Hvordan fjernes virussen "new folder.exe"

http://www.whoismadhur.com/2009/03/04/how-to-remove-newfolderexe-virus/

http://tec-updates.blogspot.com/2007/10/new-folderexe-virus-removal-tool.html

... efter og/eller i samarbejde med ovenstående kan du jo også gennemføre denne 'pakke' ->

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/manual-for-installation-og-brug-af-ccleaner/
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
http://vistaguide.dk/?Artikler/CCleaner-GuideTilOptimeringAfVista/763
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Mht.: Vista/Win7 - HøjreMusseTast - "Kør som Administrator..."

------------------

PS: En anden gang så skriv også hvilket Styresystem der er tale om ?
Win98, ME, W2000, XP, Vista, Win7, OS/2, Unix, Linux, ... ?

Tak for alle svarene. Jeg kigger lige på det i morgen, da jeg sidder med en større opgave, og så uddeler jeg ellers pointene når det lykkedes :)

#1 Nu har jeg prøvet at følge dit link, men jeg går allerede i stå i punkt når jeg har klikket mig ind på den nye guide. Jeg har fundet filerne frem i Command Promt, og der er tilmed også en fil ved navn: "New Folder.exe" , men jeg kan ikke slette den?

Er det fordi den ligger i en mappe og jeg skriver forkert?

mvh Jakob

Hvilket punkt?

NB: Som standard vises "efternavn" ikke på kendte filetyper; derfor:
vises en MAPPE's DEFAULT navn som
[New Folder]
og omtalte Virusprogram som
[New Folder]

Kan du se tekstforskellen ? Nok ikke. Derfor kan en bruger uforvarende klikke på [New Folder] (Virusprogram) ved at tro at det drejer sig om en MAPPE ved navn [New Folder] !!! Og så er F***** løs ...

... kontrolpanel - Mappeindstillinger -
Fanen [Vis] - punktet [  ] "Skjul filtypenavne for kendte filtyper" (altså fraklikkes) ...

---

...men jeg kan ikke slette den... -> Den ER så allerede aktiv. Derfor #3 proceduren !!!

#7 Nu har jeg hentet CCleaner, og har prøvet at analysere og cleane computeren, men hvordan clener jeg mit usb stik samt memory cards? :)

Derfor #3 proceduren !!!

CCleaner er mest for at rydde op i diverse Temp mapper/filer,så efterfølgende scanning ikke skal rende dem igennem også. At det så også generelt er sundt for dyret ...

#9 Okay. Jeg er i gang med at scanne alle drev nu via Malwarebytes' Anti-Malware. Vender tilbage efter det.

#9 Så har jeg scannet og hijacket.

mbam-log-2010-02-02 (20-40-21):
Malwarebytes' Anti-Malware 1.44
Database version: 3680
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

02-02-2010 20:40:21
mbam-log-2010-02-02 (20-40-21).txt

Skan type: Fuldstændig skanning (C:\|D:\|E:\|F:\|G:\|H:\|)
Objekter skannet: 164117
Tid tilbagelagt: 26 minute(s), 56 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 1
Inficerede Mapper: 0
Inficerede Filer: 1

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\WINDOWS\winst.log (Trojan.Agent) -> Delete on reboot.

Hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:50:32, on 02-02-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe
C:\WINDOWS\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jakob Hansen\My Documents\Hentede filer\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lenovo.com/welcome/thinkpad
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lenovo.com/welcome/thinkpad
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lenovo.com/welcome/thinkpad
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://c:/windows/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.2:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://80.209.94.10*
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Proxy] \\gg-fs1\sys\public\copyggxp.bat
O4 - HKLM\..\Run: [CPQEASYBTTN] C:\WINDOWS\system32\BttnServ.exe
O4 - HKLM\..\Run: [(Default)] C:\WINDOWS\svchost.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com/welcome/thinkpad
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265013352159
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: AwayNotify - C:\Program Files\Lenovo\AwayTask\AwayNotify.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Update (SUService) -  - c:\program files\lenovo\system update\suservice.exe
O23 - Service: ThinkVantage Registry Monitor Service - Unknown owner - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

--
End of file - 10569 bytes

Er det en FIRMA PC ?
O4 - HKLM\..\Run: [Proxy] \\gg-fs1\sys\public\copyggxp.bat


---

Er der nogen grund til at du stadig bruger den GAMLE - mindre sikre IE6 ?
Og ikke har instaleret de MANGE opdateringer fra WindowsUpdate der er efter ServicePack3 ?

