ComboFix 08-02.05.3 - Jes 2008-02-10 19:15:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1030.18.1329 [GMT 1:00]
Running from: C:\Documents and Settings\Jes\Skrivebord\Fjern utøj - programmappe\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
----- BITS: Possible infected sites -----
hxxp://www.download.windowsupdate.com.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_NPF
((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.
2008-02-10 17:07 . 2008-02-10 17:15 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-02-10 17:07 . 2008-02-10 17:07 <DIR> d-------- C:\Documents and Settings\Jes\Application Data\SUPERAntiSpyware.com
2008-02-10 17:07 . 2008-02-10 17:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-10 16:59 . 2008-02-10 16:59 <DIR> d-------- C:\Programmer\CCleaner
2008-02-10 16:43 . 2008-02-10 16:43 48 --a------ C:\WINDOWS\boc425.ini
2008-02-09 22:29 . 2008-02-09 22:29 <DIR> d-------- C:\Programmer\Comodo
2008-02-09 22:29 . 2007-11-26 10:38 238,848 --a------ C:\WINDOWS\UNBOC.EXE
2008-02-09 22:29 . 2007-05-08 17:01 208,896 --a------ C:\WINDOWS\CMDLIC.DLL
2008-02-09 22:29 . 2004-08-27 16:00 24,064 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-02-08 18:37 . 2008-02-08 18:37 <DIR> d-------- C:\Programmer\Lavasoft
2008-02-07 20:39 . 2008-02-07 20:43 <DIR> d-------- C:\Programmer\Windows Live
2008-02-07 19:15 . 2008-02-07 19:15 <DIR> d-------- C:\Programmer\Uniblue
2008-02-07 19:15 . 2008-02-07 19:15 <DIR> d-------- C:\Documents and Settings\Jes\Application Data\Uniblue
2008-02-07 18:25 . 2008-02-07 18:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-04 13:37 . 2008-02-04 13:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Mindjet
2008-02-03 20:41 . 2008-02-07 20:18 <DIR> d-------- C:\Documents and Settings\Jes\Tracing
2008-02-03 10:42 . 2008-02-03 10:42 72,252 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-02-02 17:31 . 2006-10-05 03:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-02-02 17:31 . 2006-10-05 03:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-02-02 17:24 . 2008-02-03 01:01 <DIR> d-------- C:\Programmer\Picasa2
2008-02-02 15:23 . 2008-02-02 15:23 <DIR> d-------- C:\Programmer\IEForge
2008-01-27 21:51 . 2008-01-27 21:51 <DIR> d-------- C:\Ross-Tech
2008-01-26 09:21 . 2008-01-26 09:21 <DIR> d-------- C:\Programmer\APSW
2008-01-24 18:15 . 2002-12-28 10:26 20,569 --a------ C:\WINDOWS\system32\pxc25pm.dll
2008-01-23 13:20 . 2008-01-24 18:29 <DIR> d-------- C:\Programmer\Mindjet
2008-01-23 13:20 . 2001-11-30 15:49 1,335,648 --a------ C:\WINDOWS\system32\Sbe6_32.dll
2008-01-23 13:20 . 2001-11-30 15:49 558,656 --a------ C:\WINDOWS\system32\Sb6ent.ocx
2008-01-23 13:20 . 2001-11-30 15:49 329,423 --a------ C:\WINDOWS\system32\SBE6_000.HLP
2008-01-23 13:20 . 2001-11-30 15:49 6,537 --a------ C:\WINDOWS\system32\SBE6_000.CNT
2008-01-17 13:32 . 2008-01-17 13:32 <DIR> d-------- C:\Programmer\MSECache
2008-01-17 10:45 . 2008-01-17 10:45 <DIR> d-------- C:\Programmer\iPod
2008-01-17 10:45 . 2008-02-10 19:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-17 10:45 . 2008-01-17 10:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-17 10:44 . 2008-01-17 10:45 <DIR> d-------- C:\Programmer\iTunes
2008-01-17 10:42 . 2008-01-17 10:43 <DIR> d-------- C:\Programmer\QuickTime
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-10 00:26 . 2008-01-10 00:26 <DIR> d-------- C:\Documents and Settings\Jes\Application Data\ImagesWords
2008-01-10 00:26 . 2008-01-10 00:26 <DIR> d-------- C:\Documents and Settings\Jes\Application Data\EasyPCGate
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 16:06 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2008-02-10 15:43 --------- d-----w C:\Programmer\InventoryBuilder
2008-02-08 18:27 --------- d-----w C:\Programmer\Fælles filer\Tjenester
2008-02-07 17:00 --------- d-----w C:\Programmer\Google
2008-02-01 21:10 --------- d-----w C:\Programmer\sterm
2008-01-18 13:56 --------- d-----w C:\Documents and Settings\Jes\Application Data\Autodesk
2008-01-18 13:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-01-16 11:48 --------- d-----w C:\Programmer\Fælles filer\Autodesk Shared
2008-01-09 17:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-09 13:53 --------- d-----w C:\Documents and Settings\VAGCOM\Application Data\FileOpen
2008-01-07 10:20 --------- d--h--w C:\Programmer\InstallShield Installation Information
2008-01-07 10:20 --------- d-----w C:\Programmer\BuildDesk DK 3.2
2007-12-25 13:46 --------- d-----w C:\Documents and Settings\VAGCOM\Application Data\SealedMedia
2007-12-25 13:45 --------- d-----w C:\Documents and Settings\VAGCOM\Application Data\Intel
2007-12-21 23:10 --------- d-----w C:\Programmer\SealedMedia
