OK, - så er der 3 logfiler.
Først fra ComboFix:
ComboFix 08-09-19.09 - John 2008-09-20 15:07:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1030.18.97 [GMT 2:00]
Running from: C:\Documents and Settings\John\Skrivebord\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((( Files Created from 2008-08-20 to 2008-09-20 )))))))))))))))))))))))))))))))
.
2008-09-20 11:57 . 2008-09-20 11:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-09-20 11:55 . 2006-07-15 13:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Andre computere
2008-09-20 11:54 . 2006-07-15 12:45 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-09-20 11:54 . 2006-07-22 06:14 <DIR> d-------- C:\Documents and Settings\Administrator\Skrivebord
2008-09-20 11:54 . 2006-07-15 11:52 <DIR> d--h----- C:\Documents and Settings\Administrator\Skabeloner
2008-09-20 11:54 . 2006-07-15 13:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Printere
2008-09-20 11:54 . 2006-07-15 13:47 <DIR> dr------- C:\Documents and Settings\Administrator\Menuen Start
2008-09-20 11:54 . 2008-09-20 15:11 <DIR> d--h----- C:\Documents and Settings\Administrator\Lokale indstillinger
2008-09-20 11:54 . 2006-07-22 06:19 <DIR> dr------- C:\Documents and Settings\Administrator\Foretrukne
2008-09-20 11:54 . 2006-07-18 12:38 <DIR> dr------- C:\Documents and Settings\Administrator\Dokumenter
2008-09-20 11:54 . 2006-07-18 13:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\InterVideo
2008-09-20 11:54 . 2006-07-22 05:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\BullGuard
2008-09-20 11:54 . 2006-07-18 13:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ahead
2008-09-20 11:54 . 2008-09-20 11:55 <DIR> d-------- C:\Documents and Settings\Administrator
2008-09-20 11:36 . 2008-09-20 11:36 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-09-20 11:36 . 2008-09-20 11:36 <DIR> d-------- C:\Documents and Settings\John\Application Data\SUPERAntiSpyware.com
2008-09-20 11:36 . 2008-09-20 11:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-20 02:50 . 2008-09-20 02:50 <DIR> d-------- C:\Programmer\MSECache
2008-09-15 21:14 . 2008-09-15 21:14 50,600 --a------ C:\Documents and Settings\John\Application Data\GDIPFONTCACHEV1.DAT
2008-09-14 18:07 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-14 18:07 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-13 12:45 . 2008-09-13 12:45 <DIR> d-------- C:\WINDOWS\system32\da
2008-09-13 12:45 . 2008-09-13 12:45 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-13 12:45 . 2008-09-13 12:45 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-13 12:39 . 2008-09-13 12:46 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-13 12:26 . 2008-09-13 12:26 <DIR> d-------- C:\WINDOWS\EHome
2008-09-13 12:04 . 2004-08-26 17:48 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-13 00:52 . 2008-09-13 00:53 <DIR> d-------- C:\Programmer\Malwarebytes' Anti-Malware
2008-09-13 00:52 . 2008-09-13 00:52 <DIR> d-------- C:\Documents and Settings\John\Application Data\Malwarebytes
2008-09-13 00:52 . 2008-09-13 00:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-13 00:52 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-13 00:52 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-12 23:07 . 2008-09-12 23:07 <DIR> d-------- C:\Programmer\Trend Micro
2008-09-12 22:39 . 2008-09-12 22:39 <DIR> d-------- C:\Programmer\CCleaner
2008-09-12 00:55 . 2008-09-20 14:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-12 00:55 . 2008-09-12 00:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-11 19:07 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-10 23:59 . 2008-09-10 23:59 <DIR> d-------- C:\Programmer\Panda Security
2008-08-30 00:37 . 2008-08-30 00:37 <DIR> dr------- C:\Documents and Settings\John\Application Data\Brother
2008-08-30 00:37 . 2008-08-30 00:37 413 --a------ C:\WINDOWS\BRWMARK.INI
2008-08-30 00:37 . 2008-08-30 00:37 184 --a------ C:\WINDOWS\system32\brsvc01a.bsi
2008-08-30 00:37 . 2008-08-30 00:37 40 --a------ C:\WINDOWS\opt_5040.ini
2008-08-30 00:37 . 2008-08-30 00:37 30 --a------ C:\WINDOWS\system32\brss01a.ini
2008-08-30 00:37 . 2008-08-30 00:37 26 --a------ C:\WINDOWS\BRPP2KA.INI
2008-08-30 00:17 . 2008-08-30 00:17 <DIR> d-------- C:\Programmer\Bonjour
2008-08-29 22:35 . 2008-08-29 22:35 376 --a------ C:\WINDOWS\ODBC.INI
2008-08-29 22:34 . 2008-08-29 22:34 <DIR> d-------- C:\WINDOWS\ShellNew
2008-08-22 20:19 . 2008-08-22 20:19 <DIR> d-------- C:\Documents and Settings\John\Application Data\PC Suite
2008-08-22 20:19 . 2008-08-22 20:19 <DIR> d-------- C:\Documents and Settings\John\Application Data\Nokia
2008-08-22 20:19 . 2008-08-22 20:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-08-22 20:17 . 2008-08-22 20:17 <DIR> d-------- C:\Programmer\Fælles filer\PCSuite
