HiJackThis log fil skal tjekkes for virus

Er der slet ingen der kan finde ud af at tjekke om der er virus/skidt på min Pc som skal fjernes.?

HiJackThis siger ikke det hele ...

Der er en del generelt 'oprydning' - men først denne 'pakke' ->

---

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/manual-for-installation-og-brug-af-ccleaner/
http://vistaguide.dk/?Artikler/CCleaner-GuideTilOptimeringAfVista/763
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Mht.: Vista/Win7 - HøjreMusseTast - "Kør som Administrator..."

Lige den person jeg håbede på ville hjælpe.. Tak ;-)

Det vil jeg lige gøre.

Jeg skal lige sige jeg i går scannet i fejlsikrede tilstand, med Malwareware Bytes, avast antivirus, spybot search and destroy, Og superAntispyware.

Den eneste der fandt malware 3 stk. var Malwarebytes.

Men jeg gør lige som du beskriver.

Log fra Malwarebytes Anti-Malware:


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5447

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18975

04-01-2011 10:52:49
mbam-log-2011-01-03 (21-42-49).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 370042
Tid gået: 1 time(e), 5 minut(ter), 7 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 3

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
c:\Windows\System32\config\systemprofile\setup.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\kpoc\setup.exe (Trojan.Ransom.Boot) -> Quarantined and deleted successfully.
c:\Windows\Temp\xird\setup.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.


__________________________________________________

Log fra HiJackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:25, on 04-01-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Sheriffen\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\Sheriffen\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Windows\system32\conime.exe
C:\Users\Sheriffen\Downloads\HiJackThis (1).exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\calc.exe
C:\Windows\System32\calc.exe
C:\Windows\System32\calc.exe
C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\YouTube Downloader\YouTubeDownloader.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freefood.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\4Media iPod Toolbar\tbhelper.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\4Media iPod Toolbar\tbcore3.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O3 - Toolbar: 4Media iPod Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\4Media iPod Toolbar\tbcore3.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [ICDRegOCX0] rundll32.exe advpack.dll,RegisterOCX C:\Windows\DOWNLO~1\ActiveXSikkerhedssoftware.ocx
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\Windows\is-0DG2H.exe" /REG /REGSVRMODE
O4 - HKLM\..\RunOnce: ["C:\Windows\system32\cmd.exe"] "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\jv16 PowerTools 2010""
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Opera] C:\Program Files\Opera\rerun.bat
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sheriffen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"
O4 - HKCU\..\Run: [UniblueRegistryBooster] "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - Startup: CNET TechTracker.lnk = C:\Users\Sheriffen\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Kaspersky Security Scan.lnk = ?
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {B0139915-B127-4215-9204-7E2510464FB5} - mscoree.dll (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.freefiles.dk/scan8/oscan8.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: BdInstHk.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: rkotrem - C:\Windows\SYSTEM32\rkotrem.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BullGuard scanning service (BsScanner) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
O23 - Service: BullGuard update service (BsUpdate) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9c296ea78180c) (gupdate1c9c296ea78180c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HeimdalAgentServiceHost - Unknown owner - C:\Program Files\CSIS\Heimdal Agent\Service\HeimdalAgentServiceHost.exe (file missing)
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\system32\WLTRYSVC.EXE

--
End of file - 14569 bytes


Ps. Det er åbnet som administrator og skannet i fejlsikrede tilstand.

Glemte at sige jeg bruger KUN Avast Antivirus prg.

1.
Hvorfor skanner du i Fejlskret tilstand ?

2.
Dine definitioner er forældede.

3.
Hvis det er de samm 3, Malwarebytes fandt igår, har du nogle større problemer.

jeg scanner i fejlsikrede tilstand fordi en her på E har lært mig at så kan den virus/orm ikke lægge et kopi ned igen. Jeg kan godt lige scanne i windows mode.

Inden jeg scannet har jeg opdateret alle disse programmer jeg har nævnt jeg har scannet med.

spybot, Malwarebytes, Sperantispyware, Avats antivirus og cclener

Fint. Gør det. Hvad angår Malwarebytes skal man, hvis man kan, altid skanne i normal tilstand.

Så stemmer din PC tid ikke med DK tid, da den var forbi Database version: 5447 på det angivne tidspunkt.

Database version er PT 5461.

Her karise_larry her er en ny log fra Mlwarebytes og fre HiJackthis.

