09B4A-A8F9-4845-B54D-304897FE2F53}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9C3B349-FFBA-4DA9-818F-B0A7A4046039}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BFF13CF6-BB9A-4D73-BDEB-4DEC2CE75171}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C079AFE5-AC16-4F43-809E-C496AC8BFA35}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4C5C903-3102-4521-87E6-615B7ACCDE5F}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E463D6A8-35D8-4933-9ECB-3277B03D2863}]
            C:\WINDOWS\SYSTEM32\WVUSR.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhaseFireWireService"="C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe" [2007-04-13 12:03 110592]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46 1318128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-10 22:30 1006264]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 22:48 479232]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 07:36 36864]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\Windows\KHALMNPR.Exe]
"Memory Allocation Services"="cisrv.exe" []
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A00CA75C-DEDD-4474-9088-5D6363D69338}"= C:\WINDOWS\SYSTEM32\SSQPO.DLL [ ]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\Windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\Windows\pss\Adobe Gamma.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=C:\Windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 22:46 624248 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 08:23 221568 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-09-20 14:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-09-20 08:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2007-04-02 17:32 1261568 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundTray]
--a------ 2007-04-01 11:44 49152 C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 22:04 1266936 I:\Programmer\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;C:\Windows\system32\DRIVERS\rtlprot.sys [2007-04-02 09:57]
S2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-05 23:44]
S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187.sys [2007-11-19 06:59]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\Windows\system32\DRIVERS\s125bus.sys [2007-04-24 08:33]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s125mdfl.sys [2007-04-24 08:33]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s125mdm.sys [2007-04-24 08:33]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s125mgmt.sys [2007-04-24 08:33]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s125obex.sys [2007-04-24 08:33]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-17 20:22]
S3 TTFWgsif;TTFWgsif;C:\Windows\system32\Drivers\TTFWgsif.sys [2005-11-29 17:33]
S3 TTPhase1394;TTPhase1394;C:\Windows\system32\Drivers\TTPhase1394.sys [2007-06-22 23:04]
S3 TTPhaseA;TTPhaseA;C:\Windows\system32\Drivers\TTPhaseA.sys [2007-06-22 23:03]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2007-12-29 11:45]
S3 viaagp;VIA AGP Bus Filter;C:\Windows\system32\drivers\viaagp.sys [2006-11-02 10:49]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork    REG_MULTI_SZ      PLA DPS BFE mpssvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Autoplay.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f977e545-7773-11dc-be70-806e6f6e6963}]
\shell\AutoRun\command - E:\.\Bin\Assetup.exe

*Newly Created Service* - ECACHE
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:16:45 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 12:35:22
Windows 6.0.6000  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 12:35:42
ComboFix-quarantined-files.txt  2008-02-08 11:35:39
ComboFix2.txt  2008-02-07 14:26:13
ComboFix3.txt  2008-02-07 13:31:44
.
2008-02-08 11:25:05    --- E O F ---
Avatar billede fromsej Praktikant
08. februar 2008 - 13:38 #16
Det var "¤"¤&/¤¤.

Så må vi prøve manuelt, højreklik på linket herunder, vælg Gem destination som, gen regfilen på skrivebordet.
Dobbeltklik så på killbho.reg svar Ja til at tilføje oplysningerne til regdatabasen.
Når den er færdig, genstart i fejlsikret, lav en frisk combofixlog, så må vi se om det hjælper.
http://www.fromsej.saknet.dk/download/killbho.reg
Avatar billede snifx Nybegynder
08. februar 2008 - 13:53 #17
Nedenstående log er fra Combofix, kørt i fejlsikret tilstand, efter tilføjelse af killbho.reg (sådan som du bad om):

:::::::::::::::::::::::

ComboFix 08-02.05.3 - Mads Lykke 2008-02-08 13:45:28.4 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Business  6.0.6000.0.1252.1.1033.18.2879 [GMT 1:00]
Running from: C:\Users\Mads Lykke\Desktop\clean\ComboFix.exe
.

(((((((((((((((((((((((((  Files Created from 2008-01-08 to 2008-02-08  )))))))))))))))))))))))))))))))
.

