Problemer med pop-ups - vil I se på mine logs?
HejJeg har fået en masse snask på min computer. Det meste er nu fjernet vha diverse programmer, men jeg har stadig følgende problemer:
- Startsiden sættes til dannz.com
- Der popper to explorer-vinduer op ca. hvert 5. minut - de åbner dog ikke nogen sider
Logs:
Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 09:41:54, on 27-08-2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\vsnp2uvc.exe
C:\Program Files\Compal\Smart Battery\SMBTray.exe
C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\System32\WScript.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Windows\System32\WScript.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\Acrobat_sl.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Users\Gonad\Desktop\alternativ.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
O4 - HKLM\..\Run: [SMBTray] C:\Program Files\Compal\Smart Battery\SMBTray.exe
O4 - HKLM\..\Run: [Wow Video&Audio] C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [%ProtectMyPC] http://gomyhit.com/MjA2MTk=/2/7391/ratna/
O4 - HKLM\..\Run: [%ProtectMyPC2] http://fullscanner.com/?id=20037
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [%AWinUpdate] C:\WINDOWS\wuauclt.vbs
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WinUpdate] C:\WINDOWS\wuauclt.vbs
O4 - Startup: Screen Clipper and Launcher til OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send billede til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send siden til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O15 - Trusted Zone: *.danskebank.dk
O15 - Trusted Zone: http://wssdemo.danskhosting.dk
O15 - Trusted IP range: 172.28.64.1
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\Windows\System32\appdrvrem01.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cycling Manager 2007 Drivers Auto Removal (pr2akt6c) (pr2akt6c) - Cyanide - C:\Windows\system32\pr2akt6c.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Combo-fix:
ComboFix 08-08-26.02 - Gonad 2008-08-27 9:44:09.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1030.18.1143 [GMT 2:00]
Running from: C:\Users\Gonad\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-07-27 to 2008-08-27 )))))))))))))))))))))))))))))))
.
2008-08-27 08:04 . 2008-08-27 08:04 7,680 --a------ C:\Windows\System32\drivers\RKL43D3.tmp.sys
2008-08-27 08:00 . 2008-08-27 08:00 <DIR> d-------- C:\Program Files\Sophos Anti-Rootkit
2008-08-26 18:34 . 2008-08-26 18:34 <DIR> d-------- C:\Users\Gonad\AppData\Roaming\Malwarebytes
2008-08-26 18:34 . 2008-08-26 18:34 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-26 18:34 . 2008-08-26 18:34 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-26 18:34 . 2008-08-26 18:34 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 18:34 . 2008-08-17 15:01 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-26 18:34 . 2008-08-17 15:01 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-26 15:25 . 2008-08-26 15:25 <DIR> d-------- C:\Users\Gonad\AppData\Roaming\SUPERAntiSpyware.com
2008-08-26 15:25 . 2008-08-26 15:25 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-08-26 15:25 . 2008-08-26 15:25 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-08-26 15:25 . 2008-08-26 15:39 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-08-26 15:17 . 2008-08-26 15:17 <DIR> d-------- C:\Program Files\CCleaner
2008-08-26 09:28 . 2008-08-22 04:21 2,474 --a------ C:\Windows\wuauclt.vbs
2008-08-26 09:28 . 2008-08-22 04:21 2,442 --a------ C:\Windows\System32\wuauclt.vbs
2008-08-22 13:09 . 2008-08-26 14:19 <DIR> dr------- C:\Users\Public\pamela
2008-08-22 09:35 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-22 09:35 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-22 09:35 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-22 09:35 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-22 09:35 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-22 09:35 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-22 09:35 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-22 09:35 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-22 09:35 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-21 10:40 . 2008-05-03 16:07 4,687,271,936 --a------ C:\am-cww.iso
2008-08-15 17:33 . 2008-08-15 17:33 <DIR> d-------- C:\Program Files\MSECache
2008-08-15 17:33 . 2008-08-15 17:33 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-08-13 09:43 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-13 08:33 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-13 08:33 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-13 08:33 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-13 08:32 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-13 08:31 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-12 08:43 . 2008-08-12 08:43 <DIR> d-------- C:\Program Files\CloneCD
2008-08-12 08:41 . 2008-08-12 08:41 <DIR> d-------- C:\Users\Gonad\AppData\Roaming\Vso
2008-08-12 08:41 . 2008-08-12 08:41 <DIR> d-------- C:\Users\All Users\DVDXStudio