Malwarebytes:


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5461

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

05-01-2011 07:49:52
mbam-log-2011-01-05 (07-49-52).txt

Skanningstype: Fuldstændig skanning (C:\|)
Objekter skannet: 356925
Tid gået: 2 time(e), 28 minut(ter), 3 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
(Ingen skadelige objekter blev fundet)


_ - - - - -- - - - - - - - - - - - - - - - - - - -

Her er Hijackthis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:16:11, on 05-01-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\ProgramData\U3\U3Launcher\LaunchU3.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Users\Sheriffen\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sheriffen\Desktop\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freefood.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\4Media iPod Toolbar\tbhelper.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\4Media iPod Toolbar\tbcore3.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O3 - Toolbar: 4Media iPod Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\4Media iPod Toolbar\tbcore3.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [ICDRegOCX0] rundll32.exe advpack.dll,RegisterOCX C:\Windows\DOWNLO~1\ActiveXSikkerhedssoftware.ocx
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\Windows\is-0DG2H.exe" /REG /REGSVRMODE
O4 - HKLM\..\RunOnce: ["C:\Windows\system32\cmd.exe"] "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\jv16 PowerTools 2010""
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Opera] C:\Program Files\Opera\rerun.bat
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sheriffen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"
O4 - HKCU\..\Run: [UniblueRegistryBooster] "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - Startup: CNET TechTracker.lnk = C:\Users\Sheriffen\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Kaspersky Security Scan.lnk = ?
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {B0139915-B127-4215-9204-7E2510464FB5} - mscoree.dll (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.freefiles.dk/scan8/oscan8.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: BdInstHk.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: rkotrem - C:\Windows\SYSTEM32\rkotrem.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BullGuard scanning service (BsScanner) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
O23 - Service: BullGuard update service (BsUpdate) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9c296ea78180c) (gupdate1c9c296ea78180c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HeimdalAgentServiceHost - Unknown owner - C:\Program Files\CSIS\Heimdal Agent\Service\HeimdalAgentServiceHost.exe (file missing)
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\system32\WLTRYSVC.EXE

--
End of file - 13851 bytes

Er det her bedre og hvad skal slettes ?

Afinstall ->

* uTorrentBar
* Family Toolbar
* 4Media iPod Toolbar
* Conduit Engine Toolbar

---

UniblueRegistryBooster
(Ved ikke rigtigt om den kan bruges til noget seriøst ? Samme famillie som http://www.eksperten.dk/spm/896485 ...)

---

Så er der både noget
* BullGuard
* avast! Antivirus
(Ikke sundt med begge igang...)

---

Ved du selv hvad dette er ->
O20 - Winlogon Notify: rkotrem - C:\Windows\SYSTEM32\rkotrem.dll

---

PS: <f-arn> må gerne bidrage...

Nej jeg aner ikke hvad dette her er: "O20 - Winlogon Notify: rkotrem - C:\Windows\SYSTEM32\rkotrem.dll

Noget slemt kan jeg gå ud fra fra dit spørgsmål.

Ang. Bullgaurd har jeg prøvet at fjerne i Hijackthis ved at åbne den gule mappe og kør så hijackthis prg. i Administrator, men den vil ikke fjerne det.

Jeg har KUN Avast Antivirus som jeg bruger.

Lige en hurtig ->

Gå i Start - Skriv i søgefeltet >  Services  > vælg det program som hedder >  Services.msc  > og højreklik på den og sig "Kør som administrator"

Find Tjenesten (Hvis den er der)

* BullGuard scanning service (BsScanner)
* BullGuard update service (BsUpdate)

* HeimdalAgentServiceHost - Unknown owner

stop den hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

Genstart normalt...

------------------------------------------------------------------------

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [MyWebSearch bar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKLM\..\RunOnce: [ICDRegOCX0] rundll32.exe advpack.dll,RegisterOCX C:\Windows\DOWNLO~1\ActiveXSikkerhedssoftware.ocx

O4 - HKLM\..\RunOnce: [Opera] C:\Program Files\Opera\rerun.bat
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"

O4 - Global Startup: Kaspersky Security Scan.lnk = ?

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O9 - Extra button: (no name) - {B0139915-B127-4215-9204-7E2510464FB5} - mscoree.dll (file missing)

O20 - Winlogon Notify: rkotrem - C:\Windows\SYSTEM32\rkotrem.dll

O23 - Service: BullGuard scanning service (BsScanner) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
O23 - Service: BullGuard update service (BsUpdate) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe

O23 - Service: HeimdalAgentServiceHost - Unknown owner - C:\Program Files\CSIS\Heimdal Agent\Service\HeimdalAgentServiceHost.exe (file missing)

Genstart normalt...

------------------------------------------------------------------------

Hvordan kører PC'en så nu ?

Evt. en oprydning med CCleaner + efterfølgende en frisk log fra HiJackThis ?

jeg har nu flere gange gjort som du har beskrevet med at fjerne dem i Hijackthis, men der er 3 stk. som den ikke vil fjerne selvom jeg har genstartet og tjekket igen og slettet dem og genstartet.