2008-02-08 10:06 . 2008-02-08 10:15    279,539,252    --a------    C:\Windows\MEMORY.DMP
2008-02-08 10:03 . 2006-11-02 10:44    320,000    --a------    C:\kmd.exe
2008-02-07 16:16 . 2008-02-07 16:16    54,156    --ah-----    C:\Windows\QTFont.qfn
2008-02-07 16:16 . 2008-02-07 16:16    1,409    --a------    C:\Windows\QTFont.for
2008-02-07 14:10 . 2008-02-07 14:10    244    --ah-----    C:\sqmnoopt12.sqm
2008-02-07 14:10 . 2008-02-07 14:10    232    --ah-----    C:\sqmdata12.sqm
2008-02-07 14:04 . 2008-02-07 14:04    244    --ah-----    C:\sqmnoopt11.sqm
2008-02-07 14:04 . 2008-02-07 14:04    232    --ah-----    C:\sqmdata11.sqm
2008-02-07 13:05 . 2008-02-07 14:35    <DIR>    d--------    C:\Program Files\SUPERAntiSpyware
2008-02-07 13:02 . 2008-02-07 13:02    <DIR>    d--------    C:\Program Files\CCleaner
2008-02-07 12:07 . 2008-02-07 12:07    244    --ah-----    C:\sqmnoopt10.sqm
2008-02-07 12:07 . 2008-02-07 12:07    232    --ah-----    C:\sqmdata10.sqm
2008-02-07 11:52 . 2008-02-07 11:52    244    --ah-----    C:\sqmnoopt09.sqm
2008-02-07 11:52 . 2008-02-07 11:52    232    --ah-----    C:\sqmdata09.sqm
2008-02-07 11:48 . 2008-02-07 12:32    245    --a------    C:\Windows\wininit.ini
2008-02-07 11:26 . 2008-02-07 11:26    <DIR>    d--------    C:\Program Files\Spybot - Search & Destroy
2008-02-07 11:05 . 2008-02-07 11:05    244    --ah-----    C:\sqmnoopt08.sqm
2008-02-07 11:05 . 2008-02-07 11:05    232    --ah-----    C:\sqmdata08.sqm
2008-01-31 11:28 . 2008-02-08 13:11    844    --a------    C:\Windows\bookcase.ini
2008-01-31 11:27 . 2008-02-08 13:11    <DIR>    d--------    C:\Program Files\Ordbog
2008-01-26 14:16 . 2008-01-26 14:16    <DIR>    d--------    C:\Program Files\DivX
2008-01-22 12:55 . 2008-01-22 12:55    <DIR>    d--------    C:\Program Files\SystemRequirementsLab
2008-01-19 11:08 . 2008-01-19 11:08    621,056    --a------    C:\Windows\System32\drivers\dxgkrnl.sys
2008-01-19 11:08 . 2008-01-19 11:08    36,864    --a------    C:\Windows\System32\cdd.dll
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Windows\System32\drivers\PnkBstrK.sys
2008-01-19 11:06 . 2008-01-19 11:06    22,328    --a------    C:\Users\Mads Lykke\AppData\Roaming\PnkBstrK.sys
2008-01-19 11:05 . 2007-07-19 18:14    1,358,192    --a------    C:\Windows\System32\D3DCompiler_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    669,184    --a------    C:\Windows\System32\pbsvc.exe
2008-01-19 11:05 . 2007-07-19 18:14    444,776    --a------    C:\Windows\System32\d3dx10_35.dll
2008-01-19 11:05 . 2008-01-19 11:05    103,736    --a------    C:\Windows\System32\PnkBstrB.exe
2008-01-19 11:05 . 2008-01-19 11:05    66,872    --a------    C:\Windows\System32\PnkBstrA.exe
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\Users\All Users\Media Center Programs
2008-01-19 11:04 . 2008-01-19 11:04    <DIR>    d--------    C:\ProgramData\Media Center Programs
2008-01-15 01:17 . 2008-01-15 01:17    305    --a------    C:\Windows\game.ini
2008-01-15 01:02 . 2008-01-15 01:02    <DIR>    d--hs----    C:\Windows\ftpcache
2008-01-15 00:53 . 2008-01-15 00:53    <DIR>    d--------    C:\Program Files\Alcohol Soft
2008-01-08 21:44 . 2008-01-08 21:44    802,816    --a------    C:\Windows\System32\drivers\tcpip.sys
2008-01-08 21:44 . 2008-01-08 21:44    216,760    --a------    C:\Windows\System32\drivers\netio.sys
2008-01-08 21:44 . 2008-01-08 21:44    167,424    --a------    C:\Windows\System32\tcpipcfg.dll
2008-01-08 21:44 . 2008-01-08 21:44    24,064    --a------    C:\Windows\System32\netcfg.exe
2008-01-08 21:44 . 2008-01-08 21:44    22,016    --a------    C:\Windows\System32\netiougc.exe
2008-01-08 21:43 . 2008-01-08 21:43    4,247,552    --a------    C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,686,016    --a------    C:\Windows\System32\gameux.dll
2008-01-08 21:43 . 2008-01-08 21:43    1,060,920    --a------    C:\Windows\System32\drivers\ntfs.sys
2008-01-08 21:43 . 2008-01-08 21:43    211,000    --a------    C:\Windows\System32\drivers\volsnap.sys
2008-01-08 21:43 . 2008-01-08 21:43    154,624    --a------    C:\Windows\System32\drivers\nwifi.sys
2008-01-08 21:43 . 2008-01-08 21:43    109,624    --a------    C:\Windows\System32\drivers\ataport.sys
2008-01-08 21:43 . 2008-01-08 21:43    45,112    --a------    C:\Windows\System32\drivers\pciidex.sys
2008-01-08 21:43 . 2008-01-08 21:43    21,560    --a------    C:\Windows\System32\drivers\atapi.sys
2008-01-08 21:43 . 2008-01-08 21:43    15,928    --a------    C:\Windows\System32\drivers\pciide.sys
2008-01-08 21:43 . 2008-01-08 21:43    11,776    --a------    C:\Windows\System32\sbunattend.exe