---

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

4 - HKLM\..\Run: [(Default)] C:\WINDOWS\svchost.exe

Genstart normalt...

-----------------------------------------------------------------

Søg efter filen
new folder.exe
(Også i system/skjulte filer)
og SLET DEM...

-----------------------------------------------------------------

Hvordan kører PC'en så nu ?

STOP...

4 - HKLM\..\Run: [(Default)] C:\WINDOWS\svchost.exe

skal IKKE fixes ...

---

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

NB: Du må ikke døbe den Combofix.exe, men eksempelvis BANAN.exe

-- Kør så combofix.exe (BANAN.exe), som du hentede tidligere, og følg anvisningerne.

Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

#14

ComboFix 10-02-02.02 - Jakob Hansen 02-02-2010  23:39:15.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1455 [GMT -8:00]
Running from: c:\documents and settings\Jakob Hansen\Desktop\Banan.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1583138493-2270468506-272251369-500
c:\windows\system32\BttnServ.exe
c:\windows\system32\drivers\vgkgx.sys
c:\windows\system32\drivers\vytjfuc.sys
c:\windows\system32\drivers\wgdybuo.sys
c:\windows\winst.log

.
(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_lmfpyoj
-------\Service_sokamiiq
-------\Service_ujnonl


(((((((((((((((((((((((((  Files Created from 2010-01-03 to 2010-02-03  )))))))))))))))))))))))))))))))
.

