Kill exe

det kan være programmet windows har lavet til at dræbe processoren. har du haft brugt det program?

Hvilket program mener du, kan det være msconfig/start ??

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

(Jooo - jeg har 'virus' på hjernen...)

Her kommer de.

Malwarebytes' Anti-Malware 1.37
Database version: 2210
Windows 5.1.2600 Service Pack 3

02-06-2009 09:23:41
mbam-log-2009-06-02 (09-23-41).txt

Skan type: Fuldstændig skanning (C:\|)
Objekter skannet: 145951
Tid tilbagelagt: 6 hour(s), 50 minute(s), 49 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
(Ingen mistænkelige filer fundet)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:02:40, on 03-06-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\SPAMfighter\sfus.exe
C:\Programmer\Google\Update\GoogleUpdate.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\SPAMfighter\SFAgent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\LevelOne WNC-0301\WlanCU.exe
C:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE
C:\WINDOWS\system32\msfeedssync.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Skrivebord\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Screen Clipper and Launcher til OneNote 2007.lnk = C:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Wireless LAN Utility.lnk = C:\Programmer\LevelOne WNC-0301\WlanCU.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparekassen-vendsyssel.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programmer\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Tjenesten Google Update (gupdate1c9b0b423c076ac) (gupdate1c9b0b423c076ac) - Google Inc. - C:\Programmer\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programmer\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programmer\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmer\SPAMfighter\sfus.exe

--
End of file - 6636 bytes

Hmmm... Hvis det stadig er aktuelt så ->

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

-- Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

Undskyld forsinkelsen, har ikke været hjemme siden fredag. Men her kommer den !
ComboFix 09-06-07.01 - Administrator 07-06-2009 23:12.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.45.1030.18.767.450 [GMT 2:00]
Kører fra: c:\documents and settings\Administrator\Skrivebord\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090607-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

(((((((((((((((((((((((((((((  Filer skabt fra 2009-05-07 til 2009-06-07  )))))))))))))))))))))))))))))))))))
.

2009-06-07 21:06 . 2009-06-07 21:06    --------    d-----w-    c:\programmer\Fælles filer\Application
2009-06-07 21:06 . 2009-06-07 21:12    --------    d-----w-    c:\programmer\SPAMfighter
2009-06-07 20:53 . 2009-02-05 20:06    51376    ----a-w-    c:\windows\system32\drivers\aswTdi.sys
2009-06-07 20:53 . 2009-02-05 20:06    23152    ----a-w-    c:\windows\system32\drivers\aswRdr.sys
2009-06-07 20:53 . 2009-02-05 20:05    26944    ----a-w-    c:\windows\system32\drivers\aavmker4.sys
2009-06-07 20:53 . 2009-02-05 20:08    93296    ----a-w-    c:\windows\system32\drivers\aswmon.sys
2009-06-07 20:53 . 2009-02-05 20:08    94032    ----a-w-    c:\windows\system32\drivers\aswmon2.sys
2009-06-07 20:53 . 2009-02-05 20:07    114768    ----a-w-    c:\windows\system32\drivers\aswSP.sys
2009-06-07 20:53 . 2009-02-05 20:07    20560    ----a-w-    c:\windows\system32\drivers\aswFsBlk.sys
2009-06-07 20:53 . 2009-02-05 20:04    97480    ----a-w-    c:\windows\system32\AvastSS.scr
2009-06-07 20:53 . 2009-02-05 20:11    1256296    ----a-w-    c:\windows\system32\aswBoot.exe
2009-06-05 10:58 . 2009-06-07 15:43    --------    d-----w-    c:\documents and settings\Administrator\Application Data\F-Secure
2009-06-05 10:53 . 2009-06-05 10:53    --------    d-----w-    c:\documents and settings\NetworkService\Lokale indstillinger\Application Data\F-Secure
2009-06-05 10:52 . 2009-06-07 20:51    --------    d-----w-    c:\programmer\TDCSikkerhedspakke
2009-06-05 10:51 . 2009-06-05 10:51    --------    d-----w-    c:\documents and settings\All Users\Application Data\fssg
2009-06-05 10:49 . 2009-06-07 20:48    --------    d-----w-    c:\documents and settings\All Users\Application Data\f-secure
2009-06-02 00:12 . 2009-06-02 00:12    3371383    ----a-w-    c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-02 00:12 . 2009-06-02 00:12    --------    d-----w-    c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-02 00:12 . 2009-05-26 11:19    19096    ----a-w-    c:\windows\system32\drivers\mbam.sys
2009-06-02 00:12 . 2009-05-26 11:20    40160    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-02 00:12 . 2009-06-05 08:11    --------    d-----w-    c:\programmer\Malwarebytes' Anti-Malware
2009-06-02 00:12 . 2009-06-02 00:12    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-01 23:11 . 2009-06-01 23:11    --------    d-----w-    c:\programmer\Recuva
2009-06-01 11:45 . 2009-06-01 11:45    --------    d-----r-    C:\Foretrukne
2009-06-01 11:45 . 2009-03-29 20:22    38674984    ----a-w-    C:\175.19_geforce_winxp_32bit_english_whql.exe
2009-05-31 22:14 . 2009-05-31 22:53    --------    d-----w-    c:\windows\system32\Adobe
2009-05-31 06:31 . 2009-05-31 07:13    --------    d-----w-    c:\documents and settings\Administrator\Application Data\Download Manager
2009-05-30 15:45 . 2009-06-01 07:13    34    ----a-w-    c:\documents and settings\Administrator\jagex_runescape_preferences.dat
2009-05-30 15:45 . 2009-05-31 16:18    --------    d-----w-    c:\windows\.jagex_cache_32
2009-05-28 17:45 . 2009-05-28 17:45    --------    d-----w-    c:\programmer\Alwil Software
2009-05-27 10:36 . 2009-05-27 10:36    --------    d-----w-    c:\programmer\MSConfig CleanUp
2009-05-19 13:03 . 2009-05-19 13:03    --------    d-sh--w-    c:\documents and settings\Administrator\IECompatCache
2009-05-19 13:01 . 2009-05-19 13:01    --------    d-----w-    c:\programmer\CCleaner
2009-05-19 05:35 . 2009-05-19 05:35    --------    d-----w-    c:\programmer\IObit

