Langsom og popups!
Hi.Min computer er langsom og desforuden kommer der popups, hvis jeg evt. har søgt på en hjemmeside. Styresystemet er XP. Neden under ses de forskellige logfiler:
ComboFix 10-08-02.01 - Tanggaard Wulff 02-08-2010 20:45:40.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1030.18.1022.591 [GMT 2:00]
Kører fra: c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Skrivebord\ComboFix.exe
Kommandoer benyttet :: c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Skrivebord\CFScript.txt
AV: F-Secure Client Security 7.10 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Client Security 7.10 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
* Dannede nyt systemgendannelsespunkt
advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.
((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Ijl11.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Filer skabt fra 2010-07-02 til 2010-08-02 )))))))))))))))))))))))))))))))))))
.
2010-07-29 18:05 . 2010-07-29 18:05 -------- d-----w- c:\programmer\StreamTorrent 1.0
2010-07-29 17:11 . 2010-07-29 17:11 -------- d-----w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\StreamTorrent
2010-07-17 07:06 . 2001-10-04 15:07 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-07-17 07:06 . 2008-04-14 07:05 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-07-14 15:41 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-02 18:31 . 2009-02-08 19:24 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware
2010-07-30 10:36 . 2006-03-01 16:53 -------- d-----w- c:\programmer\HAM
2010-07-26 17:22 . 2007-06-20 18:16 -------- d-----w- c:\programmer\CCleaner
2010-07-02 06:20 . 2010-03-10 19:01 0 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\temp.dat
2010-06-25 20:43 . 2010-06-25 20:43 50354 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Facebook\uninstall.exe
2010-06-25 20:43 . 2010-06-25 20:43 -------- d-----w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Facebook
2010-06-19 15:00 . 2010-05-26 19:51 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-10 19:54 . 2007-03-18 12:38 -------- d-----w- c:\programmer\Google
2010-06-10 19:06 . 2010-06-02 16:54 -------- d-----w- c:\programmer\Pippi
2010-06-09 10:45 . 2010-06-09 10:45 5591040 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-06-04 05:39 . 2010-01-26 08:59 -------- d-----w- c:\programmer\Microsoft Silverlight
2010-05-22 06:24 . 2010-05-22 06:24 503808 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-444306e4-n\msvcp71.dll
2010-05-22 06:24 . 2010-05-22 06:24 499712 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-444306e4-n\jmc.dll
2010-05-22 06:24 . 2010-05-22 06:24 348160 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-444306e4-n\msvcr71.dll
2010-05-22 06:22 . 2010-05-22 06:22 12800 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3939b87d-n\decora-d3d.dll
2010-05-22 06:22 . 2010-05-22 06:22 61440 ----a-w- c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3939b87d-n\decora-sse.dll
2010-05-06 10:34 . 2004-08-27 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2007-04-08 17:16 . 2007-04-08 17:16 110592 ----a-w- c:\programmer\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-27 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-27 455168]
"ATIPTA"="c:\programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"Cpqset"="c:\programmer\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"eabconfg.cpl"="c:\programmer\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"hpWirelessAssistant"="c:\programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"F-Secure Manager"="c:\programmer\F-Secure\Common\FSM32.EXE" [2007-08-27 182952]
"F-Secure TNB"="c:\programmer\F-Secure\FSGUI\TNBUtil.exe" [2007-08-27 895600]
"LogitechCommunicationsManager"="c:\programmer\Fælles filer\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2007-03-14 98304]
"SunJavaUpdateSched"="c:\programmer\Fælles filer\Java\Java Update\jusched.exe" [2010-02-18 248040]
c:\documents and settings\All Users.WINDOWS\Menuen Start\Programmer\Start\
Microsoft Office.lnk - c:\programmer\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 14:37 2178832 ----a-w- c:\programmer\Logitech\QuickCam\Quickcam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-04-29 13:39 437584 ----a-w- c:\programmer\Malwarebytes' Anti-Malware\mbamgui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmer\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Programmer\\StreamTorrent 1.0\\StreamTorrent.exe"=
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [4-01-2008 19:26 60272]
R1 F-Secure HIPS;F-Secure HIPS;c:\programmer\F-Secure\HIPS\fshs.sys [4-01-2008 19:25 70768]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\programmer\F-Secure\Anti-Virus\minifilter\fsgk.sys [4-01-2008 19:18 62064]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [14-03-2007 21:08 200192]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASKUTIL.sys [?]
S3 SASENUM;SASENUM;\??\c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\TANGGA~1.PAV\LOKALE~1\Temp\SAS_SelfExtract\SASENUM.SYS [?]
S4 F-Secure Filter;F-Secure File System Filter;c:\programmer\F-Secure\Anti-Virus\win2k\fsfilter.sys [4-01-2008 19:18 39792]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\programmer\F-Secure\Anti-Virus\win2k\fsrec.sys [4-01-2008 19:18 25200]
.