2010-02-03 04:09 . 2010-02-03 04:09    --------    d-----w-    c:\documents and settings\Jakob Hansen\Application Data\Malwarebytes
2010-02-03 04:09 . 2010-01-08 00:07    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-03 04:09 . 2010-02-03 04:09    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-03 04:09 . 2010-01-08 00:07    19160    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-02-03 04:09 . 2010-02-03 04:09    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2010-02-03 01:40 . 2010-02-03 01:40    --------    d-----w-    c:\program files\CCleaner
2010-02-03 01:20 . 2001-08-18 06:36    5632    ----a-w-    c:\windows\system32\ptpusb.dll
2010-02-03 01:20 . 2008-04-13 18:45    15104    ----a-w-    c:\windows\system32\drivers\usbscan.sys
2010-02-03 01:20 . 2008-04-13 18:45    15104    ----a-w-    c:\windows\system32\dllcache\usbscan.sys
2010-02-03 01:20 . 2008-04-14 00:12    159232    ----a-w-    c:\windows\system32\ptpusd.dll
2010-02-02 15:49 . 2009-08-13 15:16    512000    ------w-    c:\windows\system32\dllcache\jscript.dll
2010-02-01 20:32 . 2008-04-13 18:45    26368    ----a-w-    c:\windows\system32\dllcache\usbstor.sys
2010-02-01 18:46 . 2010-02-01 18:46    --------    d-----w-    c:\documents and settings\Jakob Hansen\Application Data\AdobeUM
2010-02-01 18:46 . 2010-02-01 18:46    --------    d-----w-    c:\documents and settings\Jakob Hansen\Local Settings\Application Data\Adobe
2010-02-01 18:30 . 2010-02-01 18:30    --------    d-----w-    c:\windows\system32\scripting
2010-02-01 18:30 . 2010-02-01 18:30    --------    d-----w-    c:\windows\l2schemas
2010-02-01 17:00 . 2010-02-01 17:00    --------    d-----w-    c:\program files\Reference Assemblies
2010-02-01 17:00 . 2008-07-06 12:06    89088    ----a-w-    c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-01 17:00 . 2008-07-06 12:06    89088    ------w-    c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-01 17:00 . 2008-07-06 12:06    117760    ------w-    c:\windows\system32\prntvpt.dll
2010-02-01 17:00 . 2010-02-01 17:00    --------    d-----w-    C:\316acc30ebd2c735bfca
2010-02-01 17:00 . 2008-07-06 12:06    575488    ------w-    c:\windows\system32\xpsshhdr.dll
2010-02-01 17:00 . 2008-07-06 12:06    575488    ------w-    c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-01 17:00 . 2008-07-06 12:06    1676288    ------w-    c:\windows\system32\xpssvcs.dll
2010-02-01 17:00 . 2008-07-06 12:06    1676288    ------w-    c:\windows\system32\dllcache\xpssvcs.dll
2010-02-01 17:00 . 2008-07-06 10:50    597504    ------w-    c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-01 17:00 . 2008-07-06 10:50    597504    ------w-    c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-01 16:57 . 2010-02-01 16:57    --------    d-----w-    c:\program files\MSXML 6.0
2010-02-01 09:38 . 2010-02-01 18:19    --------    d-----w-    c:\windows\ServicePackFiles
2010-02-01 09:37 . 2010-02-01 09:37    --------    d-----w-    c:\program files\MSXML 4.0
2010-02-01 09:05 . 2008-06-13 11:05    272128    ------w-    c:\windows\system32\drivers\bthport.sys
2010-02-01 09:05 . 2008-06-13 11:05    272128    ------w-    c:\windows\system32\dllcache\bthport.sys
2010-02-01 09:05 . 2009-11-21 15:51    471552    ------w-    c:\windows\system32\dllcache\aclayers.dll
2010-02-01 09:02 . 2008-05-08 14:02    203136    ------w-    c:\windows\system32\dllcache\rmcast.sys
2010-02-01 09:02 . 2008-10-24 11:21    455296    ------w-    c:\windows\system32\dllcache\mrxsmb.sys
2010-02-01 09:02 . 2008-12-11 10:57    333952    ------w-    c:\windows\system32\dllcache\srv.sys
2010-02-01 09:02 . 2008-05-01 14:33    331776    ------w-    c:\windows\system32\dllcache\msadce.dll
2010-02-01 09:02 . 2009-07-10 13:27    1315328    ------w-    c:\windows\system32\dllcache\msoe.dll
2010-02-01 09:01 . 2008-04-11 19:04    691712    ------w-    c:\windows\system32\dllcache\inetcomm.dll
2010-02-01 09:01 . 2009-06-10 17:19    2066432    ------w-    c:\windows\system32\dllcache\mstscax.dll
2010-02-01 09:01 . 2008-10-15 16:34    337408    ------w-    c:\windows\system32\dllcache\netapi32.dll
2010-02-01 09:01 . 2009-07-31 04:35    1172480    ------w-    c:\windows\system32\dllcache\msxml3.dll
2010-02-01 09:00 . 2008-05-03 11:55    2560    ------w-    c:\windows\system32\xpsp4res.dll
2010-02-01 09:00 . 2008-04-21 12:08    215552    ------w-    c:\windows\system32\dllcache\wordpad.exe
2010-02-01 08:55 . 2010-02-01 08:55    0    ----a-w-    c:\windows\nsreg.dat
2010-02-01 08:54 . 2010-02-01 08:54    --------    d-----w-    c:\documents and settings\Jakob Hansen\Local Settings\Application Data\Mozilla
2010-02-01 08:52 . 2004-08-04 06:41    1041536    ------w-    c:\windows\system32\drivers\hsfdpsp2.sys
2010-02-01 08:52 . 2004-08-04 06:41    685056    ------w-    c:\windows\system32\drivers\hsfcxts2.sys
2010-02-01 08:52 . 2004-08-04 06:41    220032    ------w-    c:\windows\system32\drivers\hsfbs2s2.sys
2010-02-01 08:36 . 2009-08-07 03:24    44768    ----a-w-    c:\windows\system32\wups2.dll
2010-02-01 08:35 . 2010-02-01 08:35    --------    d-s---w-    c:\documents and settings\Jakob Hansen\UserData
2010-02-01 08:33 . 2010-02-01 08:33    --------    d-----w-    c:\program files\ESET
2010-02-01 08:33 . 2010-02-01 08:33    --------    d-----w-    c:\documents and settings\All Users\Application Data\ESET
2010-02-01 07:10 . 2010-02-03 07:43    3216    ----a-w-    c:\windows\system32\encobject.dat
2010-02-01 07:10 . 2010-02-01 07:10    --------    d-----w-    c:\windows\system32\Client Security Solution
2010-02-01 07:04 . 2010-02-01 06:58    --------    d-----w-    c:\windows\system32\config\systemprofile\Application Data\ThinkVantage
2010-02-01 07:04 . 2010-02-01 06:58    --------    d-----w-    c:\windows\system32\config\systemprofile\Application Data\Lenovo