2008-08-12 08:41 . 2008-08-12 08:41 <DIR> d-------- C:\ProgramData\DVDXStudio
2008-08-12 08:41 . 2008-08-12 08:41 <DIR> d-------- C:\Program Files\CloneDVD
2008-08-12 08:41 . 2008-08-12 08:41 81,920 --a------ C:\Users\Gonad\AppData\Roaming\ezpinst.exe
2008-08-12 08:41 . 2008-08-12 08:41 47,360 --a------ C:\Windows\System32\drivers\pcouffin.sys
2008-08-12 08:41 . 2008-08-12 08:41 47,360 --a------ C:\Users\Gonad\AppData\Roaming\pcouffin.sys
2008-08-09 17:01 . 2008-08-09 17:01 <DIR> d-------- C:\Users\All Users\Apple
2008-08-09 17:01 . 2008-08-09 17:01 <DIR> d-------- C:\ProgramData\Apple
2008-08-09 17:01 . 2008-08-09 17:01 <DIR> d-------- C:\Program Files\Apple Software Update
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 19:21 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-26 13:25 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-26 07:32 --------- d-----w C:\Users\Gonad\AppData\Roaming\LimeWire
2008-08-25 19:45 --------- d-----w C:\Program Files\HO
2008-08-23 14:14 --------- d-----w C:\Users\Gonad\AppData\Roaming\Pro Cycling Manager 2008
2008-08-22 07:35 --------- d-----w C:\Program Files\HO - Kopi
2008-08-21 08:46 --------- d-----w C:\ProgramData\DVD Shrink
2008-08-21 06:51 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-14 18:05 --------- d-----w C:\Program Files\TVUPlayer
2008-08-13 07:43 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-13 07:40 --------- d-----w C:\Program Files\Windows Mail
2008-07-24 13:01 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-20 17:09 --------- d-----w C:\Users\Gonad\AppData\Roaming\CoreFTP
2008-07-12 16:19 304,528 ----a-w C:\Windows\System32\appdrvrem01.exe
2008-07-12 16:19 3,468,904 ----a-w C:\Windows\system32\drivers\appdrv01.sys
2008-07-12 13:28 --------- d-----w C:\ProgramData\Ulead Systems
2008-07-12 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-12 13:22 --------- d-----w C:\Program Files\Cyberlink
2008-07-04 16:35 96,520 ----a-w C:\Windows\system32\drivers\avgldx86.sys
2008-07-04 16:35 10,520 ----a-w C:\Windows\System32\avgrsstx.dll
2008-07-02 13:24 --------- d-----w C:\Program Files\Microsoft Virtual PC
2008-07-02 12:30 174 --sha-w C:\Program Files\desktop.ini
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Journal
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Defender
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Collaboration
2008-07-02 12:16 --------- d-----w C:\Program Files\Windows Calendar
2008-07-02 11:33 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-07-02 11:33 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-07-02 08:33 --------- d-----w C:\Program Files\MultipleIEs
2008-07-02 08:06 --------- d-----w C:\Program Files\LimeWire
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-22 17:21 22,782 ----a-w C:\Windows\System32\UninstXviDDec.exe
2008-06-04 09:56 920,088 ----a-w C:\Windows\System32\igxpun.exe
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2007-08-26 10:19 262,144 ----a-w C:\ProgramData\ntuser.dat
2007-08-01 08:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-08-01 08:02 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-08-01 08:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((( snapshot@2008-08-26_16.37.05.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-26 14:21:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-27 07:37:27 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-08-26 14:21:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-27 07:37:27 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-26 14:23:32 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-27 07:40:03 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-27 07:40:03 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-26 14:23:38 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-27 07:39:58 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-27 07:39:58 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-26 14:29:50 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-27 07:43:59 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2008-08-26 12:23:56 11,752 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2112064309-32628310-3143719812-1000_UserData.bin
+ 2008-08-27 07:39:56 11,918 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2112064309-32628310-3143719812-1000_UserData.bin
- 2008-08-26 12:23:56 130,466 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-27 07:39:56 131,260 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-26 14:23:43 53,468 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-27 07:39:53 53,746 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-08-25 21:52:54 524,574 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-08-26 16:29:28 526,616 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29 165784]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-08-21 22:18 171448]
"%AWinUpdate"="C:\WINDOWS\wuauclt.vbs" [2008-08-22 04:21 2474]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-26 15:39 1576176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"%ProtectMyPC2"="http://fullscanner.com/?id=20037" [?]
