Avatar billede deathlydad Nybegynder
25. november 2009 - 01:35 Der er 18 kommentarer og
1 løsning

Virus eller malware??

Hej.

Jeg sidder på en computer (Vista) som ikke vil opdateres via microsoft update. Den går i blå skærm, når den prøver.

Jeg kan heller ikke scanne den med Malware-Bytes, CCleaner, onlinescannere osv, da den stopper enten installationen eller opdateringerne.

Jeg har lavet en Hijackthis log, hvis der var nogen som ville kigge på den og hjælpe med at fjerne snavset??

På forhånd tak..


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:23:03, on 25-11-2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Packard Bell\FIJI\ABoard.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TDCSikkerhedspakke\Common\FSM32.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Kareten\Documents\HJT\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) -  - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Hjælp til tilmelding til Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\TDCSikkerhedspakke\NRS\iescript\baselitmus.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O3 - Toolbar: (no name) - {DB62CC01-ECD2-492E-BCE6-57B0AD8A8D59} - (no file)
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\TDCSikkerhedspakke\NRS\iescript\baselitmus.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\TDCSikkerhedspakke\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TDCSikkerhedspakke\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: &Indstillinger til Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programs\PartyGaming\PartyBingo\RunBingo.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programs\PartyGaming\PartyBingo\RunBingo.exe (file missing)
O13 - Gopher Prefix:
O15 - Trusted Zone: *.danskebank.dk
O15 - Trusted Zone: *.netbank.nordea.dk
O15 - Trusted Zone: *.nordea.dk
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp2.cvusyd.dk/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (Adobe Form Control) - http://www.kps.dk/Codebase/FormCtl.cab
O16 - DPF: {174F0D8D-20F5-4E39-8586-D87C898BABB9} (GateManager TinyClient Loader) - http://ssl.proloen.dk/lib/GMTinyClient.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://www.kortal.dk/ecwplugins/ncs.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.botilbuddet-kareten.dk/controls/IlosoftImageUpload.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\Anti-Virus\fsgk32st.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate1c8e1e46b6eb139) (gupdate1c8e1e46b6eb139) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

--
End of file - 11913 bytes
Avatar billede f-arn Guru
25. november 2009 - 02:32 #1
Har du en alarm nede ved siden af uret?
Kommer der en fejlmeddelelse nar du installerer malwarebytes?
25. november 2009 - 09:49 #2
Først lige lidt 'oprydning' ->

------------------------------------------------------------------------

Kør en scanning med Hijackthis, NB: HøjreMusseTast - "Kør som Administrator..."
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {DB62CC01-ECD2-492E-BCE6-57B0AD8A8D59} - (no file)

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programs\PartyGaming\PartyBingo\RunBingo.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programs\PartyGaming\PartyBingo\RunBingo.exe (file missing)

Genstart normalt...

------------------------------------------------------------------------

Når du kører MalwareBytes så brug HøjreMusseTast - "Kør som Administrator..." - Prøv igen...
25. november 2009 - 09:51 #3
Igen - indslag #1 (kl. 02:32:18) dukkede først op da #2 (kl. 09:49:03) blev [Oprettet] ???
Havde brugt [F5] flere gang først da der i oversigten stod [1] mht. antal indslag !!!
Avatar billede f-arn Guru
25. november 2009 - 10:26 #4
@karise
Ja - det er ved at være et ret trættende problem, specielt fordi jeg ikke synes det ser ud som om Admin/Coadmin gør noget for at rette det. john_stigers rappporterede det jo i lørdags!!
Avatar billede deathlydad Nybegynder
25. november 2009 - 18:27 #5
Hej.
#1
Jeg har ikke set nogen alarm ved uret...

Under installation/kørsel af malwarebytes, Ccleaner, trendmicro onlinescanning + et par stykker til, får jeg meddelelse om at installationsfilen er beskadiget eller databasen er forkert... Uanset meddelelse kan jeg ikke køre nogen af dem.

#2
Jeg er på "problem"-computeren igen på fredag (det er en arbejdscomputer), så der følges din anvisning.

Er der nogen idé om hvad det er??

Skal nok melde tilbage i løbet af fredagen..
Avatar billede deathlydad Nybegynder
27. november 2009 - 12:38 #6
Så er der fixes som beskrevet i #2.

Får stadig ikke lov til at køre Malwarebytes.... Meddelse: "Kildefilen er beskadiget" Har hentet den to andre steder med samme resultat..