Indhold af mappen 'Planlagte Opgaver'
2010-07-29 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
2010-08-02 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
2010-08-02 c:\windows\Tasks\User_Feed_Synchronization-{07766353-9DCD-4673-984D-819FDB5011DC}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Yderligere scanning -------
.
uStart Page = hxxp://eu.ask.com?o=15003&l=dis
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: c:\programmer\F-Secure\FSPS\program\FSLSP.DLL
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.sparlolland.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.10.cab
DPF: {07E8D22D-C723-485C-BE6F-003241549305} - hxxp://extcom.esoft.dk/extern/3d/eplan.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - hxxp://www.pixaco.dk/static/download/pixacodndupload.cab
DPF: {4445EA6A-9008-40D5-9160-035FDE5214C4} - hxxp://www.123hjemmeside.dk/builder/pages/Mpu-dk-1-0-0-8.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
FF - ProfilePath - c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Mozilla\Firefox\Profiles\7cwi78ym.default\
FF - prefs.js: browser.search.selectedEngine - qtl
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Mozilla\Firefox\Profiles\7cwi78ym.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\Tanggaard Wulff.PAVILIONZV6000\Application Data\Mozilla\Firefox\Profiles\7cwi78ym.default\extensions\turntoolviewer@turntool.com\plugins\nptnt.dll
FF - plugin: c:\programmer\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programmer\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\programmer\Windows Live\Photo Gallery\NPWLPG.dll
---- FIREFOX POLITIKKER ----
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmer\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmer\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programmer\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".dk");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programmer\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - TOMME GENVEJE FJERNET - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-platform beep info - c:\docume~1\TANGGA~1.PAV\APPLIC~1\BROWSE~1\Copypeak1.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-02 20:54
Windows 5.1.2600 Service Pack 3 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\programmer\HPQ\Default Settings\cpqset.exe???????????3?1?2?1??????? ???B????????? ???hLC????????
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------
- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(776)
c:\programmer\F-Secure\FSPS\program\FSLSP.DLL
- - - - - - - > 'explorer.exe'(7792)
c:\programmer\Fælles filer\Logishrd\LVMVFM\LVPrcInj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programmer\Fælles filer\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programmer\F-Secure\Anti-Virus\fsgk32st.exe
c:\programmer\F-Secure\Common\FSMA32.EXE
c:\programmer\F-Secure\Anti-Virus\FSGK32.EXE
c:\programmer\Java\jre6\bin\jqs.exe
c:\programmer\F-Secure\Common\FSMB32.EXE
c:\programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
c:\programmer\F-Secure\Common\FCH32.EXE
c:\windows\system32\HPZipm12.exe
c:\programmer\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\programmer\F-Secure\Common\FAMEH32.EXE
c:\programmer\F-Secure\Anti-Virus\fsqh.exe
c:\programmer\F-Secure\Common\FNRB32.EXE
c:\programmer\F-Secure\Anti-Virus\fssm32.exe
c:\programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
c:\programmer\F-Secure\FSAUA\program\fsaua.exe
c:\programmer\F-Secure\Common\FIH32.EXE
c:\programmer\F-Secure\FWES\Program\fsdfwd.exe
c:\programmer\HPQ\Shared\hpqwmi.exe
c:\programmer\F-Secure\FSGUI\fsguidll.exe
c:\programmer\F-Secure\Anti-Virus\fsav32.exe
.
**************************************************************************
.
Gennemført tid: 2010-08-02 21:04:09 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2010-08-02 19:04
ComboFix2.txt 2008-01-02 08:41
Pre-Kørsel: 47,894,929,408 byte ledig
Post-Kørsel: 47,982,120,960 byte ledig
- - End Of File - - 1C7218580A97ADE2A75C5C28400DE09C
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4381
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5-08-2010 07:10:52
mbam-log-2010-08-05 (07-10-52).txt
Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 262870
Tid gået: 9 time(e), 41 minut(ter), 22 sekund(er)
Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 0
Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)
Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)
Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)
Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)
Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)
Inficerede Mapper:
(Ingen skadelige objekter blev fundet)
Inficerede Filer:
(Ingen skadelige objekter blev fundet)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:30, on 5-08-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programmer\F-Secure\Anti-Virus\fsgk32st.exe
C:\Programmer\F-Secure\Common\FSMA32.EXE
C:\Programmer\F-Secure\Anti-Virus\FSGK32.EXE
C:\Programmer\Java\jre6\bin\jqs.exe
C:\Programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmer\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmer\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\F-Secure\Common\FCH32.EXE
C:\Programmer\F-Secure\Common\FAMEH32.EXE
C:\Programmer\F-Secure\Anti-Virus\fsqh.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmer\F-Secure\Common\FSM32.EXE
C:\Programmer\Fælles filer\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programmer\Fælles filer\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\F-Secure\FSGUI\fsguidll.exe
C:\Programmer\F-Secure\Common\FNRB32.EXE
C:\Programmer\F-Secure\FSAUA\program\fsaua.exe
C:\Programmer\F-Secure\Anti-Virus\fssm32.exe
C:\Programmer\F-Secure\Common\FIH32.EXE
C:\Programmer\F-Secure\FWES\Program\fsdfwd.exe
C:\Programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmer\HPQ\Shared\hpqwmi.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\F-Secure\Anti-Virus\fsav32.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\Mozilla Firefox\plugin-container.exe
C:\Programmer\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmer\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programmer\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmer\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmer\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmer\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmer\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmer\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmer\Fælles filer\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Fælles filer\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp.frosem.dk/qp2.cab
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparlolland.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.10.cab
O16 - DPF: {07E8D22D-C723-485C-BE6F-003241549305} (Ceplan Object) - http://extcom.esoft.dk/extern/3d/eplan.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - http://www.pixaco.dk/static/download/pixacodndupload.cab
O16 - DPF: {4445EA6A-9008-40D5-9160-035FDE5214C4} - http://www.123hjemmeside.dk/builder/pages/Mpu-dk-1-0-0-8.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geograf.com/viewer/mgaxctrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - http://frbsrv02.udd.sembsc.dk/dwa7W.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmer\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Programmer\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Programmer\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmer\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmer\F-Secure\Common\FSMA32.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmer\HPQ\Shared\hpqwmi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programmer\Fælles filer\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programmer\Fælles filer\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmer\Fælles filer\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 9058 bytes