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 12:42    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\uTorrent
2008-02-08 12:38    ---------    d-----w    C:\Users\Mads Lykke\AppData\Roaming\foobar2000
2008-02-08 11:33    ---------    d-----w    C:\ProgramData\FLEXnet
2008-02-07 12:04    ---------    d-----w    C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 10:48    ---------    d-----w    C:\ProgramData\Spybot - Search & Destroy
2008-01-22 12:14    ---------    d-----w    C:\ProgramData\NVIDIA
2008-01-17 19:23    ---------    d-----w    C:\Program Files\Common Files\Steam
2008-01-15 00:17    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-01-14 23:52    715,248    ----a-w    C:\Windows\system32\drivers\sptd.sys
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Sidebar
2008-01-08 20:49    ---------    d-----w    C:\Program Files\Windows Mail
2008-01-08 20:43    537,600    ----a-w    C:\Windows\AppPatch\AcLayers.dll
2008-01-08 20:43    449,024    ----a-w    C:\Windows\AppPatch\AcSpecfc.dll
2008-01-08 20:43    2,143,744    ----a-w    C:\Windows\AppPatch\AcGenral.dll
2008-01-08 20:43    173,056    ----a-w    C:\Windows\AppPatch\AcXtrnal.dll
2008-01-05 18:34    ---------    d-----w    C:\Program Files\PowerISO
2008-01-03 15:21    ---------    d-----w    C:\Program Files\Cisco Systems
2008-01-03 15:17    ---------    d-----w    C:\Program Files\Common Files\Deterministic Networks
2008-01-01 18:02    ---------    d-----w    C:\Program Files\Common Files\Adobe
2008-01-01 17:39    ---------    d-----w    C:\Program Files\Bonjour
2008-01-01 17:33    ---------    d-----w    C:\Program Files\Common Files\Macrovision Shared
2007-12-29 10:45    306,432    ----a-w    C:\Windows\System32\TuneUpDefragService.exe
2007-12-29 10:45    ---------    d-----w    C:\ProgramData\TuneUp Software
2007-12-29 10:45    ---------    d-----w    C:\Program Files\TuneUp Utilities 2008
2007-12-20 09:44    16,640    ----a-w    C:\Windows\System32\authuitu.dll
2007-12-20 09:41    29,440    ----a-w    C:\Windows\System32\uxtuneup.dll
2007-12-14 19:17    ---------    d-----w    C:\Program Files\VirtualDub 1.7.7
2007-12-14 17:19    ---------    d-----w    C:\ProgramData\Minnetonka Audio Software
2007-12-14 12:48    ---------    d-----w    C:\ProgramData\Microsoft Help
2007-12-13 21:07    9,728    ----a-w    C:\Windows\System32\LAPRXY.DLL
2007-12-13 21:07    824,832    ----a-w    C:\Windows\System32\wininet.dll
2007-12-13 21:07    56,320    ----a-w    C:\Windows\System32\iesetup.dll
2007-12-13 21:07    52,736    ----a-w    C:\Windows\AppPatch\iebrshim.dll
2007-12-13 21:07    26,624    ----a-w    C:\Windows\System32\ieUnatt.exe
2007-12-13 21:07    223,232    ----a-w    C:\Windows\System32\WMASF.DLL
2007-12-13 21:07    1,327,104    ----a-w    C:\Windows\System32\quartz.dll
2007-12-13 21:06    84,992    ----a-w    C:\Windows\system32\drivers\srvnet.sys
2007-12-13 21:06    58,368    ----a-w    C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-13 21:06    3,504,824    ----a-w    C:\Windows\System32\ntkrnlpa.exe
2007-12-13 21:06    3,470,520    ----a-w    C:\Windows\System32\ntoskrnl.exe
2007-12-13 21:06    130,048    ----a-w    C:\Windows\system32\drivers\srv2.sys
2007-12-13 21:06    101,888    ----a-w    C:\Windows\system32\drivers\mrxsmb.sys
2007-12-13 16:59    ---------    d-----w    C:\Program Files\LD-Anime
2007-12-11 17:52    356,352    ----a-w    C:\Windows\System32\nvuninst.exe
2007-12-11 16:06    86,016    ----a-w    C:\Windows\System32\nvsvc.dll
2007-12-11 16:06    81,920    ----a-w    C:\Windows\System32\nvmctray.dll
2007-12-11 16:06    8,530,464    ----a-w    C:\Windows\System32\nvcpl.dll
2007-12-11 16:06    8,238,688    ----a-w    C:\Windows\system32\drivers\nvlddmkm.sys
2007-12-11 16:06    795,104    ----a-w    C:\Windows\System32\dpinst.exe
2007-12-11 16:06    753,664    ----a-w    C:\Windows\System32\nvcplui.exe
2007-12-11 16:06    7,098,368    ----a-w    C:\Windows\System32\nvoglv32.dll
2007-12-11 16:06    6,549,504    ----a-w    C:\Windows\System32\nvdisps.dll
2007-12-11 16:06    5,263,360    ----a-w    C:\Windows\System32\nvd3dum.dll
2007-12-11 16:06    45,056    ----a-w    C:\Windows\System32\nvmccsrs.dll