"%ProtectMyPC"="http://gomyhit.com/MjA2MTk=/2/7391/ratna/" [X]
"WLSS"="C:\Program Files\Compal\Wireless Select Switch\WLSS.exe" [2007-04-23 18:55 190000]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-05-25 18:40 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-05-25 18:39 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-05-25 18:40 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-13 03:55 815104]
"snp2uvc"="C:\Windows\vsnp2uvc.exe" [2006-12-29 20:48 569344]
"SMBTray"="C:\Program Files\Compal\Smart Battery\SMBTray.exe" [2007-05-03 14:22 525872]
"Wow Video&Audio"="C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe" [2007-05-03 17:51 951856]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 18:58 856064]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-02 12:47 520192]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-04 18:36 1232152]
"QuickTime Task"="C:\Program Files\VistaCodecPack\QT\QTTask.exe" [2008-05-27 10:50 413696]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-04-18 18:36 150040]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-04-18 18:36 170520]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-04-18 18:36 141848]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2006-09-28 21:21 57344]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-12 17:11 4468736 C:\Windows\RtHDVCpl.exe]
C:\Users\Gonad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Screen Clipper and Launcher til OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-07-13 09:25:25 25214]
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 13:11:50 719664]
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 15:29:20 54512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-08-26 15:39 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-08-26 15:39 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= divxa32.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2CA3DE8D-9640-4D01-9013-19367A6277F4}"= UDP:7221:BitComet 7221 TCP
"{7B8746BA-C42E-4C9D-BC10-47EFB9988871}"= TCP:7221:BitComet 7221 UDP
"TCP Query User{755D486D-C55E-46D4-B5FE-05BFEC6009F9}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{DDA0B05D-F522-4298-9719-E717CBE8B662}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{09D44B57-D01D-4336-B279-8393A4AB0DA7}"= UDP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{DF550A09-416E-4B87-9C0A-808D33A9FA85}"= TCP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"TCP Query User{5A17C51E-62D3-4089-AE5E-77A7A796CCFA}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{A67C6351-1D92-4716-BC7A-DD8AC89A15A6}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{558BE438-D8BC-49ED-A5DC-E03FDFFC993D}"= UDP:C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:Adobe Version Cue CS2
"{808BF278-B724-475E-8DF5-EC01765F0841}"= TCP:C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:Adobe Version Cue CS2
"TCP Query User{AAD95CA7-815C-43A6-8AA1-37120F7475BC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{6057B8C3-7EC6-489C-9552-4CB2B9BBEC6D}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{60679C88-20C8-42B2-BD96-50973543FB96}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{B3C1956D-B3A4-48A2-A30B-D3CA9CC9408D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{7ED40126-9DA3-42D6-AAA2-40900C27720B}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{47645B81-A5B3-4FA4-8090-947490D92E28}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{461C4232-FB6E-4C83-92CD-09487FF33F60}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{711E3934-41E0-40A7-870D-A8F00BFCA407}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{395E553F-9A05-46F9-B6A4-100C627E3C67}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{0490EA00-63DC-4B72-85D4-209F10DD0DFF}"= UDP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{F1FFAB0E-22D6-4303-84CA-A0C8819C668B}"= TCP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"TCP Query User{86CDB9E3-8917-4AB9-8B04-B33BCFBE526C}C:\\users\\gonad\\appdata\\local\\temp\\cryf095.tmp\\install.exe"= UDP:C:\users\gonad\appdata\local\temp\cryf095.tmp\install.exe:install.exe