Ny HJT-log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:10, on 27-11-2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Packard Bell\FIJI\ABoard.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TDCSikkerhedspakke\Common\FSM32.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Users\Kareten\Documents\HJT\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\TDCSikkerhedspakke\NRS\iescript\baselitmus.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\TDCSikkerhedspakke\NRS\iescript\baselitmus.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\TDCSikkerhedspakke\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TDCSikkerhedspakke\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: &Indstillinger til Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.danskebank.dk
O15 - Trusted Zone: *.netbank.nordea.dk
O15 - Trusted Zone: *.nordea.dk
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp2.cvusyd.dk/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (Adobe Form Control) - http://www.kps.dk/Codebase/FormCtl.cab
O16 - DPF: {174F0D8D-20F5-4E39-8586-D87C898BABB9} (GateManager TinyClient Loader) - http://ssl.proloen.dk/lib/GMTinyClient.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://www.kortal.dk/ecwplugins/ncs.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.botilbuddet-kareten.dk/controls/IlosoftImageUpload.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\Anti-Virus\fsgk32st.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\TDCSikkerhedspakke\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate1c8e1e46b6eb139) (gupdate1c8e1e46b6eb139) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

--
End of file - 9673 bytes


Computeren vil stadig ikke opdatere..
27. november 2009 - 13:02 #7
Så skal der - foreløbig - andre midler til *S* ->

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

NB: Du må ikke døbe den Combofix.exe, men eksempelvis BANAN.exe

-- Kør så combofix.exe (BANAN.exe), som du hentede tidligere, og følg anvisningerne.

Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.
Avatar billede deathlydad Nybegynder
27. november 2009 - 16:01 #8
Combofix-loggen:

ComboFix 09-11-26.02 - Kareten 27-11-2009 15:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.45.1030.18.2046.1261 [GMT 1:00]
Kører fra: c:\users\Kareten\Documents\HJT\banan.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2675174679-1899476623-3150993588-500
c:\windows\system32\twain_32.dll

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-10-27 til 2009-11-27  )))))))))))))))))))))))))))))))))))
.

2009-11-27 14:33 . 2009-11-27 14:34    --------    d-----w-    c:\users\Kareten\AppData\Local\temp
2009-11-27 14:33 . 2009-11-27 14:33    --------    d-----w-    c:\users\Default\AppData\Local\temp
2009-11-24 23:21 . 2009-09-10 13:53    19160    ----a-w-    c:\windows\system32\drivers\mbam.sys
2009-11-24 23:07 . 2009-11-24 23:06    161296    ----a-w-    c:\windows\system32\drivers\tmcomm.sys
2009-11-24 22:37 . 2009-11-24 22:37    --------    d-----w-    c:\users\Kareten\AppData\Roaming\Common Toolkit Suite
2009-11-24 22:35 . 2009-11-24 22:40    4096    d-----w-    c:\program files\Common Files\Common Toolkit Suite
2009-11-24 22:35 . 2009-11-24 22:35    --------    d-----w-    c:\programdata\Common Toolkit Suite
2009-11-24 22:31 . 2009-11-24 22:35    --------    d-----w-    c:\users\Kareten\AppData\Roaming\Fighters
2009-11-24 22:31 . 2009-11-24 22:31    --------    d-----w-    c:\users\Kareten\AppData\Local\PackageAware
2009-11-20 00:49 . 2009-11-20 00:51    4096    d-----w-    c:\program files\Windows Live Safety Center
2009-11-15 13:00 . 2009-11-27 14:55    --------    d-----w-    C:\kl.files
2009-11-14 22:15 . 2009-11-14 22:15    --------    d-----w-    c:\users\Kareten\AppData\Roaming\Malwarebytes
2009-11-14 22:15 . 2009-11-14 22:15    --------    d-----w-    c:\programdata\Malwarebytes
2009-11-14 22:03 . 2009-11-04 15:49    635664    ----a-w-    c:\users\Kareten\AppData\Roaming\IObit\Common\TB_Helper.exe
2009-11-14 20:41 . 2009-11-14 22:03    --------    d-----w-    c:\users\Kareten\AppData\Roaming\IObit
2009-11-14 19:47 . 2009-11-14 19:47    --------    d-----w-    c:\program files\Windows Portable Devices
2009-11-14 19:45 . 2009-09-10 02:00    92672    ----a-w-    c:\windows\system32\UIAnimation.dll
2009-11-14 19:45 . 2009-09-10 02:01    3023360    ----a-w-    c:\windows\system32\UIRibbon.dll
2009-11-14 19:45 . 2009-09-10 02:00    1164800    ----a-w-    c:\windows\system32\UIRibbonRes.dll
2009-11-14 19:43 . 2009-10-01 01:02    30208    ----a-w-    c:\windows\system32\WPDShextAutoplay.exe
2009-11-14 19:42 . 2009-10-08 21:07    4096    ----a-w-    c:\windows\system32\oleaccrc.dll
2009-11-14 19:42 . 2009-10-08 21:08    234496    ----a-w-    c:\windows\system32\oleacc.dll
2009-11-14 19:42 . 2009-10-08 21:08    555520    ----a-w-    c:\windows\system32\UIAutomationCore.dll
2009-11-14 16:40 . 2009-08-14 13:27    2036736    ----a-w-    c:\windows\system32\win32k.sys
2009-11-14 16:40 . 2009-08-10 12:35    355328    ----a-w-    c:\windows\system32\WSDApi.dll
2009-11-06 18:50 . 2009-11-06 18:50    --------    d-----w-    c:\users\Kareten\Office Genuine Advantage
2009-11-06 15:52 . 2006-10-26 18:58    30512    ----a-w-    c:\windows\system32\mdimon.dll
2009-11-06 15:50 . 2009-11-06 15:50    4096    d-----w-    c:\program files\Microsoft Works
2009-11-06 15:49 . 2009-11-06 15:49    --------    d-----w-    c:\program files\Microsoft.NET
2009-11-06 15:46 . 2009-11-06 15:46    --------    d-----r-    C:\MSOCache
2009-11-06 13:42 . 2009-11-06 13:42    --------    d-----w-    c:\users\Kareten\_Personale
2009-11-06 13:41 . 2009-11-06 13:44    4096    d-----w-    c:\users\Kareten\_Beboere
2009-10-30 06:16 . 2009-09-10 14:58    310784    ----a-w-    c:\windows\system32\unregmp2.exe
2009-10-30 06:16 . 2009-09-10 14:59    8147456    ----a-w-    c:\windows\system32\wmploc.DLL

