Jeg synes det er en super idé at lave en, "inden vi begynder" guide. IMO bliver den måske indledt en kende arrogant, men det har jo ikke noget med nytteværdien at gøre. ;)

Man kan jo ikke forvente andet end ordentligt arbejde fra den kant. :o)

"Rootchk" blir dd 24 juli rated som Adware af Avast! AntiVirus!
Overvej at opdatere Artikel

God artikel, selvom jeg personligt ikke er enig i vurderingen af fildelingsklienter. Angående rootchk, så har en bruger på Spywarefri hjulpet mig med at få Avast til at rette deres fejl. Rootchk skulle således ikke blive detekteret mere :-)

Rolig nu fromsej, det er overkill at afinstallere alle de programmer du nævner øverst. Eksempelvis så indeholder selve programmet Azureus INTET spy/ad/malware overhovedet! Det kan godt være man kan hente filer med spyware gennem denne og lignende fildelingsprogrammer - men det kan man også på resten af Internettet! Skal vi så ikke også afinstallere alle browsere, fordi der bevisligt kommer alverdens skidt ind den vej?! For lige at bruge din egen formulering.. Nej vel?!?! Håber ikke du tager denne kritik alt ofr ilde op - jeg ved godt at din hensigt er god.. :)

hvor skal jeg lægge mine logs ind? og hvorfor er der ikke en logfil inde i SUPERAntiSpyware > Preferences > Statistics/logs? (har kørt hele programmet, (40min) men den har ikke lagt en logfil derind)

Har endnu ikke haft brug for denne guide men ikke desto mindre ville jeg ikke tøve med at benytte den da jeg ved hva fromsej står for :)

har lige brugt det og det virkede, jeg kom altid ind i megaupload vis en side var langsom eller ikke fandtes, jeg tror faktisk det var combofix der rettede det, men jeg er ikk sikker! :) fantastisk..

ok

http://www.prevx.com/ (...)

Et program som virker mod denne virus

ogra

Det ser ud til at fungere. Jeg mangler bare nogen der kan kontrollere mine log filer.

Test

Som sædvanligt super arbejde fra fromsej/Team Spywarefri !-)
-- og det er herligt at se kvikke reaktioner fra forfatteren !o]

Hej Jeg har 3 logs... vil i  kigge på dem?
ComboFix 08-03-30.5 - Signe Dyrdal 2008-04-01 16:00:01.1 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1030.18.185 [GMT 2:00]
Running from: C:Documents and SettingsSigne DyrdalSkrivebordnyComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:Documents and SettingsSigne DyrdalApplication DataFunWebProducts
C:Documents and SettingsSigne DyrdalApplication DataFunWebProductsDataSigne Dyrdalavatar.dat
C:ProgrammerFunWebProducts
C:ProgrammerMyWebSearch
C:ProgrammerMyWebSearchbarHistorysearch2
C:ProgrammerMyWebSearchbarSettingss_pid.dat
C:ProgrammerMyWebSearchbarSettingssetting2.htm
C:ProgrammerMyWebSearchbarSettingssettings.dat
C:Programmeroutlook
C:Programmeroutlookp.zip
C:WINDOWSsystem32bszip.dll
C:WINDOWSsystem32cmd.com
C:WINDOWSsystem32ping.com
C:WINDOWSsystem32regedit.com
C:WINDOWSsystem32tasklist.com
C:WINDOWSsystem32tracert.com
D:Autorun.inf

.
(((((((((((((((((((((((((  Files Created from 2008-03-01 to 2008-04-01  )))))))))))))))))))))))))))))))
.