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 21:07 . 2009-03-23 17:36    --------    d-----w-    c:\programmer\Mozilla Thunderbird
2009-06-07 20:48 . 2002-12-31 12:00    48300    ----a-w-    c:\windows\system32\perfc006.dat
2009-06-07 20:48 . 2002-12-31 12:00    327272    ----a-w-    c:\windows\system32\perfh006.dat
2009-06-07 15:39 . 2009-03-29 21:19    --------    d-----w-    c:\documents and settings\All Users\Application Data\Google Updater
2009-06-02 21:20 . 2009-03-20 21:48    --------    d-----w-    c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-01 08:49 . 2009-03-20 22:05    --------    d-----w-    c:\programmer\Google
2009-05-19 05:44 . 2009-03-29 19:12    --------    d-----w-    c:\documents and settings\Administrator\Application Data\IObit
2009-05-04 23:05 . 2009-05-04 23:05    152576    ----a-w-    c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-04 21:46 . 2009-04-15 19:39    --------    d-----w-    c:\programmer\Mobile Partner
2009-04-30 16:20 . 2009-04-30 16:20    --------    d-----w-    c:\programmer\QuickTime
2009-04-20 10:25 . 2009-04-20 10:25    --------    d-----w-    c:\documents and settings\All Users\Application Data\NOS
2009-04-20 10:25 . 2009-04-20 10:25    --------    d-----w-    c:\programmer\NOS
2009-04-20 10:24 . 2009-04-20 10:24    --------    d-----w-    c:\documents and settings\Administrator\Application Data\AdobeUM
2009-03-23 17:36 . 2009-03-23 17:36    0    ----a-w-    c:\windows\nsreg.dat
2009-03-20 22:01 . 2009-03-20 22:01    69232    ----a-w-    c:\documents and settings\Administrator\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-03-20 21:17 . 2009-03-20 18:08    86327    ----a-w-    c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-20 18:48 . 2009-03-20 18:48    21035    ----a-w-    c:\windows\system32\drivers\AegisP.sys
2009-03-20 18:06 . 2009-03-20 18:06    21644    ----a-w-    c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"Adobe Reader Speed Launcher"="c:\programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2009-04-30 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SPAMfighter Agent"="c:\programmer\SPAMfighter\SFAgent.exe" [2009-03-12 326792]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2003-12-19 65024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Administrator\Menuen Start\Programmer\Start\
Screen Clipper and Launcher til OneNote 2007.lnk - c:\programmer\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Adobe Gamma Loader.lnk - c:\programmer\F‘lles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-21 113664]
Wireless LAN Utility.lnk - c:\programmer\LevelOne WNC-0301\WlanCU.exe [2007-11-28 626688]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmer\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmer\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmer\\SiSoftware\\SiSoftware Sandra Lite 2005.SR3\\sandra.exe"=
"c:\\Programmer\\SiSoftware\\SiSoftware Sandra Lite 2005.SR3\\RpcSandraSrv.exe"=
"c:\\Programmer\\SiSoftware\\SiSoftware Sandra Lite 2005.SR3\\RpcDataSrv.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\iexist.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ifilflyt.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ikundenr.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\initexp.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ikortval.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\iprint.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\totalxml.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\itransak.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\iudpak.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ichckkod.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\igembo.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\iudskriv.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ivaluta.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ixmlinsr.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\totalexp.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ibettype.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\ibackup.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\Wkvit.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\dkt1.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\iartopsl.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\FormView.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\Drawer.exe"=
"c:\\Programmer\\EDB Gruppen\\MO-BIL-LET B410\\pgm\\icruvagt.exe"=
"c:\\Programmer\\EA GAMES\\MOHAA\\MOHAA.EXE"=
"c:\\Programmer\\GlobalSCAPE\\CuteFTP\\cutftp32.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53:TCP"= 53:TCP:websrvx
"1120:UDP"= 1120:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1121:UDP"= 1121:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1122:UDP"= 1122:UDP:Windows Media Format SDK (IEXPLORE.EXE)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [07-06-2009 22:53 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [07-06-2009 22:53 20560]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\programmer\SPAMfighter\sfus.exe [12-03-2009 10:44 184968]
S2 gupdate1c9b0b423c076ac;Tjenesten Google Update (gupdate1c9b0b423c076ac);c:\programmer\Google\Update\GoogleUpdate.exe [29-03-2009 23:20 133104]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\programmer\NOS\bin\getPlus_HelperSvc.exe [20-04-2009 12:25 33176]

