Hej... har kørt Combofix og fik adgang til
www.microsoft.com - opdaterede straks min virusscanner og har scannet disk et par gange. Der er igen lukket ned for Microsoft, Norman og en masse andet. Her er Combofix loggen og en frisk HiJackThis log:
ComboFix 09-10-16.09 - Karsten Ydegaard 18-10-2009 11:56.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.45.1030.18.511.229 [GMT 2:00]
Kører fra: c:\documents and settings\Karsten Ydegaard\Dokumenter\PC\KVY.exe
AV: VIRUSfighter ver. 5.80 *On-access scanning enabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Karsten Ydegaard\Application Data\Desktopicon
c:\documents and settings\Karsten Ydegaard\Application Data\Desktopicon\eBayShortcuts.exe
c:\programmer\INSTALL.LOG
c:\recycler\S-1-5-21-3952667337-2119979879-3970303382-1003
c:\windows\Installer\eeee0.msi
c:\windows\system32\ntSVc.ocx
.
((((((((((((((((((((((((((((( Filer skabt fra 2009-09-18 til 2009-10-18 )))))))))))))))))))))))))))))))))))
.
2009-10-18 09:50 . 2009-10-18 09:52 -------- d-----w- C:\KVY
2009-10-17 20:17 . 2009-10-17 20:17 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\Malwarebytes
2009-10-17 20:17 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-17 20:17 . 2009-10-17 20:17 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2009-10-17 20:17 . 2009-10-17 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-17 20:17 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-17 16:45 . 2009-10-17 16:45 -------- d-----w- c:\programmer\CCleaner
2009-10-14 15:57 . 2009-10-14 15:57 -------- d-----w- c:\programmer\Fælles filer\Authentium
2009-10-14 15:57 . 2009-10-14 15:57 -------- d-----w- c:\programmer\iolo
2009-10-14 15:57 . 2009-10-14 15:57 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo
2009-10-14 15:57 . 2009-10-14 15:57 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\iolo
2009-10-04 14:51 . 2009-10-04 14:51 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\SmartFTP
2009-10-04 14:50 . 2009-10-04 14:50 -------- d-----w- c:\programmer\SmartFTP Client
2009-10-04 14:48 . 2009-10-04 14:48 -------- d-----w- c:\programmer\SmartFTP Client 2.5 Setup Files
2009-10-04 14:38 . 2009-10-04 14:38 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Lokale indstillinger\Application Data\SyncEdit
2009-10-04 13:51 . 2009-10-04 13:51 -------- d-----w- c:\windows\l2schemas
2009-10-04 13:51 . 2009-10-04 13:51 -------- d-----w- c:\windows\system32\da
2009-10-04 13:09 . 2009-10-04 13:10 -------- d-----w- C:\Virusfighter
2009-10-04 08:47 . 2009-10-04 11:04 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\Mp3tag
2009-10-04 08:47 . 2009-10-04 08:47 -------- d-----w- c:\programmer\Mp3tag
2009-09-22 19:00 . 2009-10-14 19:08 -------- d-----w- c:\programmer\Amitech NetBackup
2009-09-22 18:18 . 2009-10-04 08:06 -------- d-----w- c:\windows\system32\NtmsData
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-18 10:07 . 2009-10-18 10:07 4096 ----a-w- c:\windows\system32\03.tmp
2009-10-04 14:16 . 2003-08-02 09:23 63214 ----a-w- c:\windows\system32\perfc006.dat
2009-10-04 14:16 . 2003-08-02 09:23 396140 ----a-w- c:\windows\system32\perfh006.dat
2009-10-04 14:10 . 2005-11-22 13:30 96384 ----a-w- c:\windows\system32\drivers\sptd9741.sys
2009-09-14 20:16 . 2004-03-10 20:38 -------- d-----w- c:\programmer\Lavasoft
2009-09-14 20:16 . 2004-10-30 19:41 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\Lavasoft
2009-09-14 20:15 . 2006-06-26 17:48 -------- d-----w- c:\programmer\CodeStuff
2009-09-14 20:09 . 2006-06-12 15:01 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\SUPERAntiSpyware.com
2009-09-14 20:08 . 2006-05-17 19:38 -------- d-----w- c:\programmer\Fælles filer\Wise Installation Wizard
2009-09-14 17:08 . 2003-09-24 14:50 -------- d-----w- c:\programmer\SkoleKom
2009-09-01 18:20 . 2009-09-01 17:59 -------- d-----w- c:\documents and settings\Karsten Ydegaard\Application Data\AccurateRip
2009-09-01 17:59 . 2009-09-01 17:59 -------- d-----w- c:\programmer\Exact Audio Copy