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-27 11:22 . 2007-06-07 13:34    --------    d-----w-    c:\users\Kareten\AppData\Roaming\OpenOffice.org2
2009-11-26 14:31 . 2007-01-29 22:35    85672    ----a-w-    c:\windows\system32\perfc006.dat
2009-11-26 14:31 . 2007-01-29 22:35    481452    ----a-w-    c:\windows\system32\perfh006.dat
2009-11-15 01:04 . 2007-07-15 08:58    16384    d-----w-    c:\programdata\Microsoft Help
2009-11-14 22:53 . 2007-06-17 09:20    --------    d-----w-    c:\program files\DAEMON Tools SearchBar
2009-11-14 19:47 . 2006-11-02 10:25    665600    ----a-w-    c:\windows\inf\drvindex.dat
2009-11-14 19:46 . 2009-11-14 19:46    0    ---ha-w-    c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-14 19:45 . 2009-11-14 19:45    0    ---ha-w-    c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-14 18:52 . 2006-11-02 11:18    4096    d-----w-    c:\program files\Windows Mail
2009-11-06 23:25 . 2007-06-06 14:44    117288    ----a-w-    c:\users\Kareten\AppData\Local\GDIPFONTCACHEV1.DAT
2009-11-06 15:30 . 2007-01-29 13:55    8192    d--h--w-    c:\program files\InstallShield Installation Information
2009-11-06 15:20 . 2006-11-02 12:37    --------    d-----w-    c:\program files\MSBuild
2009-11-06 15:09 . 2007-01-29 14:02    4096    d-----w-    c:\programdata\Symantec
2009-11-06 15:09 . 2007-01-29 14:02    16384    d-----w-    c:\program files\Common Files\Symantec Shared
2009-11-02 19:42 . 2009-10-03 06:41    195456    ------w-    c:\windows\system32\MpSigStub.exe
2009-10-26 09:08 . 2009-10-17 13:10    8192    d-----w-    c:\program files\TDCSikkerhedspakke
2009-10-23 06:17 . 2006-11-02 12:37    --------    d-----w-    c:\program files\Windows Calendar
2009-10-23 06:17 . 2006-11-02 12:37    4096    d-----w-    c:\program files\Windows Sidebar
2009-10-23 06:17 . 2006-11-02 12:37    4096    d-----w-    c:\program files\Windows Journal
2009-10-23 06:17 . 2006-11-02 12:37    4096    d-----w-    c:\program files\Windows Collaboration
2009-10-23 06:17 . 2006-11-02 12:37    4096    d-----w-    c:\program files\Windows Photo Gallery
2009-10-23 06:17 . 2006-11-02 12:37    4096    d-----w-    c:\program files\Windows Defender
2009-10-18 06:21 . 2007-08-07 10:23    --------    d-----w-    c:\program files\Dream Chronicles
2009-10-17 22:34 . 2009-10-17 22:34    8192    d-----w-    c:\program files\Microsoft IntelliPoint
2009-10-17 21:01 . 2009-09-15 22:24    --------    d-----w-    c:\program files\Microsoft
2009-10-17 14:04 . 2009-10-17 14:04    --------    d-----w-    c:\users\Kareten\AppData\Roaming\F-Secure
2009-10-17 13:19 . 2009-10-17 13:12    33920    ----a-w-    c:\windows\system32\drivers\fsbts.sys
2009-10-17 13:11 . 2009-10-17 13:07    --------    d-----w-    c:\programdata\f-secure
2009-10-17 13:10 . 2009-10-17 13:10    --------    d-----w-    c:\programdata\fssg
2009-10-11 03:17 . 2009-02-15 08:29    411368    ----a-w-    c:\windows\system32\deploytk.dll
2009-10-07 10:38 . 2009-10-07 10:38    --------    d-----w-    c:\programdata\Office Genuine Advantage
2009-10-04 05:54 . 2007-06-12 22:30    4096    d-----w-    c:\program files\Azureus
2009-10-03 11:56 . 2007-06-12 22:31    12288    d-----w-    c:\users\Kareten\AppData\Roaming\Azureus
2009-10-03 11:47 . 2008-05-26 22:47    4096    d-----w-    c:\program files\Aglare Mp4 to AVI Converter
2009-10-03 11:45 . 2008-04-23 16:50    4096    d-----w-    c:\program files\Soldier of Fortune II - Double Helix
2009-10-01 01:02 . 2009-11-14 19:43    2537472    ----a-w-    c:\windows\system32\wpdshext.dll
2009-10-01 01:02 . 2009-11-14 19:43    334848    ----a-w-    c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02 . 2009-11-14 19:43    87552    ----a-w-    c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02 . 2009-11-14 19:43    31232    ----a-w-    c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-11-14 19:43    546816    ----a-w-    c:\windows\system32\wpd_ci.dll
2009-10-01 01:01 . 2009-11-14 19:43    160256    ----a-w-    c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01 . 2009-11-14 19:43    60928    ----a-w-    c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01 . 2009-11-14 19:43    350208    ----a-w-    c:\windows\system32\WPDSp.dll
2009-10-01 01:01 . 2009-11-14 19:43    196608    ----a-w-    c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01 . 2009-11-14 19:43    100864    ----a-w-    c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01 . 2009-11-14 19:43    81920    ----a-w-    c:\windows\system32\wpdbusenum.dll