2007-12-11 16:06    385,024    ----a-w    C:\Windows\System32\nvapi.dll
2007-12-11 16:06    356,352    ----a-w    C:\Windows\System32\nvudisp.exe
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod100.dll
2007-12-11 16:06    35,328    ----a-w    C:\Windows\System32\nvcod.dll
2007-12-11 16:06    307,200    ----a-w    C:\Windows\System32\nvexpbar.dll
2007-12-11 16:06    3,710,976    ----a-w    C:\Windows\System32\nvvitvs.dll
2007-12-11 16:06    3,420,160    ----a-w    C:\Windows\System32\nvgames.dll
2007-12-11 16:06    229,376    ----a-w    C:\Windows\System32\nvmccs.dll
2007-12-11 16:06    2,498,560    ----a-w    C:\Windows\System32\nvwss.dll
2007-12-11 16:06    188,416    ----a-w    C:\Windows\System32\nvmccss.dll
2007-12-11 16:06    147,456    ----a-w    C:\Windows\System32\nvcolor.exe
2007-12-11 16:06    1,830,912    ----a-w    C:\Windows\System32\nvwgf2um.dll
2007-12-11 16:06    1,228,800    ----a-w    C:\Windows\System32\nvmobls.dll
2007-12-04 13:04    837,496    ----a-w    C:\Windows\System32\aswBoot.exe
2007-12-04 12:54    95,608    ----a-w    C:\Windows\System32\AvastSS.scr
2007-11-29 22:30    200,704    ----a-w    C:\Windows\System32\ssldivx.dll
2007-11-29 22:30    1,044,480    ----a-w    C:\Windows\System32\libdivx.dll
2007-11-20 18:17    107,888    ----a-w    C:\Windows\System32\CmdLineExt.dll
2007-10-10 21:45    174    --sha-w    C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7AF268D9-5ABE-40C6-A923-14418865A835}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhaseFireWireService"="C:\Program Files\Common Files\TerraTec\PhaseFW\common\PhaseFWService.exe" [2007-04-13 12:03 110592]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46 1318128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-10 22:30 1006264]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 22:48 479232]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 07:36 36864]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\Windows\KHALMNPR.Exe]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\Windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\Windows\pss\Adobe Gamma.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=C:\Windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 22:46 624248 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 08:23 221568 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-09-20 14:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-09-20 08:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2007-04-02 17:32 1261568 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundTray]
--a------ 2007-04-01 11:44 49152 C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 22:04 1266936 I:\Programmer\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;C:\Windows\system32\DRIVERS\rtlprot.sys [2007-04-02 09:57]
S2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-05 23:44]
S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187.sys [2007-11-19 06:59]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\Windows\system32\DRIVERS\s125bus.sys [2007-04-24 08:33]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s125mdfl.sys [2007-04-24 08:33]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s125mdm.sys [2007-04-24 08:33]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s125mgmt.sys [2007-04-24 08:33]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s125obex.sys [2007-04-24 08:33]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-17 20:22]
S3 TTFWgsif;TTFWgsif;C:\Windows\system32\Drivers\TTFWgsif.sys [2005-11-29 17:33]
S3 TTPhase1394;TTPhase1394;C:\Windows\system32\Drivers\TTPhase1394.sys [2007-06-22 23:04]
S3 TTPhaseA;TTPhaseA;C:\Windows\system32\Drivers\TTPhaseA.sys [2007-06-22 23:03]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2007-12-29 11:45]
S3 viaagp;VIA AGP Bus Filter;C:\Windows\system32\drivers\viaagp.sys [2006-11-02 10:49]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork    REG_MULTI_SZ      PLA DPS BFE mpssvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Autoplay.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f977e545-7773-11dc-be70-806e6f6e6963}]
\shell\AutoRun\command - E:\.\Bin\Assetup.exe

