overtagelse af computer afluring af messenger

"...kan stadig gå ind og aflure mig..." - hvordan ved du det ?
Hvordag viser det sig ? i praksis ?

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

(Jooo - jeg har 'virus' på hjernen...)

Mht.: Vista - HøjreMusseTast på *.EXE filen - Kør som Administrator...

------------------

Generelt -> http://www.eksperten.dk/list.phtml?spm_creator=macolzen&status_1=on&status_2=on&status_3=on&status_4=on - du bør pænt vende tilbage til dine tidligere spørgsmål !!!

http://expfaq.dk/behandling_af_svar#behandling_af_svar

efter at jeg har skiftet password kopierer vedkommende stadig min messenger tekst - dette undrer mig da jeg skulle mene at det ikke skulle kunne lade sig gøre

Hvordan ved du kan kopierer din tekst?

kan >= han

jeg ved det gennem en bekendt der kan se vedkommende på sin messenger

[20/09-2008 22:25:34] !!!

jeg er igang med at køre malware - resultatet plus Hijackthis følger

Malwarebytes' Anti-Malware 1.28
Database version: 1182
Windows 5.1.2600 Service Pack 3

20-09-2008 23:42:27
mbam-log-2008-09-20 (23-42-19).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 111681
Tid tilbagelagt: 54 minute(s), 46 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 3
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 2
Inficerede Filer: 1

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e12bff69-38a7-406e-a8ef-2738107a7831} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\WinPCDoctor (Rogue.WinPCDoctor) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> No action taken.

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
C:\Programmer\PopsMedia Site Adviser (Trojan.Agent) -> No action taken.
C:\Casino (Adware.Casino) -> No action taken.

Inficerede Filer:
C:\Documents and Settings\Benjamin Cordes\Foretrukne\Online Security Test.url (Rogue.Link) -> No action taken.


Det var Malware loggen
-------------------------------------

og her er HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:40:12, on 20-09-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmer\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\System32\logon.scr
C:\Documents and Settings\Anne Cordes\Dokumenter\hjt\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [NI.ERSK_0001_N91E2012] "C:\DOCUME~1\BENJAM~1\LOKALE~1\Temp\ERS6.exe" -nag
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [FjernerVirus] C:\Programmer\FjernerVirus\pgs.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O22 - SharedTaskScheduler: fluobromide - {e7aff349-39e1-4a96-a13d-24983440b44a} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe

--
End of file - 8330 bytes

Det ser ud som om malwarebyte fandt noget, men gjorde intet ved det...

1. Fix disse i hijackthis:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O22 - SharedTaskScheduler: fluobromide - {e7aff349-39e1-4a96-a13d-24983440b44a} - (no file)

Genstart PC.
Afinstaller AVG 7 og installer AVG version 8.0. Genstart hvis du bliver bedt om det.

Start Malwarebytes Anti-Malware igen. Denne gang SKAL du HUSKE at opdatere programmet inden du skanner!!! Kan se du bare har kørt programmet uden at opdatere det først.

Log fra Malwarebytes Anti-Malware herind.

... samt "Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte"..." detaljen...

[FjernerVirus] skal også væk!

Til info er det AntiSpywareMaster infektionen der er tale om, så vidt jeg kan finde ud af...

*ENIG*

Malwarebytes' Anti-Malware 1.28
Database version: 1200
Windows 5.1.2600 Service Pack 3

23-09-2008 22:30:58
mbam-log-2008-09-23 (22-30-58).txt

Skan type: Hurtig skanning
Objekter skannet: 46838
Tid tilbagelagt: 4 minute(s), 1 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
(Ingen mistænkelige filer fundet)

"Skan type: Hurtig skanning"

Du _skal_ foretage et fuldstændigt systemscan - på den igen og ny log :)

Det er også det vi skriver du skal gøre ;)

STOP!