"UDP Query User{F6FDEE9A-8EEC-484B-A531-8CB3039B29F4}C:\\users\\gonad\\appdata\\local\\temp\\cryf095.tmp\\install.exe"= TCP:C:\users\gonad\appdata\local\temp\cryf095.tmp\install.exe:install.exe
"TCP Query User{2B633632-AC86-4914-90D1-8945D32E9B7A}C:\\program files\\pokerplex\\ua.exe"= UDP:C:\program files\pokerplex\ua.exe:UA Application
"UDP Query User{3E7F0E25-6DD0-4EE8-A272-2767E446F326}C:\\program files\\pokerplex\\ua.exe"= TCP:C:\program files\pokerplex\ua.exe:UA Application
"TCP Query User{93F0C0F5-874C-4A19-8947-877889E07932}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{5B36D156-BE4B-4C2D-A3A1-F953FBAA612E}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{0744A3BB-2A13-4DE5-A994-E2156473A1E5}"= UDP:C:\martin\spil\Pro Cycling Manager 2007\GameCenter\GameCenter.exe:GameCenter
"{71976A36-4E25-452B-B544-F01FF88D1F47}"= TCP:C:\martin\spil\Pro Cycling Manager 2007\GameCenter\GameCenter.exe:GameCenter
"TCP Query User{183FAB9C-5759-4A37-9190-50B2DD0E3DEC}C:\\martin\\spil\\top spin 2\\data\\top spin 2.exe"= UDP:C:\martin\spil\top spin 2\data\top spin 2.exe:Top Spin 2
"UDP Query User{80DA37FB-7530-4C55-9D33-4FD7EB25B8EA}C:\\martin\\spil\\top spin 2\\data\\top spin 2.exe"= TCP:C:\martin\spil\top spin 2\data\top spin 2.exe:Top Spin 2
"{E726083E-3966-421A-858F-127C57593C26}"= UDP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter
"{A571D2EE-9598-48F4-97EF-200C655C5011}"= TCP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter
"TCP Query User{9569C267-FAB5-48F0-AD0C-3AFDEACE7CFC}C:\\games\\pro cycling manager 2007\\pcm.exe"= UDP:C:\games\pro cycling manager 2007\pcm.exe:pcm
"UDP Query User{C01C198D-353A-48C9-9B6F-2AA3D11DF96F}C:\\games\\pro cycling manager 2007\\pcm.exe"= TCP:C:\games\pro cycling manager 2007\pcm.exe:pcm
"{4CFC2A65-CB31-4801-8861-4EA2551D2637}"= UDP:7221:BitComet 7221 TCP
"{6B87D04B-4320-40A3-A7C4-373D51D30B5D}"= TCP:7221:BitComet 7221 UDP
"TCP Query User{D325F591-CC31-419C-BE71-29D8221BB3B8}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVU Player Component
"UDP Query User{1A9072BA-F304-4E7F-BC83-72EA10CFA858}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVU Player Component
"TCP Query User{B5A0154A-2219-4B36-92FB-DD6666D7C2A6}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{78B7C207-8838-46E7-ADFC-2C7310DDE819}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{3CE579A7-B550-4347-9C76-12B0C1DB7E13}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{CED553D1-AF91-4BAB-941C-204980017E85}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{E9EA44A3-30AD-4C9D-8DB7-0071C655E2E8}C:\\program files\\pokerplex\\ua.exe"= UDP:C:\program files\pokerplex\ua.exe:UA Application
"UDP Query User{D3A95444-0D5A-4C08-BAF3-CEA4A1A88A80}C:\\program files\\pokerplex\\ua.exe"= TCP:C:\program files\pokerplex\ua.exe:UA Application
"{042B225C-7D4E-4C3E-8036-F977C7231FC5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{CDBF7AC0-61DE-4899-BC73-9817A58A2A04}"= UDP:16754:BitComet 16754 TCP
"{A7EB80E1-42F3-4954-B927-AC677241AB50}"= TCP:16754:BitComet 16754 UDP
"{5AD8FFAB-55E3-4186-9CDD-831BEF6E6AA9}"= UDP:16754:BitComet 16754 TCP
"{7553E0C0-073E-4D78-9D77-AC53A63DFE87}"= TCP:16754:BitComet 16754 UDP
"{B227891F-521F-4278-9A9E-7ABB3DA74AA7}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{1E83DAEE-965D-403E-AEBA-23D87988666D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{2D18F7D4-DB75-445E-BB90-98C2342037B7}"= UDP:C:\Games\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008
"{5EC6524F-6005-4B8E-91F2-78D07F59519A}"= TCP:C:\Games\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008
"{9605F3E7-6287-4986-894E-59859EA2F10E}"= UDP:C:\Games\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun
"{0A86982A-BCEF-4E85-A32A-44AA2429FD83}"= TCP:C:\Games\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun
"TCP Query User{44EB6900-3A25-45D7-AE01-9B9D53E7884E}C:\\games\\pro cycling manager - season 2008\\pcm.exe"= UDP:C:\games\pro cycling manager - season 2008\pcm.exe:pcm
"UDP Query User{99DB2377-F908-4CDE-8344-1FE323A7E9FF}C:\\games\\pro cycling manager - season 2008\\pcm.exe"= TCP:C:\games\pro cycling manager - season 2008\pcm.exe:pcm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"= C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox
R0 EMSC;COMPAL Embedded System Control;C:\Windows\system32\DRIVERS\EMSC.SYS [2007-02-13 19:29]
R0 pf2akt6c;Cycling Manager 2007 File System Driver (pf2akt6c);C:\Windows\system32\drivers\pf2akt6c.sys [2007-06-14 12:25]
R1 appdrv01;Application Driver (01);C:\Windows\system32\Drivers\appdrv01.sys [2008-07-12 18:19]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-07-04 18:35]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 18:35]
R2 SSPORT;SSPORT;C:\Windows\system32\Drivers\SSPORT.sys [2006-12-08 02:50]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-09 00:03]
S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\Windows\System32\appdrvrem01.exe svc []
S2 pr2akt6c;Cycling Manager 2007 Drivers Auto Removal (pr2akt6c);C:\Windows\system32\pr2akt6c.exe svc []
S3 AntiAries;Anti Aries Helper Driver;C:\Windows\System32\drivers\RKL43D3.tmp.sys [2008-08-27 08:04]
S3 btwaudio;Bluetooth-audioenhed;C:\Windows\system32\drivers\btwaudio.sys [2007-07-12 17:39]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-07-12 17:39]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-07-12 17:40]
S3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-05-10 14:19]
S3 Ktp;Elantech Touchpad;C:\Windows\system32\DRIVERS\Ktp.sys [2007-07-12 17:20]
S3 msloop;Driver til Microsoft Loopback-netværkskort;C:\Windows\system32\DRIVERS\loop.sys [2008-01-19 07:55]
S3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-11-02 09:30]
S4 3056HID;3056HID - HID Driver;C:\Windows\system32\drivers\3056hid.sys [2006-08-02 09:54]
S4 3252HID;3252HID - HID Driver;C:\Windows\system32\drivers\3252hid.sys [2006-08-02 09:54]
S4 716xHID;716xHID - PCIe HID Driver;C:\Windows\system32\drivers\716xhid.sys [2006-11-17 14:04]
S4 BDA_Loader_225;USB Digital-TV Receiver. Firmware Loader 6.8.30.0;C:\Windows\system32\drivers\bda_loader_225.sys [2006-09-22 14:35]
S4 CX88IR;DTV_DVB 1027 IR Decoder;C:\Windows\system32\drivers\88xbdair.sys [2007-01-18 17:39]
S4 MtsHID;DTV-DVB Mantis BDA HID Driver;C:\Windows\system32\drivers\mtshid.sys [2006-06-19 19:06]
S4 THIR;DTV-DVB 3054 IR Decoder;C:\Windows\system32\drivers\3054ir.sys [2005-12-06 10:39]
S4 tridhid;tridhid - USB 2.0 HID Driver;C:\Windows\system32\drivers\tridhid6010.sys [2006-11-01 20:45]
S4 UDST7021HID;UDST7021HID - HID Driver;C:\Windows\system32\drivers\udst7021hid.sys [2006-06-29 09:46]
S4 UDTT2HID;UDTT2HID - USB 2.0 HID Driver;C:\Windows\system32\drivers\udtt2hid.sys [2006-06-22 10:57]
S4 UDTT7049HID;UDTT7049HID - HID Driver;C:\Windows\system32\drivers\udtt7049hid.sys [2006-06-29 10:04]
S4 UDXTTM6000HID;UDXTTM6000HID - HID Driver;C:\Windows\system32\drivers\udxttm6000hid.sys [2006-06-29 10:11]
S4 UDXTTM6010HID;UDXTTM6010HID - HID Driver;C:\Windows\system32\drivers\udxttm6010hid.sys [2007-02-23 16:34]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9577977-a957-11dc-96fe-0016d4db8be3}]
\shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2008-08-26 C:\Windows\Tasks\User_Feed_Synchronization-{0F5B06BE-D3D8-4F66-A91E-7EDBBE4EA079}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 09:33]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert to existing PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 -: Send billede til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 -: Send siden til &Bluetooth-enhed... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O15 -: Trusted Zone: *.danskebank.dk
O16 -: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
C:\Windows\Downloaded Program Files\e-Safekey.inf
C:\Windows\Downloaded Program Files\e-Safekey.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 09:49:35
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\Users\Gonad\AppData\Local\Temp\~DFF16D.tmp
C:\Users\Gonad\AppData\Local\Temp\~DFF180.tmp
scan completed successfully
hidden files: 2
**************************************************************************
.
Completion time: 2008-08-27 9:51:50
ComboFix-quarantined-files.txt 2008-08-27 07:51:39
ComboFix2.txt 2008-08-26 14:37:57
Pre-Run: 22,661,459,968 byte ledig
Post-Run: 22,643,232,768 byte ledig
331 --- E O F --- 2008-08-27 05:58:56
Er der nogle, som kan hjælpe?