*Newly Created Service* - ECACHE
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:16:45 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 13:47:12
Windows 6.0.6000  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 13:47:29
ComboFix-quarantined-files.txt  2008-02-08 12:47:26
ComboFix2.txt  2008-02-08 11:35:43
ComboFix3.txt  2008-02-07 14:26:13
ComboFix4.txt  2008-02-07 13:31:44
.
2008-02-08 11:25:05    --- E O F --- 

:::::::::::::::::::::::::::::::::::::::::::

Håber det kan løse mysteriet?
Avatar billede fromsej Praktikant
08. februar 2008 - 14:39 #18
Det hjalp rigtig meget.
Hvis du vil undgå lignende i fremtiden så drop fildeling.
Afinstaller uTorrent, så er der ikke mere at komme efter.
Avatar billede snifx Nybegynder
08. februar 2008 - 15:27 #19
Tak for tippet!

Var det så det, fromsej? Er problemet fjernet?
- og bør jeg beholde både SUPERAntiSpyware og Spybot? Eller er der et helt tredje program der er bedre?
Avatar billede fromsej Praktikant
08. februar 2008 - 16:28 #20
Efter min bedste overbevisning skulle din maskine være ren nu.
SuperAntiSpyware er bedre end Spybot, hvis du ydermere køber den i stedet for at nøjes med den gratis udgave, får du realtidsbeskyttelse, på samme måde som med et antivirusprogram.