2008-08-22 20:16 . 2008-08-22 20:17 <DIR> d-------- C:\Programmer\Fælles filer\Nokia
2008-08-22 20:16 . 2008-08-22 20:16 <DIR> d-------- C:\Programmer\DIFX
2008-08-22 20:15 . 2008-08-22 20:15 <DIR> d-------- C:\Programmer\PC Connectivity Solution
2008-08-22 20:15 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-08-22 20:14 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-08-22 20:13 . 2008-08-22 20:16 <DIR> d-------- C:\Programmer\Nokia
2008-08-22 20:08 . 2008-08-22 20:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-20 12:51 --------- d-----w C:\Documents and Settings\John\Application Data\Skype
2008-09-20 12:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\BullGuard
2008-09-20 09:35 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2008-09-20 00:43 --------- d-----w C:\Documents and Settings\John\Application Data\BullGuard
2008-09-13 13:03 --------- d-----w C:\Programmer\Microsoft Works
2008-09-01 21:41 --------- d-----w C:\Programmer\Mozilla Thunderbird
2008-08-29 20:29 --------- d-----w C:\Programmer\microsoft frontpage
2008-08-06 22:38 --------- d-----w C:\Programmer\Trustpilot
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:33 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2006-07-18 14:04 8 --sh--r C:\WINDOWS\system32\C20D43C03A.sys
2006-07-18 14:04 4,704 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="C:\Programmer\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BullGuard"="C:\Programmer\BullGuard Software\BullGuard\bullguard.exe" [2008-04-30 308552]
"WMPNSCFG"="C:\Programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]
"Skype"="C:\Programmer\Skype\Phone\Skype.exe" [2007-09-13 22880040]
"TomTomHOME.exe"="C:\Programmer\TomTom HOME 2\HOMERunner.exe" [2008-05-06 202088]
"Nokia.PCSync"="C:\Programmer\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"PC Suite Tray"="C:\Programmer\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
"Google Update"="C:\Documents and Settings\John\Lokale indstillinger\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-10 133104]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-07-19 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-19 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-07-19 114688]
"LaunchAp"="C:\Programmer\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="C:\Programmer\Launch Manager\HotkeyApp.exe" [2006-07-17 65536]
"CtrlVol"="C:\Programmer\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"LMgrOSD"="C:\Programmer\Launch Manager\OSD.exe" [2005-03-16 204800]
"Wbutton"="C:\Programmer\Launch Manager\Wbutton.exe" [2006-07-10 86016]
"NeroFilterCheck"="C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"BullGuard"="C:\Programmer\BullGuard Software\BullGuard\bullguard.exe" [2008-04-30 308552]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2006-07-14 798810]
"Adobe Photo Downloader"="C:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="C:\Programmer\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-06 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 C:\WINDOWS\sm56hlpr.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
C:\Documents and Settings\John\Menuen Start\Programmer\Start\
Picture Motion Browser Media Check Tool.lnk - C:\Programmer\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-05-18 385024]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programmer\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FLLESF~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Programmer\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Programmer\\NetMeeting\\Conf.exe"=
"C:\\Programmer\\InterVideo\\DVD7\\WinDVD.exe"=
"C:\\Programmer\\InterVideo\\MediaOne Gallery\\mediaone.exe"=
"C:\\Programmer\\BullGuard Software\\BullGuard\\BullGuard.exe"=
"C:\\Programmer\\BullGuard Software\\BullGuard\\BullGuardUpdate.exe"=
"C:\\Programmer\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programmer\\MSN Messenger\\msncall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\iTunes\\iTunes.exe"=
"C:\\Programmer\\Bonjour\\mDNSResponder.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmer\\Skype\\Phone\\Skype.exe"=
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 9867]
R1 VFILT;BullGuard Firewall Kernel Driver;C:\Programmer\BullGuard Software\BullGuard\FwEngine\FiltNt.sys [2006-10-27 125216]
R2 BdFileSpy;BullGuard File Monitor Driver;C:\WINDOWS\system32\drivers\BdFileSpy.sys [2008-04-30 50896]
R2 BsFileScan;BullGuard File Scan Service;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 BsFwall;BullGuard Firewall Service;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 PROTECT.DLL;BullGuard Firewall Protection Plugin;C:\Programmer\BullGuard Software\BullGuard\FwEngine\Protect.dll [2006-10-27 16960]