2009-10-01 01:01 . 2009-11-14 19:43    40448    ----a-w-    c:\windows\system32\drivers\WpdUsb.sys
2009-10-01 01:01 . 2009-11-14 19:43    226816    ----a-w-    c:\windows\system32\WpdMtp.dll
2009-10-01 01:01 . 2009-11-14 19:43    61952    ----a-w-    c:\windows\system32\WpdMtpUS.dll
2009-10-01 01:01 . 2009-11-14 19:43    33280    ----a-w-    c:\windows\system32\WpdConns.dll
2009-09-25 02:10 . 2009-11-14 19:44    974848    ----a-w-    c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-11-14 19:44    189440    ----a-w-    c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-11-14 19:44    321024    ----a-w-    c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-11-14 19:44    1554432    ----a-w-    c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-11-14 19:44    351232    ----a-w-    c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-11-14 19:44    847360    ----a-w-    c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-11-14 19:44    280064    ----a-w-    c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-11-14 19:44    135680    ----a-w-    c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-11-14 19:44    195584    ----a-w-    c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-11-14 19:44    829440    ----a-w-    c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-11-14 19:44    369664    ----a-w-    c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-11-14 19:44    252928    ----a-w-    c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-11-14 19:44    519680    ----a-w-    c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-11-14 19:44    486912    ----a-w-    c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-11-14 19:44    161280    ----a-w-    c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-11-14 19:44    218112    ----a-w-    c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-11-14 19:44    1030144    ----a-w-    c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-11-14 19:44    828928    ----a-w-    c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-11-14 19:44    481792    ----a-w-    c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-11-14 19:44    190464    ----a-w-    c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-11-14 19:44    634880    ----a-w-    c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-11-14 19:44    37888    ----a-w-    c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-11-14 19:44    793088    ----a-w-    c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-11-14 19:44    1064448    ----a-w-    c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-11-14 19:44    258048    ----a-w-    c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-11-14 19:44    667648    ----a-w-    c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-11-14 19:44    26112    ----a-w-    c:\windows\system32\printfilterpipelineprxy.dll
2009-09-14 09:29 . 2009-10-16 05:10    144896    ----a-w-    c:\windows\system32\drivers\srv2.sys
2009-09-10 16:48 . 2009-10-16 05:11    218624    ----a-w-    c:\windows\system32\msv1_0.dll
2009-09-04 11:41 . 2009-10-16 05:10    60928    ----a-w-    c:\windows\system32\msasn1.dll
2009-03-29 11:03 . 2009-03-29 11:01    251    ----a-w-    c:\program files\Garden Plannerini.xml
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2006-10-23 1092152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-19 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-20 228088]
"ACTIVBOARD"="c:\program files\Packard Bell\FIJI\aboard.exe" [2007-01-15 54840]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link D-Link Wireless N DWA-140"="c:\program files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe" [2007-03-14 1388544]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"F-Secure Manager"="c:\program files\TDCSikkerhedspakke\Common\FSM32.EXE" [2009-08-05 199264]
"F-Secure TNB"="c:\program files\TDCSikkerhedspakke\FSGUI\TNBUtil.exe" [2009-08-05 2349664]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2006-11-09 3784704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Kareten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\users\Kareten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Kareten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Kareten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):9b,2a,db,68,a9,53,ca,01