2010-02-01 07:04 . 2010-02-01 06:48    --------    d-----w-    c:\windows\system32\config\systemprofile\Application Data\Symantec
2010-02-01 06:58 . 2010-02-01 06:58    --------    d-----w-    c:\documents and settings\Administrator\Application Data\ThinkVantage
2010-02-01 06:58 . 2010-02-01 06:58    --------    d-----w-    c:\documents and settings\NetworkService\Local Settings\Application Data\Lenovo
2010-02-01 06:58 . 2010-02-01 06:58    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\Lenovo
2010-02-01 06:58 . 2010-02-01 07:07    --------    d-----w-    c:\documents and settings\Administrator\Application Data\Lenovo
2010-02-01 06:56 . 2010-02-01 06:56    --------    d-sh--r-    C:\RRbackups
2010-02-01 06:55 . 2006-05-04 10:00    115880    ----a-w-    c:\windows\system32\pxinsi64.exe
2010-02-01 06:55 . 2006-03-09 09:00    114856    ----a-w-    c:\windows\system32\pxcpyi64.exe
2010-02-01 06:54 . 2010-02-01 06:55    5427    ----a-w-    c:\windows\system32\EGATHDRV.SYS
2010-02-01 06:53 . 2010-02-01 06:53    --------    d-----w-    c:\program files\SMI2
2010-02-01 06:53 . 2010-02-01 06:53    --------    d-----w-    c:\program files\TVT SMBus
2010-02-01 06:53 . 2010-02-01 07:10    --------    d-----w-    C:\SWSHARE
2010-02-01 06:53 . 2010-02-01 06:54    23552    ----a-w-    c:\windows\system32\drivers\psasrv.exe
2010-02-01 06:53 . 2010-02-01 06:53    7012    ----a-w-    c:\windows\system32\drivers\pmemnt.sys
2010-02-01 06:53 . 2006-11-08 23:06    583232    ----a-w-    c:\windows\system32\tvt_gina.dll
2010-02-01 06:53 . 2006-11-08 23:06    288320    ----a-w-    c:\windows\system32\tvt_gina_api.dll
2010-02-01 06:53 . 2006-01-13 08:33    6016    ----a-w-    c:\windows\system32\drivers\IBMBLDID.sys
2010-02-01 06:53 . 2005-11-08 17:27    11520    ----a-w-    c:\windows\system32\drivers\ANC.sys
2010-02-01 06:53 . 2010-02-01 06:53    --------    d-----w-    c:\program files\Diskeeper Corporation
2010-02-01 06:52 . 2010-02-01 06:52    --------    d-----w-    c:\windows\Downloaded Installations
2010-02-01 06:52 . 2005-07-07 16:06    114688    ----a-w-    c:\windows\desktopset.exe
2010-02-01 06:49 . 2010-02-01 06:49    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-02-01 06:49 . 2010-01-31 23:20    40    ----a-w-    c:\windows\system32\profile.dat
2010-02-01 06:48 . 2010-02-01 06:48    --------    d-----w-    c:\documents and settings\Administrator\Application Data\Symantec
2010-02-01 06:48 . 2010-01-31 23:21    --------    d-----w-    c:\program files\Symantec
2010-02-01 06:48 . 2010-01-31 23:24    --------    d-----w-    c:\program files\Symantec Client Security
2010-02-01 06:48 . 2010-01-31 23:21    --------    d-----w-    c:\program files\Common Files\Symantec Shared
2010-02-01 06:48 . 2010-01-31 23:21    --------    d-----w-    c:\documents and settings\All Users\Application Data\Symantec
2010-02-01 06:47 . 2010-02-01 06:47    --------    d-----w-    c:\program files\PCDR5
2010-02-01 06:45 . 2002-11-22 10:57    204800    ----a-w-    c:\windows\system32\IVIresizeW7.dll
2010-02-01 06:45 . 2002-11-22 10:57    200704    ----a-w-    c:\windows\system32\IVIresizeA6.dll
2010-02-01 06:45 . 2002-11-22 10:57    192512    ----a-w-    c:\windows\system32\IVIresizeP6.dll
2010-02-01 06:45 . 2002-11-22 10:57    192512    ----a-w-    c:\windows\system32\IVIresizeM6.dll
2010-02-01 06:45 . 2002-11-22 10:57    188416    ----a-w-    c:\windows\system32\IVIresizePX.dll
2010-02-01 06:42 . 2010-02-01 06:42    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\Google
2010-02-01 06:42 . 2010-01-31 23:23    --------    d-----w-    c:\program files\Google
2010-02-01 06:42 . 2006-07-25 06:17    139264    ----a-w-    c:\windows\system32\igfxres.dll
2010-02-01 06:42 . 2010-02-01 06:42    --------    d-----w-    c:\documents and settings\NetworkService\Application Data\Intel
2010-02-01 06:39 . 2005-05-04 17:20    53248    ----a-w-    c:\windows\system32\wdmioctl.dll
2010-02-01 06:38 . 2006-03-16 03:04    479232    ----a-w-    c:\windows\system32\TpShCPL.dll
2010-02-01 06:36 . 2008-04-14 00:12    28672    ----a-w-    c:\windows\system32\verclsid.exe
2010-02-01 06:36 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Common Files\Installshield
2010-02-01 06:36 . 2010-02-01 06:36    --------    d-----w-    c:\program files\Windows Media Connect 2
2010-02-01 06:32 . 2010-02-01 06:39    --------    d-----w-    c:\program files\Analog Devices
2010-02-01 06:32 . 2008-04-13 18:36    13952    ----a-w-    c:\windows\system32\drivers\cmbatt.sys
2010-02-01 06:32 . 2008-04-13 18:36    10240    ----a-w-    c:\windows\system32\drivers\compbatt.sys
2010-02-01 06:32 . 2008-04-13 18:36    14208    ----a-w-    c:\windows\system32\drivers\battc.sys
2010-02-01 06:32 . 2008-04-14 00:11    7168    ----a-w-    c:\windows\system32\hccoin.dll
2010-02-01 06:32 . 2008-04-13 18:45    30208    ----a-w-    c:\windows\system32\drivers\usbehci.sys
2010-02-01 06:32 . 2001-08-17 21:51    19584    ----a-w-    c:\windows\system32\drivers\rasirda.sys
2010-02-01 06:32 . 2008-04-14 00:12    151552    ----a-w-    c:\windows\system32\irftp.exe
2010-02-01 06:32 . 2008-04-14 00:12    8192    ----a-w-    c:\windows\system32\wshirda.dll
2010-02-01 06:32 . 2008-04-13 18:54    88192    ----a-w-    c:\windows\system32\drivers\irda.sys
2010-02-01 06:31 . 2008-04-13 18:54    28672    ----a-w-    c:\windows\system32\drivers\nscirda.sys
2010-02-01 06:25 . 2010-02-01 07:05    --------    d-----w-    C:\SWTOOLS
2010-02-01 06:22 . 2010-02-01 07:06    --------    d---a-w-    C:\I386
2010-01-31 23:18 . 2010-01-31 23:18    12328    ----a-w-    c:\documents and settings\Jakob Hansen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-03 03:58 . 2010-02-01 06:44    --------    d-----w-    c:\program files\Common Files\Java
2010-02-01 18:34 . 2006-04-30 07:12    86327    ----a-w-    c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-01 17:48 . 2010-02-01 17:48    --------    d-----w-    c:\program files\Common Files\Adobe