Kør denne igennem i stedet: http://www.ctrlaltdel.dk/SWF_hent.exe

Malwarebytes' Anti-Malware 1.28
Database version: 1182
Windows 5.1.2600 Service Pack 3

23-09-2008 22:22:29
mbam-log-2008-09-23 (22-22-29).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 108063
Tid tilbagelagt: 38 minute(s), 30 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
(Ingen mistænkelige filer fundet)

jeg havde kørt et fuldstændigt scan med malware og har nu kørt Ccleaner også

her følger Combofix

ComboFix 08-09-22.06 - Anne Cordes 2008-09-24  0:44:14.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1030.18.152 [GMT 2:00]
Running from: C:\Documents and Settings\Anne Cordes\Skrivebord\Spywarefri\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin cordes@adrevolver[1].txt
C:\Programmer\MalwareWiped 6.8
C:\Programmer\MalwareWiped 6.8\malwarewipe.ini

.
(((((((((((((((((((((((((  Files Created from 2008-08-23 to 2008-09-23  )))))))))))))))))))))))))))))))
.

2008-09-23 22:44 . 2008-09-23 22:44    <DIR>    d--------    C:\Programmer\Avira
2008-09-23 22:44 . 2008-09-23 22:44    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Avira
2008-09-23 22:38 . 2008-09-23 22:38    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Avg7
2008-09-20 22:35 . 2008-09-20 23:42    <DIR>    d--------    C:\Programmer\Malwarebytes' Anti-Malware
2008-09-20 22:35 . 2008-09-20 22:35    <DIR>    d--------    C:\Documents and Settings\Anne Cordes\Application Data\Malwarebytes
2008-09-20 22:35 . 2008-09-20 22:35    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-20 22:35 . 2008-09-10 00:04    38,528    --a------    C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-20 22:35 . 2008-09-10 00:03    17,200    --a------    C:\WINDOWS\system32\drivers\mbam.sys
2008-09-20 22:28 . 2008-09-20 22:28    <DIR>    d--------    C:\Snort

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 20:52    ---------    d-----w    C:\Programmer\Steam
2008-09-23 20:49    ---------    d--h--w    C:\Programmer\InstallShield Installation Information
2008-09-23 20:38    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-20 22:12    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-20 22:06    ---------    d-----w    C:\Programmer\Google
2008-07-18 20:10    94,920    ----a-w    C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10    53,448    ----a-w    C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10    45,768    ----a-w    C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10    36,552    ----a-w    C:\WINDOWS\system32\wups.dll
2008-07-18 20:09    563,912    ----a-w    C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09    325,832    ----a-w    C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09    205,000    ----a-w    C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09    1,811,656    ----a-w    C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07    270,880    ----a-w    C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07    210,976    ----a-w    C:\WINDOWS\system32\muweb.dll
2008-07-13 18:47    7,580    ----a-w    C:\Documents and Settings\Benjamin Cordes\Application Data\wklnhst.dat
2008-07-07 20:29    253,952    ----a-w    C:\WINDOWS\system32\es.dll
2008-06-24 16:44    74,240    ----a-w    C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12    295,936    ------w    C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:33    826,368    ----a-w    C:\WINDOWS\system32\wininet.dll
2008-05-30 15:43    32,768    --sha-w    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\MSHist012008053020080531\index.dat
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Programmer\Synaptics\SynTP\SynTPLpr.exe" [2005-08-01 98393]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2005-08-01 688217]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="C:\Programmer\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"avgnt"="C:\Programmer\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SoundMan"="SOUNDMAN.EXE" [2005-08-01 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Reader Hurtigstart.lnk - C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmer\\Messenger\\msmsgs.exe"=
"C:\\Programmer\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-08-01 200192]
S0 esff;esff;C:\WINDOWS\system32\drivers\esff.sys [ ]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-CtrlVol - C:\Launch Manager\CtrlVol.exe
HKLM-Run-NI.ERSK_0001_N91E2012 - C:\DOCUME~1\BENJAM~1\LOKALE~1\Temp\ERS6.exe
HKLM-Run-FjernerVirus - C:\Programmer\FjernerVirus\pgs.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.dk/
O8 -: E&ksporter til Microsoft Excel - C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 -: {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk
O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe
O9 -: {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk -
O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe -

O16 -: {3D2CB570-D425-11D5-ABD0-00008369C46F} - hxxps://netbank.danskebank.dk/html/activex/DB/Menu.cab
C:\WINDOWS\Downloaded Program Files\Menu.inf
C:\WINDOWS\Downloaded Program Files\menu.dll

O16 -: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe

O16 -: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
C:\WINDOWS\Downloaded Program Files\e-Safekey.inf
C:\WINDOWS\Downloaded Program Files\e-Safekey.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-24 00:46:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  CtrlVol = C:\Launch Manager\CtrlVol.exe???????8???????????T??????|x??|????q??|?j?wQj?w????????,??? ???|???????????\??????|????????h?????@? D?????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s???????w??@?N'?s?>9?-6@??>9????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-24  0:47:27
ComboFix-quarantined-files.txt  2008-09-23 22:47:23

Pre-Run: 43.987.820.544 byte ledig
Post-Run: 44,107,005,952 byte ledig

119    --- E O F ---    2008-09-11 00:07:47

Kan se ComboFix tog noget snavs...
Så vidt jeg kan se er der ikke mere at komme efter.
Jeg prøver dog lige at få fat i en rigtig ekspert!