R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [17-10-2009 14:12 33920]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\TDCSikkerhedspakke\HIPS\drivers\fshs.sys [17-10-2009 14:11 68064]
R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [17-10-2009 14:11 35680]
R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [17-10-2009 14:11 71040]
R1 fsvista;F-Secure Vista Support Driver;c:\program files\TDCSikkerhedspakke\Anti-Virus\minifilter\fsvista.sys [17-10-2009 14:10 12384]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [24-08-2009 15:51 185640]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30-03-2009 15:28 1533808]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\TDCSikkerhedspakke\Anti-Virus\minifilter\fsgk.sys [17-10-2009 14:10 101496]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\System32\drivers\fetnd6v.sys [22-09-2008 03:20 43520]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\TDCSikkerhedspakke\ORSP Client\fsorsp.exe [17-10-2009 14:11 55936]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [02-04-2007 14:59 328192]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [17-06-2007 10:15 682232]
S2 gupdate1c8e1e46b6eb139;Google Update Service (gupdate1c8e1e46b6eb139);c:\program files\Google\Update\GoogleUpdate.exe [09-07-2008 17:53 133104]
S3 FontCache;Tjenesten Windows-skrifttypecache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [25-05-2008 07:23 21504]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\System32\drivers\rt2870.sys [24-07-2008 17:53 476416]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\TDCSikkerhedspakke\Anti-Virus\win2k\fsfilter.sys [17-10-2009 14:10 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\TDCSikkerhedspakke\Anti-Virus\win2k\fsrec.sys [17-10-2009 14:10 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ      FontCache
.
Indhold af mappen 'Planlagte Opgaver'