2010-02-01 17:01 . 2010-02-01 17:01    --------    d-----w-    c:\program files\MSBuild
2010-02-01 07:07 . 2010-02-01 07:05    --------    d-----w-    c:\documents and settings\Jakob Hansen\Application Data\Lenovo
2010-02-01 07:07 . 2010-02-01 06:45    --------    d-----w-    c:\documents and settings\All Users\Application Data\Lenovo
2010-02-01 07:05 . 2010-02-01 07:05    50    ----a-w-    c:\windows\system32\drivers\LENOVO_1952_WLL.MRK
2010-02-01 06:58 . 2010-02-01 07:05    --------    d-----w-    c:\documents and settings\Jakob Hansen\Application Data\ThinkVantage
2010-02-01 06:55 . 2010-02-01 06:54    5427    ----a-w-    c:\windows\EGATHDRV.TMP
2010-02-01 06:54 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Common Files\Lenovo
2010-02-01 06:54 . 2010-02-01 06:39    --------    d-----w-    c:\program files\Lenovo
2010-02-01 06:53 . 2006-11-17 00:14    17536    ----a-w-    c:\windows\system32\drivers\psadd.sys
2010-02-01 06:53 . 2010-02-01 06:38    --------    d-----w-    c:\program files\ThinkPad
2010-02-01 06:53 . 2010-02-01 06:38    --------    d--h--w-    c:\program files\InstallShield Installation Information
2010-02-01 06:48 . 2010-02-01 07:05    --------    d-----w-    c:\documents and settings\Jakob Hansen\Application Data\Symantec
2010-02-01 06:46 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Sonic Icons for Lenovo
2010-02-01 06:46 . 2010-02-01 06:46    --------    d-----w-    c:\documents and settings\All Users\Application Data\InstallShield
2010-02-01 06:46 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Common Files\SureThing Shared
2010-02-01 06:46 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Sonic
2010-02-01 06:46 . 2010-02-01 06:46    --------    d-----w-    c:\program files\Multimedia Center for Think Offerings
2010-02-01 06:46 . 2010-02-01 06:45    --------    d-----w-    c:\program files\Common Files\Sonic Shared
2010-02-01 06:45 . 2010-02-01 06:45    --------    d-----w-    c:\program files\InterVideo
2010-02-01 06:45 . 2010-02-01 06:44    --------    d-----w-    c:\program files\ThinkVantage
2010-02-01 06:45 . 2010-02-01 06:44    --------    d-----w-    c:\program files\Java
2010-02-01 06:40 . 2010-02-01 06:40    --------    d-----w-    c:\documents and settings\LocalService\Application Data\Intel
2010-02-01 06:40 . 2010-02-01 06:40    --------    d-----w-    c:\program files\Digital Line Detect
2010-02-01 06:40 . 2010-02-01 06:40    --------    d-----w-    c:\program files\NetWaiting
2010-02-01 06:40 . 2010-02-01 06:40    --------    d-----w-    c:\program files\CONEXANT
2010-02-01 06:39 . 2010-02-01 06:39    0    ---ha-r-    c:\windows\system32\drivers\IBM_1952_WLL_TP.MRK
2010-02-01 06:39 . 2010-02-01 06:39    21419    ----a-w-    c:\windows\system32\drivers\AegisP.sys
2010-02-01 06:39 . 2010-02-01 06:39    --------    d-----w-    c:\windows\system32\config\systemprofile\Application Data\Intel
2010-02-01 06:39 . 2010-02-01 06:39    --------    d-----w-    c:\documents and settings\All Users\Application Data\Intel
2010-02-01 06:39 . 2010-02-01 06:39    --------    d-----w-    c:\program files\Intel
2010-02-01 06:38 . 2010-02-01 06:38    --------    d-----w-    c:\program files\Synaptics
2009-12-22 05:21 . 2006-04-30 06:56    667136    ----a-w-    c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2006-04-30 06:55    81920    ----a-w-    c:\windows\system32\ieencode.dll
2009-11-21 15:51 . 2006-04-30 06:55    471552    ----a-w-    c:\windows\AppPatch\aclayers.dll
2009-11-16 17:06 . 2009-11-16 17:06    96408    ----a-w-    c:\windows\system32\drivers\epfwtdir.sys
2009-11-16 17:03 . 2009-11-16 17:03    108792    ----a-w-    c:\windows\system32\drivers\ehdrv.sys
2009-11-16 16:56 . 2009-11-16 16:56    116520    ----a-w-    c:\windows\system32\drivers\eamon.sys
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 151552]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 208896]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 237568]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-03 856064]
"TpShocks"="TpShocks.exe" [2006-03-16 106496]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"TP4EX"="tp4ex.exe" [2005-10-17 65536]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-07-25 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-07-25 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-07-25 118784]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-07-04 110592]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 81920]
"AwaySch"="c:\program files\Lenovo\AwayTask\AwaySch.EXE" [2006-08-16 69632]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-15 503808]
"DiskeeperSystray"="c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-19 196696]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2007-02-20 409600]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2007-02-20 110592]
"PDService.exe"="c:\program files\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-14 41472]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2006-07-15 2341632]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]
2006-08-16 17:07    49152    ----a-w-    c:\program files\Lenovo\AwayTask\AwayNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 14:45    28672    ----a-w-    c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 11:16    24576    ----a-w-    c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16-11-2009 09:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16-11-2009 09:06 96408]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16-11-2009 09:04 735960]
R2 PrivateDisk;PrivateDisk;c:\program files\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [13-03-2006 16:05 58368]
R2 smi2;smi2;c:\program files\SMI2\smi2.sys [14-07-2006 15:55 3968]
.
Contents of the 'Scheduled Tasks' folder