Vi har lavet en samlet pakke, hvor diverse sikkerhedsprogrammer er beskrevet mere indgående, den finder du her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Avatar billede snifx Nybegynder
08. februar 2008 - 16:30 #21
Mange tak for din indsats, fromsej. Det er dejligt at have sådan nogen som dig ved hånden!
Avatar billede fromsej Praktikant
08. februar 2008 - 16:32 #22
Velbekomme og tak for point. :-)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel Indlæg Oprettet Seneste aktivitet
Findes der mon et Antivirus program, som ikke, konstant, reklamerer, for at købe ? Af Ikke-ekspert i Virus 21 22/06/202419:22 23/06/202412:54
Anbefaling af antivirusprogram med firewall Af OnePlusFan i Virus 23 07/05/202421:02 13/05/202419:48
trusler Af gerhardpet i Virus 4 26/01/202410:02 27/01/202408:32
Kan ikke fjerne virus Af mik28 i Virus 16 09/01/202416:37 10/01/202419:59
virusscanning Af JetteD i Virus 2 10/11/202312:55 10/11/202316:36
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester



Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I dag 06:10 Excel åbner fil i kæmpe format Af Aske i Excel
I går 22:00 Datafordeler Af Lsk i PHP
I går 12:37 Summere beløb pr. dato Af TTA i Excel
31/1022:44 Tilslutte chassic fans Af viking69 i PC
31/1020:28 LED lysstofrør Af ErikHg i Fri debat
White papers
Flere white papers »


Premium
Teaser billede
Staten vil selv udvikle kæmpe it-system til 650 millioner kroner: Nu tvinges regeringen til at lægge vigtige dokumenter frem
Læs mere »
Det går fantastisk på det danske Dynamics-marked: NNIT-selskabet Scales kan vælge og vrage mellem opgaver
Skelsættende GDPR-sag ændrer definitionen af 'følsomme oplysninger'
Microsoft: Tvungen skift til Windows 11 kan udskydes med et år, hvis du betaler os 200 kroner
Se alle »
Computerworld
Teaser billede
Russisk domstol: Google skal betale 20 kvintilliarder dollar i bøde - fordobles løbende
Læs mere »
Microsoft: Windows-opdateringer bliver nu 45 procent hurtigere
Test: Det er nærmest vanedannede at anvende disse mini-tastaturer
Prøvekørt: Mægtige, magelige Volvo EX90 er den fødte skærgårdskrydser
Se alle »
CIO
Teaser billede
Novo Nordisk satsede på HoloLens, men nu har Microsoft dræbt produktet
Læs mere »
Microsoft: Sådan arbejder Google målrettet på at skade os i det skjulte
Efter markante prisstigninger: VMware-kunder får dummebøder hvis de ikke skifter hurtigt nok til ny licens-ordning
Trods "indlysende ulempe": CIO Torben Ruberg siger nej til at konsolidere Satairs stribe af ERP-systemer
Se alle »
Job & Karriere
Teaser billede
Pludselig exit fra Schultz kom som en overraskelse for Merete Søby: Derfor stoppede samarbejdet
Læs mere »
Merete Søby fratræder med omgående virkning som CEO for Schultz efter blot tre måneder på posten
Danske Aeven flytter hele hovedkontoret med 600 medarbejdere til ny adresse og tager Sentia med
Microsoft klar med ny direktion for den danske forretning: Her er de nye direktører
Se alle »
White paper
Teaser billede
Cyberstatus 2024: Her er truslerne – og her forbereder virksomhederne sig
Læs mere »
Vær proaktiv og prioritér IT-sikkerheden – før det er for sent
Rapport kortlægger de 13 bedste muligheder for at sætte turbo på din cloud computing
SAP: Skab værdi og minimér omkostninger med effektiv dokumenthåndtering
Se alle »

Events
Flere events »
White papers
Flere white papers »
IT-Kurser
Se alle vores it-kurser »