--- Andre Services/Drivers i Hukommelsen ---

*NewlyCreated* - ASWUPDSV
*NewlyCreated* - AVAST!_ANTIVIRUS
*NewlyCreated* - AVAST!_MAIL_SCANNER
*NewlyCreated* - AVAST!_WEB_SCANNER
*NewlyCreated* - SPAMFIGHTER_UPDATE_SERVICE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Indhold af mappen 'Planlagte Opgaver'

2009-06-07 c:\windows\Tasks\Google Software Updater.job
- c:\programmer\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-29 21:19]

2009-06-07 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\programmer\Google\Update\GoogleUpdate.exe [2009-03-29 21:20]

2009-06-07 c:\windows\Tasks\User_Feed_Synchronization-{358F4E54-2413-4DC8-BF45-E82B6460881E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
- - - - TOMME GENVEJE FJERNET - - - -

SafeBoot-procexp90.Sys


.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.sparekassen-vendsyssel.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zq21dc77.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.dk/
FF - plugin: c:\programmer\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\programmer\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 23:13
Windows 5.1.2600 Service Pack 3 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------

[HKEY_USERS\S-1-5-21-1123561945-926492609-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c3,00,52,af,8b,a1,06,45,93,0f,a1,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c3,00,52,af,8b,a1,06,45,93,0f,a1,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c3,00,52,af,8b,a1,06,45,93,0f,a1,\
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'winlogon.exe'(652)
c:\windows\SYSTEM32\Wireless\WirelessGina.DLL

- - - - - - - > 'explorer.exe'(1028)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Gennemført tid: 2009-06-07 23:14
ComboFix-quarantined-files.txt  2009-06-07 21:14

Pre-Kørsel: 140.665.434.112 byte ledig
Post-Kørsel: 140.920.111.104 byte ledig

195    --- E O F ---    2009-05-12 21:05

... Hmmm... er det stadig aktuelt ?

Ja på denne - åbenbart

Så tager vi MSCONFIG 'trixet' ...

Start => Kør
Skriv: msconfig
Tryk OK
Vælg fanebladet Fanebladet Startup

Her ka' du én for én fra/tilklikke diverse elementer i din opstart. Med en normal genstart ind imellem...

http://www.spywareinfo.dk/#/tip-og-tricks/msconfig.htm

Så burde 'banditten' dukke op ?

Prøver lige i aften når jeg kommer hjem fra jobbet

Har nu prøvet msconfig/start - ikke noget at se der, men kan se der er installeret et lille program på PC'en - msconfig cleanup, kan det måske have slettet noget som ikke kan findes igen ? Ellers kan jeg ikke greje den, måske en systemgendannelse kunne hjælpe ??

Har fundet løsningen der hjalp på
http://www.dougknox.com/xp/scripts_desc/fix_xp_logon.htm

Så lukker spørgsmålet