2010-02-03 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-02-01 16:13]

2010-02-01 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2010-02-01 01:32]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.lenovo.com/welcome/thinkpad
uInternet Connection Wizard,ShellNext = hxxp://www.lenovo.com/welcome/thinkpad
uInternet Settings,ProxyServer = 192.168.1.2:8080
uInternet Settings,ProxyOverride = https://80.209.94.10*
FF - ProfilePath - c:\documents and settings\Jakob Hansen\Application Data\Mozilla\Firefox\Profiles\56dridz9.default\
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",  1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",      2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",      1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",  25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",    5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".dk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Proxy - \\gg-fs1\sys\public\copyggxp.bat
HKLM-Run-(Default) - c:\windows\svchost.exe
Notify-ACNotify - ACNotify.dll
Notify-NavLogon - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-02 23:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1348)
c:\windows\system32\tvt_gina.dll
c:\program files\Lenovo\Client Security Solution\css_gina_plugin.dll
c:\program files\Lenovo\Client Security Solution\css_wait_bar.dll
c:\program files\Lenovo\Client Security Solution\cssuserdatadispatcher.dll
c:\program files\Lenovo\Client Security Solution\csswait.dll
c:\program files\Common Files\Lenovo\tvt_banner.dll
c:\program files\Lenovo\Client Security Solution\cssdlgpwentry.dll
c:\program files\Lenovo\Client Security Solution\dlganswerprompt.dll
c:\program files\Lenovo\Client Security Solution\tvttsp.dll
c:\program files\Lenovo\Client Security Solution\tcsrpc.dll
c:\program files\Common Files\Lenovo\tvt_res.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\tphklock.dll
c:\program files\Lenovo\AwayTask\AwayNotify.dll