2008-04-01 15:07 . 2008-04-01 15:08    <DIR>    d--------    C:ProgrammerFælles filerWise Installation Wizard
2008-04-01 15:02 . 2008-04-01 15:02    <DIR>    d--------    C:ProgrammerCCleaner
2008-04-01 00:38 . 2008-04-01 00:39    <DIR>    d--------    C:ProgrammerTrend Micro
2008-03-31 21:23 . 2008-03-31 21:23    <DIR>    d--------    C:Documents and SettingsSigne DyrdalDoctorWeb
2008-03-31 20:32 . 2008-03-31 20:32    <DIR>    d--------    C:ProgrammerSUPERAntiSpyware
2008-03-31 20:32 . 2008-03-31 20:32    <DIR>    d--------    C:Documents and SettingsSigne DyrdalApplication DataSUPERAntiSpyware.com
2008-03-31 20:32 . 2008-03-31 20:33    <DIR>    d--------    C:Documents and SettingsAll UsersApplication DataSUPERAntiSpyware.com
2008-03-31 20:30 . 2008-03-31 20:30    <DIR>    d--------    C:Documents and SettingsSigne DyrdalApplication DataGrisoft
2008-03-31 20:30 . 2008-03-31 20:30    <DIR>    d--------    C:Documents and SettingsAll UsersApplication DataGrisoft
2008-03-31 20:30 . 2007-05-30 14:10    10,872    --a------    C:WINDOWSsystem32driversAvgAsCln.sys
2008-03-26 14:33 . 2008-03-26 14:33    <DIR>    d--------    C:Documents and SettingsSigne DyrdalWINDOWS
2008-03-24 12:22 . 2008-03-24 12:22    <DIR>    d--------    C:ProgrammerAlwil Software
2008-03-19 18:56 . 2008-03-19 18:56    <DIR>    d--------    C:ProgrammerGamesBar
2008-03-19 18:56 . 2008-03-19 18:56    <DIR>    d--------    C:ProgrammerGamenext
2008-03-19 18:56 . 2008-03-19 18:56    <DIR>    d--------    C:Documents and SettingsAll UsersApplication DataTEMP

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-27 18:12    ---------    d-----w    C:ProgrammerMicrosoft SQL Server Compact Edition
2008-02-27 18:07    ---------    d-sh--w    C:ProgrammerFælles filerWindowsLiveInstaller
2008-02-27 18:07    ---------    d-----w    C:ProgrammerWindows Live
2008-02-27 18:06    ---------    d-----w    C:Documents and SettingsAll UsersApplication DataWLInstaller
2008-02-01 09:17    586,752    ----a-w    C:WINDOWSWLXPGSS.SCR
2008-01-11 04:40    44,544    ----a-w    C:WINDOWSsystem32dllcachepngfilt.dll
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32ctfmon.exe" [2004-08-27 05:00 15360]
"MsnMsgr"="C:ProgrammerWindows LiveMessengerMsnMsgr.exe" [ ]
"updateMgr"="C:ProgrammerAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"SUPERAntiSpyware"="C:ProgrammerSUPERAntiSpywareSUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"LaunchApp"="Alaunch" []
"SynTPLpr"="C:ProgrammerSynapticsSynTPSynTPLpr.exe" [2004-05-20 19:57 98304]
"SynTPEnh"="C:ProgrammerSynapticsSynTPSynTPEnh.exe" [2004-05-20 19:57 532480]
"RemoteControl"="C:ProgrammerrCyberLinkPowerDVDPDVDServ.exe" [2003-10-21 11:52 40960]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-27 05:00 110592 C:WINDOWSsystem32bthprops.cpl]
"IMJPMIG8.1"="C:WINDOWSIMEimjp8_1IMJPMIG.exe" [2004-08-27 05:00 208952]
"MSPY2002"="C:WINDOWSsystem32IMEPINTLGNTImScInst.exe" [2004-08-27 05:00 59392]
"PHIME2002ASync"="C:WINDOWSsystem32IMETINTLGNTTINTSETP.exe" [2004-08-27 05:00 455168]
"PHIME2002A"="C:WINDOWSsystem32IMETINTLGNTTINTSETP.exe" [2004-08-27 05:00 455168]
"IgfxTray"="C:WINDOWSsystem32igfxtray.exe" [2004-02-11 01:55 155648]
"HotKeysCmds"="C:WINDOWSsystem32hkcmd.exe" [2004-02-11 01:51 118784]
"EPM-DM"="c:acerepmepm-dm.exe" [2004-07-14 14:19 151552]
"ePowerManagement"="C:AcerePMePM.exe" [2004-09-01 17:38 2876416]
"LManager"="C:ProgrammerLaunch ManagerQtZgAcer.EXE" [2004-07-30 11:30 319488]
"SunJavaUpdateSched"="C:ProgrammerJavajre1.6.0_05binjusched.exe" [2008-02-22 04:25 144784]
"HPDJ Taskbar Utility"="C:WINDOWSsystem32spooldriversw32x863hpztsb12.exe" [2005-03-08 06:42 176128]
"GrooveMonitor"="C:ProgrammerMicrosoft OfficeOffice12GrooveMonitor.exe" [2006-10-27 00:47 31016]
"!AVG Anti-Spyware"="C:ProgrammerGrisoftAVG Anti-Spyware 7.5avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]
"CTFMON.EXE"="C:WINDOWSsystem32CTFMON.EXE" [2004-08-27 05:00 15360]
"Nokia.PCSync"="C:ProgrammerNokiaNokia PC Suite 6PcSync2.exe" [2007-03-27 15:58 1744896]

