Virus / keylogger eller ej? - Diverse log-filer
Avast advarede i morges om en "Win32:trojan-gen {other}". Den lå i en tmp-fil Avast ikke kunne slette (lå i /brugernavn/lokale indstillinger/temp/).Derudover har Blizzard advaret mig om at min konto hos dem, er forsøgt tilgået for at ændre password, af en anden end mig.
Det har fået mig til at blive lidt nervøs for en evt. virus eller key-logger, og jeg ville være meget taknemmelig hvis én af Jer med forstand på den slags, kunne finde tid til, at kigge mine log-filer igennem for uønskede sager.
Jeg har gennemgået hele Fromsejs (iøvrigt rigtig gode og letforståelige) vejledning her: http://www.eksperten.dk/guide/1232 og har fået nedenstående 3 logs ud af det efter CC-Cleaner var kørt (volapyk for mig det meste må jeg sige).
På forhånd tak for hjælpen :-)
PS: Det skal lige nævnes at Avast ikke finder den Trojan mere (ved en fuld scanning), men hellere sikker end usikker.
Malwarebytes log:
Malwarebytes' Anti-Malware 1.40
Database version: 2557
Windows 5.1.2600 Service Pack 3
04-08-2009 16:54:16
mbam-log-2009-08-04 (16-54-16).txt
Skan type: Fuldstændig skanning (C:\|)
Objekter skannet: 345308
Tid tilbagelagt: 2 hour(s), 4 minute(s), 57 second(s)
Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 0
Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)
Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)
Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)
Inficerede Mapper:
(Ingen mistænkelige filer fundet)
Inficerede Filer:
(Ingen mistænkelige filer fundet)
Combofix log:
ComboFix 09-08-03.A0 - Claus 04-08-2009 17:03.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.2047.1463 [GMT 2:00]
Kører fra: c:\documents and settings\Claus\Skrivebord\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Claus\Skrivebord\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090804-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\acfc72.msi
.
((((((((((((((((((((((((((((( Filer skabt fra 2009-07-04 til 2009-08-04 )))))))))))))))))))))))))))))))))))
.
2009-08-04 11:43 . 2009-08-04 11:43 -------- d-----w- c:\documents and settings\Claus\Application Data\Malwarebytes
2009-08-04 11:43 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-04 11:43 . 2009-08-04 11:43 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2009-08-04 11:43 . 2009-08-04 11:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-04 11:43 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-03 13:14 . 2009-08-03 13:14 -------- d-----w- c:\programmer\CCleaner
2009-08-03 11:44 . 2009-08-04 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-03 11:44 . 2009-08-03 11:47 -------- d-----w- c:\programmer\Spybot - Search & Destroy
2009-08-03 11:00 . 2009-08-03 11:00 -------- d-----w- c:\programmer\XoftSpySE
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 12:17 . 2007-04-08 11:55 29560 ----a-w- c:\documents and settings\Claus\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-08-04 11:25 . 2007-06-29 23:42 -------- d-----w- c:\programmer\Empire Interactive
2009-08-04 11:25 . 2007-04-08 12:07 -------- d--h--w- c:\programmer\InstallShield Installation Information
2009-07-17 17:34 . 2007-04-08 06:53 -------- d-----w- c:\programmer\World of Warcraft
2009-06-29 15:58 . 2001-10-09 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:58 . 2008-10-27 16:12 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:58 . 2008-10-27 16:12 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-24 21:49 . 2007-04-08 12:07 -------- d-----w- c:\programmer\Realtek
2009-06-24 20:00 . 2009-06-24 20:00 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS
2009-06-24 19:49 . 2009-06-24 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-06-24 19:42 . 2008-09-05 16:45 -------- d-----w- c:\programmer\ATI Technologies
2009-06-24 19:35 . 2009-06-24 19:23 4716 ----a-w- c:\windows\gdrv.sys
2009-06-16 14:39 . 2008-10-27 16:11 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:39 . 2008-10-27 16:11 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-13 08:53 . 2009-06-13 06:32 -------- d-----w- c:\programmer\ICQ6.5
2009-06-13 06:35 . 2008-07-03 16:45 -------- d-----w- c:\programmer\ICQ6
2009-06-03 19:11 . 2008-10-27 16:11 1295360 ----a-w- c:\windows\system32\quartz.dll
2009-05-16 03:58 . 2007-04-08 11:52 4069888 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-05-16 03:39 . 2008-09-05 16:46 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-05-16 03:38 . 2007-04-08 11:52 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-05-16 03:18 . 2008-05-15 02:02 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-05-16 03:17 . 2008-05-15 02:02 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-05-16 03:17 . 2008-05-15 02:01 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-05-16 03:17 . 2008-05-15 02:01 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-05-16 03:17 . 2008-05-15 02:01 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-05-16 03:15 . 2008-05-15 01:59 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-05-16 03:14 . 2008-05-15 01:58 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-05-16 03:07 . 2007-04-08 11:52 2987136 ----a-w- c:\windows\system32\ati3duag.dll
2009-05-16 02:55 . 2008-10-29 02:10 11423744 ----a-w- c:\windows\system32\atioglxx.dll
2009-05-16 02:54 . 2007-04-08 11:52 2122624 ----a-w- c:\windows\system32\ativvaxx.dll
2009-05-16 02:54 . 2008-09-05 16:46 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-05-16 02:54 . 2008-09-05 16:46 3 ----a-w- c:\windows\system32\ativva5x.dat
2009-05-16 02:51 . 2008-09-05 16:46 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-05-16 02:38 . 2009-05-16 02:38 49664 ----a-w- c:\windows\system32\atimpc32.dll
2009-05-16 02:38 . 2008-05-15 01:24 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-05-16 02:33 . 2008-05-15 01:20 479232 ----a-w- c:\windows\system32\atikvmag.dll
2009-05-16 02:31 . 2008-05-15 01:18 139264 ----a-w- c:\windows\system32\atiadlxx.dll
2009-05-16 02:31 . 2008-05-15 01:18 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-05-16 02:30 . 2008-05-15 01:18 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-05-16 02:26 . 2008-05-15 01:16 376832 ----a-w- c:\windows\system32\atiok3x2.dll
2009-05-16 02:24 . 2007-04-08 11:52 651264 ----a-w- c:\windows\system32\ati2cqag.dll
2009-05-16 01:35 . 2009-05-16 01:35 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-05-16 01:34 . 2009-05-16 01:34 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-05-16 01:33 . 2009-05-16 01:33 3158016 ----a-w- c:\windows\system32\aticaldd.dll
2009-05-15 19:05 . 2008-09-05 16:46 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-05-07 15:33 . 2008-10-27 16:11 346624 ----a-w- c:\windows\system32\localspl.dll
2009-07-28 06:06 . 2008-09-14 21:37 134648 ----a-w- c:\programmer\mozilla firefox\components\brwsrcmp.dll
.