2007-12-16 15:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-13 11:21 --------- d-----w C:\Programmer\MSN Messenger
2007-12-10 13:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\ibm
2007-07-31 10:39 24 ------w C:\Programmer\InventoryBuildersettings.ini
2006-04-21 17:30 24,192 ------w C:\Documents and Settings\Jes\usbsermptxp.sys
2006-04-21 17:30 22,768 ------w C:\Documents and Settings\Jes\usbsermpt.sys
2006-05-29 15:54 108 --sha-r C:\WINDOWS\neoqaz2.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07A11D74-9D25-4fea-A833-8B0D76A5577A}]
2007-05-18 00:05 71184 -ra------ C:\Programmer\Mindjet\MindManager 7\Mm7InternetExplorer.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 16:00 15360]
"msnmsgr"="C:\Programmer\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"TPKMAPMN"="C:\Programmer\ThinkPad\Utilities\TpKmapMn.exe" [2005-10-28 18:04 45056]
"WMPNSCFG"="C:\Programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 10:30 204288]
"pdfSaver3"="C:\Programmer\Mindjet\MindManager 7\PDF-XChange\pdfSaver\pdfSaver3.exe" [2004-09-05 17:20 380928]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46 1318128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2007-08-11 01:30 110592]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2007-08-11 01:30 512000]
"TPKMAPHELPER"="C:\Programmer\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 18:04 864256]
"TpShocks"="TpShocks.exe" [2005-11-07 11:14 106496 C:\WINDOWS\system32\TpShocks.exe]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-05 16:15 94208]
"TP4EX"="tp4ex.exe" [2005-10-17 01:11 65536 C:\WINDOWS\system32\TP4EX.exe]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-11-17 02:22 237568]
"SoundMAXPnP"="C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544]
"SoundMAX"="C:\Programmer\Analog Devices\SoundMAX\Smax4.exe" [2004-08-06 07:27 860160]
"ATIPTA"="C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-01-21 21:00 344064]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-03-07 01:05 122939]
"IBMPRC"="C:\IBMTOOLS\UTILS\ibmprc.exe" [2005-04-27 09:53 90112]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-12-07 01:12 151552]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-12-07 01:12 208896]
"ShStatEXE"="C:\Programmer\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 07:00 98304]
"McAfeeUpdaterUI"="C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50 139320]
"Network Associates Error Reporting Service"="C:\Programmer\Fælles filer\Network Associates\TalkBack\TBMon.exe" [ ]
"ISS_Certtool"="C:\Programmer\IBM\Security\certtool.exe" [2005-05-06 08:55 90112]
"IBM_PWMGR"="C:\Programmer\IBM\Password Manager\pwmgr.exe" [2005-05-06 08:58 208896]
"TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [2002-10-08 22:28 40960]
"ACTray"="C:\Programmer\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 12:09 409600]
"ACWLIcon"="C:\Programmer\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 11:59 98304]
"TVT Scheduler Proxy"="C:\Programmer\Fælles filer\Lenovo\Scheduler\scheduler_proxy.exe" [ ]
"PSQLLauncher"="C:\Programmer\ThinkVantage Fingerprint Software\launcher.exe" [2006-04-25 18:03 31232]
"MSKDetectorExe"="C:\Programmer\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16 1121792]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"sealmon"="C:\Programmer\SealedMedia\sealmon.exe" [2007-06-04 17:43 296080]
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"MMReminderService"="C:\Programmer\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 00:05 37392]
"googletalk"="C:\Programmer\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"Ad-Watch"="C:\Programmer\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2008-01-24 09:22 2476408]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-27 16:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\FÆLLES~1\MICROS~1\DW\dwtrig20.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="C:\Programmer\Fælles filer\logishrd\WUApp32.exe" [ ]
C:\Documents and Settings\VAGCOM\Menuen Start\Programmer\Start\
RT-Opdatering.lnk - C:\NEtech\VAG-COM\VagCom.exe [2007-04-10 16:23:00 795400]
VAG-COM Tester.lnk - C:\NEtech\VAG-COM\VagCom.exe [2007-04-10 16:23:00 795400]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
ACNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
psqlpwd.dll 2006-04-25 18:20 40448 C:\WINDOWS\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-05 22:45 28672 C:\WINDOWS\system32\notifyf2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2006-02-01 15:09 24576 C:\WINDOWS\system32\tphklock.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
--------- 2006-01-12 19:52 483328 C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-01-15 03:22 267048 C:\Programmer\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-10 15:27 385024 C:\Programmer\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