C:Documents and SettingsAll UsersMenuen StartProgrammerStart
HP Digital Imaging Monitor.lnk - C:ProgrammerHPDigital Imagingbinhpqtra08.exe [2005-05-11 23:23:26 282624]
ZyXEL G-162 Wireless Adapter Utility.lnk - C:ProgrammerZyXELG162Gcc.exe [2007-09-12 17:23:45 36864]
Adobe Reader Speed Launch.lnk - C:ProgrammerAdobeAcrobat 7.0Readerreader_sl.exe [2005-09-23 22:05:26 29696]

[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorershellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:ProgrammerSUPERAntiSpywareSASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotify!SASWinLogon]
C:ProgrammerSUPERAntiSpywareSASWINLO.dll 2007-04-19 12:41 294912 C:ProgrammerSUPERAntiSpywareSASWINLO.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Photo Downloader]
--a------ 2005-06-06 23:46 57344 C:ProgrammerAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBullGuard]
C:ProgrammerBullGuard LtdBullGuardbullguard.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregHP Software Update]
--a------ 2005-05-11 23:12 49152 C:ProgrammerHPHP Software UpdateHPWuSchd2.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregPCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 C:ProgrammerNokiaNokia PC Suite 6LaunchApplication.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigservices]
"BsMailProxy"=2 (0x2)
"BsFire"=2 (0x2)
"BsFileScan"=2 (0x2)
"BgMainSvc"=2 (0x2)
"BgLiveSvc"=2 (0x2)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity center]
"AntiVirusOverride"=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"C:\Programmer\Messenger\msmsgs.exe"=
"C:\Programmer\LimeWire\LimeWire.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpqste08.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpofxm08.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hposfx08.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hposid01.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpqscnvw.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpqkygrp.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpqCopy.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpfccopy.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpzwiz01.exe"=
"C:\Programmer\HP\Digital Imaging\Unload\HpqPhUnl.exe"=
"C:\Programmer\HP\Digital Imaging\Unload\HpqDIA.exe"=
"C:\Programmer\HP\Digital Imaging\bin\hpoews01.exe"=
"C:\Programmer\Microsoft Office\Office12\OUTLOOK.EXE"=
"C:\Programmer\Microsoft Office\Office12\groove.exe"=
"C:\Programmer\Microsoft Office\Office12\ONENOTE.EXE"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=

R1 SMBHC;Driver til Microsoft SM Bus-værtscontroller;C:WINDOWSsystem32DRIVERSSMBHC.sys [2001-08-17 21:57]
R2 EpmPsd;Acer EPM Power Scheme Driver;C:WINDOWSsystem32driversepm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:WINDOWSsystem32driversepm-shd.sys [2004-08-14 20:59]
R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;C:WINDOWSsystem32CBTNDIS5.SYS [2003-07-16 22:28]
R3 odysseyIM3;Odyssey Network Services Miniport;C:WINDOWSsystem32DRIVERSodysseyIM3.sys [2003-05-14 16:01]
R3 SMBBATT;Driver til Microsoft Smart Battery;C:WINDOWSsystem32DRIVERSSMBBATT.sys [2004-08-03 23:07]
R3 TNET1130x;ZyXEL 802.11g Wireless Card;C:WINDOWSsystem32DRIVERStnet1130x.sys [2004-06-10 17:14]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 16:01:36
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-01 16:02:05
ComboFix-quarantined-files.txt  2008-04-01 14:02:04
Pre-Run: 6,600,949,760 byte ledig
Post-Run: 6,590,578,688 byte ledig
.
2008-03-13 18:47:11    --- E O F --- 