2009-08-31 17:32 . 2005-01-11 18:14 -------- d-----w- c:\programmer\Winamp
2009-08-30 17:32 . 2004-09-11 15:38 -------- d-----w- c:\programmer\Java
2009-08-23 14:56 . 2009-08-23 14:56 4096 ----a-w- c:\windows\system32\02.tmp
2009-07-25 03:23 . 2008-12-03 15:29 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-03-21 14:21 . 2003-08-02 09:23 157577 --sha-r- c:\windows\system32\mhxiw.dll
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\programmer\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"MSMSGS"="c:\programmer\Messenger\msmsgs.exe" [2008-04-14 1695232]
"WMPNSCFG"="c:\programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\ati-cpanel\atiptaxx.exe" [2003-06-05 335872]
"Norman ZANDA"="c:\virusfighter\bin\ZLH.EXE" [2005-03-07 135168]
"Adobe Reader Speed Launcher"="c:\programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ArcSoft Connection Service"="c:\programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-10-11 31232]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2007-06-29 286720]
"HP Software Update"="c:\programmer\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Share-to-Web Namespace Daemon"="c:\programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"CamMonitor"="c:\programmer\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-06 90112]
"SunJavaUpdateSched"="c:\programmer\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"SyncErr"="c:\programmer\Amitech NetBackup\SyncErr.exe" [2008-05-16 280576]
"Malwarebytes Anti-Malware (reboot)"="c:\programmer\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Jane Ydegaard\Menuen Start\Programmer\Start\
Webshots.lnk - c:\programmer\Webshots\Launcher.exe [2004-2-22 45056]
c:\documents and settings\Karsten Ydegaard\Menuen Start\Programmer\Start\
Webshots.lnk - c:\programmer\Webshots\Launcher.exe [2004-2-22 45056]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4609:TCP"= 4609:TCP:bnvulush
R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [16-09-2003 20:38 9344]
S2 nzcqrhwz;Center Network;c:\windows\system32\svchost.exe -k netsvcs [02-08-2003 11:23 14336]
S2 SyncLive;SyncLive;c:\programmer\Amitech NetBackup\SyncLive.exe [10-04-2007 10:14 23552]
S2 SyncMon;SyncMon;c:\programmer\Amitech NetBackup\SyncMon.exe [06-05-2008 11:42 69120]
S2 SyncQue;SyncQue;c:\programmer\Amitech NetBackup\SyncQue.exe [06-05-2008 12:30 237568]
S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [16-09-2003 20:38 468480]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nzcqrhwz
.
Indhold af mappen 'Planlagte Opgaver'
2009-08-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
.
------- Yderligere scanning -------
.
uStart Page =
www.google.commSearch Bar =
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
DPF: ppctlcab -
hxxp://www.pestscan.com/scanner/ppctlcab.cabDPF: {A590956F-AE99-4419-BB39-3C721276C625} -
hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exeDPF: {F9408298-9658-482C-8B02-93F09A80225F} -
hxxps://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0104.exeFF - ProfilePath - c:\documents and settings\Karsten Ydegaard\Application Data\Mozilla\Firefox\Profiles\m5bh5trs.default\
FF - prefs.js: browser.startup.homepage -
hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:da:officialFF - plugin: c:\program files\Garmin GPS Plugin\npGarmin.dll
FF - plugin: c:\programmer\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\programmer\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programmer\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programmer\Mozilla Firefox\plugins\NPMySrch.dll
FF - plugin: c:\programmer\Mozilla Firefox\plugins\npsabffx.dll
FF - plugin: c:\programmer\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\programmer\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\SuperAdBlocker.com\npsabffx.dll
---- FIREFOX POLITIKKER ----
c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".dk");
.