R3 Reconn;BullGuard Email Monitor;C:\Programmer\BullGuard Software\BullGuard\reconn.sys [2008-04-30 16984]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [ ]
S3 ADBLOCK.DLL;BullGuard Firewall Adware Plugin;C:\Programmer\BullGuard Software\BullGuard\FwEngine\AdBlock.dll [ ]
S3 BGRaSvc;BGRaSvc;C:\Programmer\BullGuard Software\BullGuard\support\bgrasvc.exe [2008-04-30 79176]
S3 HTMLFILT.DLL;BullGuard Firewall HTML Plugin;C:\Programmer\BullGuard Software\BullGuard\FwEngine\HtmlFilt.dll [ ]
S3 HTTPFILT.DLL;BullGuard Firewall HTTP Plugin;C:\Programmer\BullGuard Software\BullGuard\FwEngine\HttpFilt.dll [ ]
S3 uxddrv;Dynamically loaded UxdDrv;e:\Diagnose\Wstpro\uxddrv.sys [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard REG_MULTI_SZ BgMainSvc BsFileScan BsMailProxy
BullGuardFw REG_MULTI_SZ BsFwall
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191d46d3-c1ed-11dc-abf0-00166fa6c1b3}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191d46d5-c1ed-11dc-abf0-00166fa6c1b3}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191d46d6-c1ed-11dc-abf0-00166fa6c1b3}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{191d46d7-c1ed-11dc-abf0-00166fa6c1b3}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-NWEReboot - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\zzvpzhy8.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
hxxp://www.economic.dk/website/default.aspFF -: plugin - C:\Documents and Settings\John\Lokale indstillinger\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Programmer\iTunes\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-09-20 15:12:21
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-09-20 15:14:53
ComboFix-quarantined-files.txt 2008-09-20 13:14:37
Pre-Run: 44.332.597.248 byte ledig
Post-Run: 44,715,753,472 byte ledig
219 --- E O F --- 2008-09-13 12:16:51
Og så fra HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:58:56, on 20-09-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Launch Manager\OSD.exe
C:\Programmer\Launch Manager\Wbutton.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmer\QuickTime\QTTask.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\Windows Media Player\WMPNSCFG.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\TomTom HOME 2\HOMERunner.exe
C:\Programmer\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Programmer\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Documents and Settings\John\Lokale indstillinger\Application Data\Google\Update\GoogleUpdate.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\Programmer\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmer\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Programmer\Fælles filer\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Skype\Plugin Manager\skypePM.exe
C:\Programmer\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Programmer\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.basix.dk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://www.aldi.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Programmer\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [HotkeyApp] "C:\Programmer\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Programmer\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Programmer\Launch Manager\OSD.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe" -boot
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmer\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmer\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Programmer\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Programmer\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programmer\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\John\Lokale indstillinger\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Programmer\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmer\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programmer\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {B0139915-B127-4215-9204-7E2510464FB5} - mscoree.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152960316328O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221309730875O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: BGRaSvc - BullGuard - C:\Programmer\BullGuard Software\BullGuard\support\bgrasvc.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 10144 bytes
Og tilsidst fra SuperAntiSpyware:
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 09/20/2008 at 05:20 PM
Application Version : 4.0.1154
Core Rules Database Version : 3412
Trace Rules Database Version: 1404
Scan type : Complete Scan
Total Scan Time : 01:41:13
Memory items scanned : 171
Memory threats detected : 0
Registry items scanned : 6113
Registry threats detected : 0
File items scanned : 25818
File threats detected : 0