------- Sigcheck -------
[7] 2004-08-26 15:53 170496 7DCDC8993BC0BAC37FF74C86CFE33B15 c:\windows\$NtServicePackUninstall$\appmgmts.dll
[7] 2008-04-14 16:05 170496 E39274E0BE87E672211392A4176C4EE6 c:\windows\ServicePackFiles\i386\appmgmts.dll
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"LDM"="c:\programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-08-19 67128]
"MsnMsgr"="c:\programmer\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"SpybotSD TeaTimer"="c:\programmer\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"Launch LGDCore"="c:\programmer\Fælles filer\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1126400]
"Acrobat Assistant 8.0"="c:\programmer\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\programmer\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\programmer\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-05-20 98304]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-02-17 17508864]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mie\Menuen Start\Programmer\Start\
OpenOffice.org 2.3.lnk - c:\programmer\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]
c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Logitech Desktop Messenger.lnk - c:\programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-8-19 67128]
Logitech SetPoint.lnk - c:\programmer\Logitech\SetPoint\SetPoint.exe [2008-11-1 805392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 ----a-w- c:\programmer\Fælles filer\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\World of Warcraft\\WoW-2.0.3-enGB-downloader.exe"=
"c:\\Programmer\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-enGB-downloader.exe"=
"c:\\Programmer\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programmer\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\Programmer\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"c:\\Programmer\\Messenger\\msmsgs.exe"=
"c:\\Programmer\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmer\\Fælles filer\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Programmer\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmer\\World of Warcraft\\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe"=
"c:\\Programmer\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmer\\MSN Messenger\\livecall.exe"=
"c:\\Programmer\\World of Warcraft\\Launcher.exe"=
"c:\\Programmer\\World of Warcraft\\WoW-3.1.1.9835-to-3.1.2.9901-enGB-downloader.exe"=
"c:\\Programmer\\ICQ6.5\\ICQ.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08-04-2008 23:04 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08-04-2008 23:04 20560]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [08-04-2007 08:40 3712]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [05-09-2008 18:42 84992]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [24-06-2009 23:49 1684736]
.
Indhold af mappen 'Planlagte Opgaver'
2009-08-04 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 20:18]
2009-08-04 c:\windows\Tasks\XoftSpySE 2.job
- c:\programmer\XoftSpySE\XoftSpy.exe [2009-07-29 16:30]
2009-08-03 c:\windows\Tasks\XoftSpySE.job
- c:\programmer\XoftSpySE\XoftSpy.exe [2009-07-29 16:30]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.lpsf.dk/
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Claus\Menuen Start\Programmer\IMVU\Run IMVU.lnk
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Claus\Application Data\Mozilla\Firefox\Profiles\x16ccqfr.default\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 17:20
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\Ati2evxx.dll
c:\programmer\fælles filer\logitech\bluetooth\LBTWlgn.dll
c:\programmer\fælles filer\logitech\bluetooth\LBTServ.dll
- - - - - - - > 'explorer.exe'(3700)
c:\programmer\Logitech\SetPoint\lgscroll.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\programmer\Alwil Software\Avast4\aswUpdSv.exe
c:\programmer\Alwil Software\Avast4\ashServ.exe
c:\programmer\Bonjour\mDNSResponder.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\Alwil Software\Avast4\ashMaiSv.exe
c:\programmer\Alwil Software\Avast4\ashWebSv.exe
c:\programmer\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\programmer\Fælles filer\Logishrd\KHAL2\KHALMNPR.exe
c:\programmer\Fælles filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\programmer\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Gennemført tid: 2009-08-04 17:27 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2009-08-04 15:27
Pre-Kørsel: 86.567.309.312 byte ledig
Post-Kørsel: 88.943.534.080 byte ledig
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
207 --- E O F --- 2009-07-29 23:45
Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:21, on 04-08-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmer\Fælles filer\Logitech\G-series Software\LGDCore.exe
C:\Programmer\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Programmer\Java\jre6\bin\jusched.exe
C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programmer\Logitech\SetPoint\SetPoint.exe
C:\Programmer\Fælles filer\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programmer\Fælles filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lpsf.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Programmer\Fælles filer\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programmer\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\FLLESF~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Programmer\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Claus\Menuen Start\Programmer\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmer\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmer\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://frbsrv03.udd.sembsc.dk/qp2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Programmer\Fælles filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmer\Fælles filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programmer\Fælles filer\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 9328 bytes