Det er disse her:

O23 - Service: BullGuard scanning service (BsScanner) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
O23 - Service: BullGuard update service (BsUpdate) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe

O23 - Service: HeimdalAgentServiceHost - Unknown owner - C:\Program Files\CSIS\Heimdal Agent\Service\HeimdalAgentServiceHost.exe (file missing)

Den kunne heller ikke finde noget i denne mappe:

Gå i Start - Skriv i søgefeltet >  Services  > vælg det program som hedder >  Services.msc  > og højreklik på den og sig "Kør som administrator"

Find Tjenesten (Hvis den er der)

* BullGuard scanning service (BsScanner)
* BullGuard update service (BsUpdate)

* HeimdalAgentServiceHost - Unknown owner

Log fil fra Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:50:38, on 06-01-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\ProgramData\U3\U3Launcher\LaunchU3.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\mobsync.exe
C:\Users\Sheriffen\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sheriffen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Sheriffen\Desktop\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freefood.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\Windows\is-0DG2H.exe" /REG /REGSVRMODE
O4 - HKLM\..\RunOnce: ["C:\Windows\system32\cmd.exe"] "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\jv16 PowerTools 2010""
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Sheriffen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - Startup: CNET TechTracker.lnk = C:\Users\Sheriffen\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: LaunchU3.exe.lnk = ?
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.sparnord.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.freefiles.dk/scan8/oscan8.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: BdInstHk.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BullGuard scanning service (BsScanner) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
O23 - Service: BullGuard update service (BsUpdate) - BullGuard Ltd. - C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9c296ea78180c) (gupdate1c9c296ea78180c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HeimdalAgentServiceHost - Unknown owner - C:\Program Files\CSIS\Heimdal Agent\Service\HeimdalAgentServiceHost.exe (file missing)
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\system32\WLTRYSVC.EXE

--
End of file - 11629 bytes

Gå i Start - Skriv i søgefeltet >  Services  > vælg det program som hedder >  Services.msc  > og højreklik på den og sig "Kør som administrator"

Find Tjenesten (Hvis den er der)

* BullGuard scanning service (BsScanner)
* BullGuard update service (BsUpdate)

* HeimdalAgentServiceHost - Unknown owner

stop den hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

Hijackthis kan IKKE slette disse filer.

+ UniblueRegistryBooster fremstår IKKE i hijackthis el. når jeg søger efter det prg. eller i tilføj/Fjern prg.

Hvad gør jeg så få det er skide irreterene at bullGuard IKKE gider at blive slettet fra min Pc. ??

Jeg er åben for ALT af divs. løsninger. :)

Jeg tror du kigger 'forkert' mht. denne Services.msc - omtalte elementer bør være der...

---

UniblueRegistryBooster er tilsyneladende væk nu ...

---

Mht.: Vista/Win7 - HøjreMusseTast - "Kør som Administrator..."

Jeg tror jeg har fået løst problemet. Men jeg er ikke helt sikker for NU kan jeg ikke hente windows update ned. Samt logge på min MSN Messenger konto.

Jeg kan heller ikke hente MSN Messenger ned efter jeg afinstalleret den og ville installere den på ny for at se om det virkede men det gjorde det desværre ikke.

1. Download denne fil -> http://www.kortelinks.dk/?HPOOH
2. Højreklik på WindowsUpdate-Reg.cmd og vælg Kør som administrator.
3. Tjek Windows Update.

---

Oprydning med CCleaner...

Hej jg har prøvet at trykke på det link flere gange men den kommer op med at siden ikke eksistere.

... den virker da fint nok! Hvilken Browser bruger du ?
(Det er ikke en 'side' - men et direkte Download link - vil normalt komme ud og spørge om du vil gemme...)

google crome og har prøvet på internet explore

.

http://www.kortelinks.dk/

Det er dette link jeg får frem når jeg trykker på dt link du har været så flink at lægge ind.

men siden viser at den er tom på min computer.

Sådan ser den side ud jeg får frem.

file:///C:/Users/Sheriffen/Desktop/Untitled.html

Dette er en Screenshots. da jeg ville sætte linket ind så blev jeg ved med at få meddelse om at at denne side ikke er tilgængelig(altså eksperten.dk) ´´ derfor blev jeg nød til at tage dette Screenshots så du kunne se hvad jeg taler om.

Underligt at den ikke vil tage det link når jeg kan skrive. derfor dette punktum i svar #23 for at teste om jeg kunne skrive eller om det blot var en fejl.

Bruger du bare den SYNLIG del af

http://www.kortelinks.dk/?HPOOH

eller

http: // www.kortelinks.dk/?HPOOH

Har laaangt om længe fået løst det ved at antivirus prg. de lå og blokeret.

undskyld mit sene svar.
Lægger du et svar. TAK for hjælpen..

Ping...

;-)