--------- 2006-03-30 15:45 313472 C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"HP Status Server"=3 (0x3)
"HP Port Resolver"=3 (0x3)
"LVSrvLauncher"=2 (0x2)
"NBService"=3 (0x3)
"Pml Driver HPZ12"=2 (0x2)
"ServiceLayer"=3 (0x3)
"TVT Scheduler"=2 (0x2)
R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2005-11-30 15:58]
R0 TPDiskPM;TPDiskPM;C:\WINDOWS\system32\drivers\TPDiskPM.sys [2006-04-27 15:45]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 08:27]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2006-01-12 23:33]
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 12:18]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2005-12-07 01:12]
R2 ibmfilter;ibmfilter;C:\WINDOWS\system32\drivers\ibmfilter.sys [2005-04-27 10:27]
R2 IBMI2CPCD;IBMI2CPCD;C:\Programmer\SMBUS\ibmi2cpcd.sys [2006-03-10 19:40]
R2 smi2;smi2;C:\WINDOWS\system32\drivers\smi2.sys [2006-03-10 19:40]
R2 SmiHlp;SMI helper driver;C:\Programmer\ThinkVantage Fingerprint Software\smihlp.sys [2006-04-25 18:00]
R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2006-04-25 18:13]
R3 TPInput;TPInput;C:\WINDOWS\system32\DRIVERS\TPInput.sys [2006-03-30 14:03]
R3 TPM;Winbond Trusted Platform Module;C:\WINDOWS\system32\DRIVERS\tpm.sys [2005-10-09 20:35]
S3 Cpmt;Cisco Media Termination;C:\WINDOWS\system32\Drivers\Cpmt.sys []
S3 FTD2XX;VAGUSB.SYS VAG-COM USB Driver;C:\WINDOWS\system32\Drivers\VAGUSB.sys [2005-12-15 15:27]
S3 RT-USB;Ross-Tech USB driver;C:\WINDOWS\system32\drivers\RT-USB.sys [2007-02-05 12:38]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 16:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 16:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 16:59]
S3 TPM11;NSC Integrated Trusted Platform Module 1.1;C:\WINDOWS\system32\DRIVERS\nsctpm11.sys [2005-04-21 16:44]
S3 USBREC;Canon USB Video Record;C:\WINDOWS\system32\DRIVERS\USBREC.sys [2004-10-05 09:39]
S3 USBVCD;Canon USB Video;C:\WINDOWS\system32\drivers\USBVCD.sys [2004-10-05 09:39]
S3 VCIDRV;Canon USB Video Control;C:\WINDOWS\system32\DRIVERS\VCIDRV.sys [2004-10-05 09:39]
S4 viaagp;VIA AGP-busfilter;C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-03 23:07]
*Newly Created Service* - ENTDRV51
.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 08:57:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
"2007-09-10 19:32:02 C:\WINDOWS\Tasks\Backop_Laptop.job"
- C:\WINDOWS\system32\ntbackup.exeubackup
"2008-02-10 15:43:35 C:\WINDOWS\Tasks\User_Feed_Synchronization-{BB9CEA34-3B3D-4732-8A6B-F037385AD90B}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-02-10 19:23:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Programmer\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Programmer\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Programmer\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll
PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\PROGRA~1\ThinkPad\UTILIT~1\DK\PWRMGRRT.DLL
-> C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmer\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Programmer\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Programmer\IBM\Security\uvmserv.exe
C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
C:\Programmer\Network Associates\VirusScan\Mcshield.exe
C:\Programmer\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Programmer\IBM\Security\TssCore.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
c:\programmer\lenovo\system update\suservice.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Programmer\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Programmer\Windows Media Player\WMPNetwk.exe
C:\Programmer\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programmer\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Programmer\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-02-10 19:26:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-10 18:26:27
.
2008-02-08 07:02:12 --- E O F ---
********************************* ROOTCHK-(28-12-07)-LOG, by ejvindh
10-02-2008 19:12:40,39
NOTICE!! Rootchk is not being updated anymore, and is thus gradually getting outdated.
Last update was made 28-12-07
The rootkits that are detected by this tool were not found.
********************************* ROOTCHK-LOG-end
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-02-10 19:12:41
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000285
scanning hidden files ...
hidden processes: 0
hidden services: 0
hidden files: 0
(Du skal lige give os tillidelse til disse -> )
http://www.049.dk/eksperten/hijackthis.loghttp://www.049.dk/eksperten/SUPERAntiSpyware%20Scan%20Log%20-%2002-10-2008%20-%2018-57-28.log