- - - - TOMME GENVEJE FJERNET - - - -
Toolbar-{54f6af0d-444e-48f6-9397-effa28d32465} - (no file)
WebBrowser-{54F6AF0D-444E-48F6-9397-EFFA28D32465} - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-10-18 12:07
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nzcqrhwz]
"ServiceDll"="c:\windows\system32\mhxiw.dll"
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_USERS\S-1-5-21-1495406720-3153813357-156863503-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6FFB0C0E-568A-BA03-C93E-4B55AD702C68}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jaojdekipdafhehehheg"=hex:6b,61,6b,65,62,6b,62,69,63,64,62,6d,6e,66,6a,6a,6d,
68,69,65,6a,6d,00,01
"iaijjdjhdijbenemcf"=hex:6b,61,6d,65,61,6a,63,61,69,68,61,62,62,6b,70,6c,68,63,
70,6b,66,67,00,01
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'explorer.exe'(2788)
c:\windows\system32\WPDShServiceObj.dll
c:\programmer\Nokia\Nokia PC Suite 6\phonebrowser.dll
c:\programmer\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\programmer\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng.nlr
c:\programmer\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACService.exe
c:\programmer\Fælles filer\Authentium\AntiVirus\dvpapi.exe
c:\programmer\Java\jre6\bin\jqs.exe
c:\virusfighter\Bin\Zanda.exe
c:\windows\system32\HPZipm12.exe
c:\programmer\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
c:\programmer\Webshots\Webshots.scr
c:\programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\programmer\Windows Media Player\wmpnetwk.exe
c:\windows\system32\msiexec.exe
c:\virusfighter\Bin\Njeeves.exe
c:\windows\system32\msiexec.exe
.
**************************************************************************
.
Gennemført tid: 2009-10-18 12:12 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2009-10-18 10:12
Pre-Kørsel: 65.875.177.472 byte ledig
Post-Kørsel: 68.761.825.280 byte ledig
188 --- E O F --- 2009-10-04 14:04
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:20, on 18-10-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Virusfighter\Npm\bin\ELOGSVC.EXE
C:\Virusfighter\Npm\Bin\Zanda.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Windows Media Player\WMPNetwk.exe
C:\Virusfighter\Npm\bin\NJEEVES.EXE
C:\Virusfighter\Nse\bin\NSESVC.EXE
C:\WINDOWS\System32\alg.exe
C:\Virusfighter\Nvc\BIN\NVCSCHED.EXE
C:\Virusfighter\Nvc\bin\nvcoas.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\Virusfighter\Npm\bin\ZLH.EXE
C:\Virusfighter\Nvc\BIN\NIP.EXE
C:\Virusfighter\Nvc\bin\cclaw.exe
C:\Programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Programmer\Java\jre6\bin\jusched.exe
C:\Programmer\Amitech NetBackup\SyncErr.exe
C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Virusfighter\Nvc\BIN\nvcod.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Karsten Ydegaard\Dokumenter\Downloads\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Programmer\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Virusfighter\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programmer\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SyncErr] C:\Programmer\Amitech NetBackup\SyncErr.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmer\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmer\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Programmer\Webshots\Launcher.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver -
res://C:\WINDOWS\system32\GPhotos.scr/200O8 - Extra context menu item: E&ksporter til Microsoft Excel -
res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Programmer\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: ppctlcab -
http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} -
https://externalnf.maerskdata.dk/Citrix/ICAWEB/en/ica32/wficac.cabO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exeO16 - DPF: {819F8533-D935-4183-B692-587F8D56AC3C} (iolo.AV.OnlineVirusScanner) -
http://www.iolo.com/threatcenter/App/ocx/AVCheckUp.ocxO16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} -
https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exeO16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
http://download.abacast.com/download/files/abasetup152.cabO16 - DPF: {F9408298-9658-482C-8B02-93F09A80225F} -
https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0104.exeO23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Programmer\Fælles filer\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Programmer\Fælles filer\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Virusfighter\Npm\bin\ELOGSVC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Virusfighter\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Virusfighter\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Virusfighter\Nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Virusfighter\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Virusfighter\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SyncLive - Amitech Danmark A/S - C:\Programmer\Amitech NetBackup\SyncLive.exe
O23 - Service: SyncMon - Amitech Danmark A/S - C:\Programmer\Amitech NetBackup\SyncMon.exe
O23 - Service: SyncQue - Amitech Danmark A/S - C:\Programmer\Amitech NetBackup\SyncQue.exe
O24 - Desktop Component 0: (no name) -
http://www.norefjell.com/webcams/pictures/ENONOREF_653.jpgO24 - Desktop Component 1: (no name) -
http://www.skeikampen.no/webcams/pictures/ENOSKEI_649.jpg--
End of file - 9321 bytes