Den venter vi lidt med...

Hent http://www.superantispyware.com/downloads/SUPERAntiSpywarePro1241.exe
Start programmet, klik på Check for updates, når det er opdateret, luk programmet, du skal ikke scanne endnu.
Genstart i fejlsikret. (tryk på <F8> under opstarten)
Start SuperAntiSpyware, klik på Scan your Computer, sæt flueben i de drev der skal scannes.
(Fixed disk betyder harddisk)
Flyt prikken til Perform complete scan og klik på Næste, så kører scanningen.

Når den er færdig kommer der et vindue med en opsummering, klik på OK, klik så på næste og så på Udfør.

Der kommer et vindue med Quarantine and removal Complete, klik på OK, klik på Udfør.
Luk programmet, genstart normalt.
Kopier logfilen herind til tjek.

Jeg er med på en "lytter" i mangel af bedre ord. Husk at slutte af med en hijackthis-log, sådan at vi kan konstatere at alt er fjernet.

Her følger logfilen fra Superantispyware

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/24/2008 at 11:14 PM

Application Version : 4.0.1154

Core Rules Database Version : 3578
Trace Rules Database Version: 1566

Scan type      : Complete Scan
Total Scan Time : 01:39:21

Memory items scanned      : 179
Memory threats detected  : 0
Registry items scanned    : 4900
Registry threats detected : 2
File items scanned        : 16858
File threats detected    : 59

Adware.Tracking Cookie
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@bs.serving-sys[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@advertising[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@ad.yieldmanager[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@adtech[3].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@atdmt[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@socialmedia[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@serving-sys[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@tradedoubler[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@2o7[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@247realmedia[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@doubleclick[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@mediaplex[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@track.adform[3].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@apmebf[2].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@apmebf[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@mediaplex[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@adtech[1].txt
    C:\Documents and Settings\Anne Cordes\Cookies\anne_cordes@track.adform[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@atdmt[4].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@atdmt[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@atdmt[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@adopt.specificclick[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@specificclick[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@doubleclick[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@2o7[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@doubleclick[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@stats.dagenssundhed[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@eas.apm.emediate[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@statcounter[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@telmore.112.2o7[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@track.adform[5].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@track.adform[4].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@track.adform[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@track.adform[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@track.adform[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.livewebstats[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[4].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[7].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[8].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@www.googleadservices[5].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@msnportal.112.2o7[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@stat.postdanmark[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@ad1.emediate[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@advertising[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@advertising[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@advertising[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@eas4.emediate[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin cordes@stats.drivecleaner[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@mediaplex[1].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@mediaplex[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@mediaplex[3].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@account.live[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@herlev.headnet[2].txt
    C:\Documents and Settings\Benjamin Cordes\Cookies\benjamin_cordes@imrworldwide[2].txt
    C:\QooBox\Quarantine\C\Documents and Settings\Benjamin Cordes\Cookies\benjamin cordes@adrevolver[1].txt.vir

Trojan.Media-Codec/V3
    HKCR\VAXObject.Chl
    HKCR\VAXObject.Chl\CLSID

og her følger en HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:32:29, on 24-09-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Anne Cordes\Skrivebord\Spywarefri\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - C:\Documents and Settings\Benjamin Cordes\Skrivebord\InterCasino $$$.lnk (file missing)
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programmer\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe

--
End of file - 6763 bytes

Umiddelbart ser det fint ud nu.

Tak for hjælpen - alt kører ok igen - superlækkert at I gider hjælpe - jeg anbefaler klart jeres side til andre :-)

Rart at høre.
Jeg svarer, men vent på flere svar :)

Det er altid dejligt at kunne hjælpe - selv om jeg nu ikke gjorde så meget :-)