2009-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-07-09 11:32]

2009-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-07-09 11:32]

2009-11-27 c:\windows\Tasks\Recovery DVD Creator.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2007-01-29 16:34]

2009-11-27 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-03-29 05:29]

2009-11-27 c:\windows\Tasks\Udvidet garanti.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2007-01-29 16:38]

2009-11-26 c:\windows\Tasks\User_Feed_Synchronization-{3BDC664D-CD2B-42A1-A9BB-E35754B65A4A}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/
uInternet Settings,ProxyOverride = *.local
LSP: c:\program files\TDCSikkerhedspakke\FSPS\program\FSLSP.DLL
Trusted Zone: danskebank.dk
Trusted Zone: nordea.dk
Trusted Zone: nordea.dk\*.netbank
DPF: {174F0D8D-20F5-4E39-8586-D87C898BABB9} - hxxp://ssl.proloen.dk/lib/GMTinyClient.cab
DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} - hxxp://webc.botilbuddet-kareten.dk/controls/IlosoftImageUpload.dll
FF - ProfilePath - c:\users\Kareten\AppData\Roaming\Mozilla\Firefox\Profiles\5t5zkk4g.default\
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff30\gears.dll
FF - component: c:\program files\TDCSikkerhedspakke\NRS\litmus-ff@f-secure.com\components\litmus-ff.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - TOMME GENVEJE FJERNET - - - -

AddRemove-AX-Cursors 4.5 - c:\program files\Axialis\AX-Cursors\UnInstall.exe AX-Cursors 4.5 AXCursor.exe
AddRemove-Easy-PhotoPrint - c:\program files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
AddRemove-HijackThis - c:\users\Kareten\Documents\HJT\HijackThis.exe
AddRemove-MediaNavigation.CDLabelPrint - c:\program files\Canon\CD-LabelPrint\Uninstal.exe Canon.CDLabelPrint.Application
AddRemove-NVIDIA Drivers - c:\windows\system32\NVUNINST.EXE UninstallGUI



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-27 15:34
Windows 6.0.6002 Service Pack 2 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\program files\tdcsikkerhedspakke\hips\fshook32.dll

- - - - - - - > 'lsass.exe'(672)
c:\program files\tdcsikkerhedspakke\hips\fshook32.dll
.
Gennemført tid: 2009-11-27 15:41
ComboFix-quarantined-files.txt  2009-11-27 14:41

Pre-Kørsel: 173.892.894.720 byte ledig
Post-Kørsel: 173.970.870.272 byte ledig

- - End Of File - - 75CBA8197CBCE2A74AA08F9A90D27A37
Avatar billede f-arn Guru
27. november 2009 - 18:09 #9
Nu viser den igen ikke alle inlæg!
Avatar billede f-arn Guru
27. november 2009 - 18:14 #10
Og der kom de så!
Hvordan fjernede du Symantec/Norton?
Var det iøvrigt Symantec eller Norton du havde? Jo-der er forskel!
Avatar billede deathlydad Nybegynder
27. november 2009 - 18:49 #11
Ja, den svinger lidt i hvor mange indlæg den vil vise :-)

Det var Norton 360 og den blev afinstalleret med "tilføj/fjern programmer"
Avatar billede f-arn Guru
27. november 2009 - 19:51 #12
Så vil jeg anbefale dig at hente og køre norton removal tool:
http://solutions.symantec.com/sdccommon/asp/symcu_defcontent_view.asp?ssfromlink=true&sprt_cid=8fd76a20-d443-4ff6-b9e4-9cb7d13cd741&ln=da_DK&seg=hho&lg=da&ct=dk&src=gg

Din nuværende TDC Sikkerhedspakke ser efter combologgen ikke ud til at være ordentligt installeret.

Det kan skyldes at ikke samtlige "rester" efter Norton blev fjernet.
Avatar billede f-arn Guru
27. november 2009 - 20:00 #13
Jeg fant lige et bedre link til norton removal tool:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039
Avatar billede deathlydad Nybegynder
28. november 2009 - 08:09 #14
Norton Removal tool er kørt.

Kan stadig ikke køre Malwarebytes og der er stadig opdateringer som ikke kan installeres....
Avatar billede f-arn Guru
29. november 2009 - 18:00 #15
Prøv at af og geninstallere TDC Sikkerhedspakke og send en ny combolog herind
Avatar billede deathlydad Nybegynder
29. november 2009 - 21:17 #16
Det gør jeg, men er ikke på arbejde før torsdag, så det bliver først der at det bliver gjort..
Avatar billede deathlydad Nybegynder
14. december 2009 - 12:42 #17
Der var intet der virkede, uanset hvad hulen jeg gjorde, så jeg har kørt maskinen tilbage til fabriksindstillingerne. Så udover at det tog en krig med opdateringerne, så kører den perfekt nu :-)

Tager selv point, men hvis der ønskes point for hjælpen, så smid lige et svar :-)
Avatar billede f-arn Guru
14. december 2009 - 18:51 #18
Ingen point til mig,jeg har de point jeg skal bruge :)
Avatar billede deathlydad Nybegynder
15. december 2009 - 17:16 #19
Ok, men tak for hjælpen alligevel :-)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester