csrss.exe Trojansk hest?

Jeg ser på det - et øjeblik.

Jeg kan ikke se tegn på virus/spyware, men lad os alligevel lige scanne.
Læs alle punkterne inden du gør noget.
Gem evt. denne vejledning som en tekstfil på skrivebordet vha. Notepad.

(1)
Hent AVG Anti-Spyware her: http://www.grisoft.com/doc/downloads-products/us/crp/0?prd=triasw
Installer programmer og opdater det, men vent med at scanne.

(2)
Hent AFT-cleaner her: http://www.geekstogo.com/forum/index.php?autocom=downloads&showfile=21
Start programmet og vælg "select all" og derefter "empty all".
Hvis du har Firefox skal du først vælge det i menuen og derefter "select all" og "empty all".

(3)
Start AVG Anti-Spyware, vælg fanebladet "scanner" og klik på "complete system scan".
Bagefter klik "apply all actions", "save report", "save report as" og gem logfil, f.eks. på skrivebordet.

(4)
Genstart computeren normalt. Send loggen fra AVG Anti-Spyware herind.

.. tilføjelse
I punkt (3) skal du starte med at genstarte computeren i fejlsikret tilstand (tryk F8 under opstarten af computeren), idet AVG skal køres i fejlsikret tilstand.

Jeg kan se masser af tegn på virus/spyware!!!

C:\WINDOWS\Config\csrss.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe

arlet -> det er rigtig, og jeg kan jo også bare læse, hvad michaelwr selv skriver :-)

Den rigtige csrss.exe skal være i mappen c:\windows\system32 og ikke i c:\windows\config.

michaelwr -> derfor kommer der en ny vejledning til dig:

Læs alle punkterne inden du gør noget.
Gem evt. denne vejledning som en tekstfil på skrivebordet vha. Notepad.

(1)
Hent AVG Anti-Spyware her: http://www.grisoft.com/doc/downloads-products/us/crp/0?prd=triasw
Installer programmer og opdater det, men vent med at scanne.

(2)
Hent AFT-cleaner her: http://www.geekstogo.com/forum/index.php?autocom=downloads&showfile=21
Start programmet og vælg "select all" og derefter "empty all".
Hvis du har Firefox skal du først vælge det i menuen og derefter "select all" og "empty all".

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op) og Fix følgende linjer med HijackThis:
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe

(4)
Start AVG Anti-Spyware, vælg fanebladet "scanner" og klik på "complete system scan".
Bagefter klik "apply all actions", "save report", "save report as" og gem logfil, f.eks. på skrivebordet.

(5)
Åbn "denne computer", i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper", sæt prik i "Vis skjulte filer og mapper". Husk at trykke på knappen "Anvend på alle mapper" i stedet for "ok".

søg efter og slet følgende fil(er):
C:\WINDOWS\Config\csrss.exe

(6)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind sammen med loggen fra AVG Anti-Spyware.

Hej
Jeg er meget taknemlig for den gode vejledning, og for at få hjælp.
Efter fjernelse af CSRSS.EXE, spørger Windows efter filen ved genstart.

Log fra AVG og Highjack This:

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:    12:51:04 05-03-2008

+ Scan result:   



C:\System Volume Information\_restore{1BE136E6-1AD8-4129-9795-03F31A6B88D5}\RP57\A0013053.exe -> Adware.Agent : No action taken.
C:\WINDOWS\AutoUpdateWin31.dll -> Adware.Agent : No action taken.
C:\WINDOWS\AutoUpdateWin33.exe -> Adware.Agent : No action taken.
E:\System Volume Information\_restore{FD33FCF3-479A-4D59-8F40-E8A1CA227F07}\RP578\A0170277.dll -> Adware.SpyNoMore : No action taken.
E:\System Volume Information\_restore{FD33FCF3-479A-4D59-8F40-E8A1CA227F07}\RP579\A0170606.dll -> Adware.SpyNoMore : No action taken.
E:\System Volume Information\_restore{FD33FCF3-479A-4D59-8F40-E8A1CA227F07}\RP583\A0170809.dll -> Adware.SpyNoMore : No action taken.
E:\System Volume Information\_restore{FD33FCF3-479A-4D59-8F40-E8A1CA227F07}\RP597\A0173786.exe -> Dropper.Agent.dlj : No action taken.
C:\Programmer\Onlinetjenester\Tele2\t2dkdesk.exe/setup.exe -> Heuristic.Win32.Dialer : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@borsen.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@stepstone.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
K:\Documents and Settings\Michael\Cookies\michael@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@2.adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@3.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@2.adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@3.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@ads.adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@advertising[2].txt -> TrackingCookie.Advertising : No action taken.
K:\Documents and Settings\Michael\Cookies\michael@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@cz11.clickzs[2].txt -> TrackingCookie.Clickzs : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@cz5.clickzs[2].txt -> TrackingCookie.Clickzs : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@connextra[1].txt -> TrackingCookie.Connextra : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@connextra[2].txt -> TrackingCookie.Connextra : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
K:\Documents and Settings\Michael\Cookies\michael@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@as1.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@hit.gemius[1].txt -> TrackingCookie.Gemius : No action taken.
K:\Documents and Settings\Michael\Cookies\michael@hit.gemius[2].txt -> TrackingCookie.Gemius : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@ehg-skistar.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@ivwbox[1].txt -> TrackingCookie.Ivwbox : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@image.masterstats[1].txt -> TrackingCookie.Masterstats : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@auto.search.msn[2].txt -> TrackingCookie.Msn : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@ie.search.msn[1].txt -> TrackingCookie.Msn : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken.
E:\Documents and Settings\Michael Christensaen\Cookies\michael christensaen@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : No action taken.
E:\Documents and Settings\Michael Christensaen\Lokale indstillinger\Temp\Cookies\michael christensaen@yadro[2].txt -> TrackingCookie.Yadro : No action taken.
C:\WINDOWS\WindowsUpdates.exe -> Trojan.Agent : No action taken.
C:\System Volume Information\_restore{1BE136E6-1AD8-4129-9795-03F31A6B88D5}\RP55\A0012837.bat -> Trojan.KillFire.d : No action taken.
C:\Recovered\Downloaded Programs\Win XP activation III\Win XP activation III.zip/XPKey.exe -> Trojan.Small.edz : No action taken.
C:\Recovered\cluster 11008634.ZIP/XPKey.exe -> Trojan.Small.edz : No action taken.


::Report end


Highjack This:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:50:02, on 05-03-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\SPAMfighter\SFAgent.exe
C:\Programmer\Trend Micro\Internet Security 12\pccguide.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programmer\NetLimiter 2 Monitor\nlsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\HACE\Mmm\Mmm.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Programmer\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Programmer\NetLimiter 2 Monitor\NLClient.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmer\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mmm] "C:\Programmer\HACE\Mmm\Mmm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.20.cab
O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programmer\NetLimiter 2 Monitor\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmer\WinPcap\rpcapd.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmer\SPAMfighter\sfus.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 7849 bytes

Med venlig hilsen
Michaelwr

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
Denne linje er stadig i hijackthis-loggen, har du gjort som i punkt (3)?

Du skriver at windows brokker sig over at filen er væk, men kan du mærke at der er kommet problemer som følge deraf?

Hej levich

Jeg fjernede "F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe" (det er det med at læse det hele) vha. HighjackThis.
Windows brokker sig ikke mere over den manglende fil.
Nedefor er en ny logfil.

Jeg takker mange gange for den fine service du giver.

Med venlig hilsen
Michaelwr

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:27:16, on 06-03-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\SPAMfighter\SFAgent.exe
C:\Programmer\Trend Micro\Internet Security 12\pccguide.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\HACE\Mmm\Mmm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmer\NetLimiter 2 Monitor\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Programmer\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Programmer\NetLimiter 2 Monitor\NLClient.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmer\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mmm] "C:\Programmer\HACE\Mmm\Mmm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.20.cab
O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programmer\NetLimiter 2 Monitor\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmer\WinPcap\rpcapd.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmer\SPAMfighter\sfus.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 7781 bytes

Det ser fint ud.

Hmmm...

Ved du selv hvad dette er ->

O4 - HKCU\..\Run: [Mmm] "C:\Programmer\HACE\Mmm\Mmm.exe"

http://spywarefiles.prevx.com/RRHHHG277282/MMM.EXE.html
http://www.processlibrary.com/directory/files/mmm/242346

Jeg gætter på: http://hace-software.com/mmm.shtml

(Det har du nok ret i!)

Hej igen
Levich fik løst problemet. Min PC fungerer fint nu.
Mmm er bare et prg. jeg fandt.
Fik du dine point?
Svaret er accepteret.
MVH
Michaelwr.

Ja, jeg fik point.
Held og lykke med at holde den fri for virus/spyware fremover.

Det her "nulstiller" windows mht. systemgendannelse:

(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Genstart normalt og aktiver systemgendannelse igen.

er det standard hvis min "C:\windows\config\" mappe, er HELT tom?:o
- sry, ved godt det er gammel tråd men gad ikke til at oprette ny tråd for at spørge dette ene spørgsmål :)

<tobiasS> Du SKAL oprette din egen tråd !!!

hm okay:) undskyld

hej hos mig er der to. hvilken skal jeg slette?

<Skoday>: Hvad snakker du om ?

lige meget. det virker ikke

Øhhh...