- - - - - - - > 'explorer.exe'(3400)
c:\windows\system32\PROCHLP.DLL
c:\program files\Lenovo\Client Security Solution\tvtpwm_windows_hook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\IPSSVC.EXE
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\lenovo\system update\suservice.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\System32\TPHDEXLG.EXE
c:\windows\system32\TpKmpSVC.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Lenovo\Logger\logmon.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\TpShocks.exe
c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
c:\program files\ThinkPad\UltraNav Wizard\UNavTray.EXE
c:\program files\Lenovo\Client Security Solution\tvtpwm_tray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-02  23:46:57 - machine was rebooted
ComboFix-quarantined-files.txt  2010-02-03 07:46

Pre-Run: 40.575.778.816 bytes free
Post-Run: 40.535.080.960 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 312D24C052F9C5DAF704E1415CF1ADEE

Det er en pc købt igennem min fars arbejde. Og angående IE6 er det fordi jeg bruger Mozilla Firefox, og versionen af IE6 er ikke opdateret yderligere, da jeg bootede min computer igår, da den havde virussen overført fra memory card'et :)

... og PC'en kører kun 'lokalt' hos dig ? Altså ikke forbundet til firmates server ell. lign. ?

Burde være ominstaleret!

---

Selvom du ikke bruger IE så er den aktiv på en eller anden måde alligevel, og bør (skal) opdateres. Banditprogrammer finder alligevel vej igennem en IKKE opdateret IE; er oplevet flere gange...

---

Med CCleaner - værktøjer - opstart - du bør/skal fjerne:
* [Proxy] \\gg-fs1\sys\public\copyggxp.bat

---

Hvordan kører PC'en så nu ?

Den kører kun lokalt hos mig ja. Computeren var forresten også ominstalleret - fra fabriksny -, jeg formulerede mig bare ikke korrekt.

Nu har jeg prøvet at finde [Proxy] \\gg-fs1\sys\public\copyggxp.bat , men den er der hverken i CCleaner, Hijackthis eller Combofix, så jeg antager at virussen er væk?

Det skal siges at jeg har mulighed for at slette "new folder.exe" mappen nu, og den kommer ikke retur, hvilket vel er et godt tegn?

Og for at være på den helt sikre side... hvordan ved jeg at virussen med 100 % garanti er væk? Skal jeg evt. smide en log herind?

Den nævnte
\\gg-fs1\sys\public\copyggxp.bat
virkede mere som en 'rest' fra en SERVER forbindelse (altså ikke noget med Virus at gøre...)

Ping...
(Det var et [svar]...)

#20 men hvordan kan jeg være 100 % sikker på at virussen er væk? Jeg bliver nok ikke voldsom populær, hvis jeg begynder at smide usb stik og memory card i de andre computere, og de så også ender med en virus :)