Logfile of HijackThis v1.99.1
Scan saved at 15:57:29, on 01-04-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:AcereManageranbmServ.exe
C:ProgrammerGrisoftAVG Anti-Spyware 7.5guard.exe
C:ProgrammerFælles filerMicrosoft SharedVS7DEBUGmdm.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:ProgrammerSynapticsSynTPSynTPLpr.exe
C:ProgrammerSynapticsSynTPSynTPEnh.exe
C:ProgrammerrCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:acerepmepm-dm.exe
C:ProgrammerLaunch ManagerQtZgAcer.EXE
C:ProgrammerJavajre1.6.0_05binjusched.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb12.exe
C:ProgrammerMicrosoft OfficeOffice12GrooveMonitor.exe
C:ProgrammerGrisoftAVG Anti-Spyware 7.5avgas.exe
C:WINDOWSsystem32ctfmon.exe
C:ProgrammerSUPERAntiSpywareSUPERAntiSpyware.exe
C:ProgrammerHPDigital Imagingbinhpqtra08.exe
C:ProgrammerHPDigital ImagingbinhpqSTE08.exe
C:ProgrammerZyXELG162Gcc.exe
C:ProgrammerHPDigital ImagingProduct Assistantbinhprblog.exe
C:ProgrammerZyXELG162OdHost.exe
C:ProgrammerInternet Exploreriexplore.exe
C:Documents and SettingsSigne DyrdalSkrivebordnyalternativ.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk/ (...)
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/ (...)
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/ (...)
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/ (...)
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/ (...)
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:PROGRA~1MICROS~2Office12GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:ProgrammerJavajre1.6.0_05binssv.dll
O4 - HKLM..Run: [LaunchApp] Alaunch
O4 - HKLM..Run: [SynTPLpr] C:ProgrammerSynapticsSynTPSynTPLpr.exe
O4 - HKLM..Run: [SynTPEnh] C:ProgrammerSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [RemoteControl] C:ProgrammerrCyberLinkPowerDVDPDVDServ.exe
O4 - HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM..Run: [IMJPMIG8.1] "C:WINDOWSIMEimjp8_1IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM..Run: [MSPY2002] C:WINDOWSsystem32IMEPINTLGNTImScInst.exe /SYNC
O4 - HKLM..Run: [PHIME2002ASync] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /SYNC
O4 - HKLM..Run: [PHIME2002A] C:WINDOWSsystem32IMETINTLGNTTINTSETP.EXE /IMEName
O4 - HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 - HKLM..Run: [EPM-DM] c:acerepmepm-dm.exe
O4 - HKLM..Run: [ePowerManagement] C:AcerePMePM.exe boot
O4 - HKLM..Run: [LManager] C:ProgrammerLaunch ManagerQtZgAcer.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] "C:ProgrammerJavajre1.6.0_05binjusched.exe"
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb12.exe
O4 - HKLM..Run: [GrooveMonitor] "C:ProgrammerMicrosoft OfficeOffice12GrooveMonitor.exe"
O4 - HKLM..Run: [!AVG Anti-Spyware] "C:ProgrammerGrisoftAVG Anti-Spyware 7.5avgas.exe" /minimized
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:ProgrammerWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [updateMgr] C:ProgrammerAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU..Run: [SUPERAntiSpyware] C:ProgrammerSUPERAntiSpywareSUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:ProgrammerHPDigital Imagingbinhpqtra08.exe
O4 - Global Startup: ZyXEL G-162 Wireless Adapter Utility.lnk = C:ProgrammerZyXELG162Gcc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:ProgrammerAdobeAcrobat 7.0Readerreader_sl.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammerJavajre1.6.0_05binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammerJavajre1.6.0_05binssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengermsmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/ (...)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/ (...)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/ (...)
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/ (...)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:PROGRA~1MICROS~2Office12GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:ProgrammerFælles filerMicrosoft SharedHelphxds.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:ProgrammerWindows LiveMailmailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:PROGRA~1FÆLLES~1MICROS~1OFFICE12MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:ProgrammerSUPERAntiSpywareSASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:WINDOWSSYSTEM32igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:AcereManageranbmServ.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:ProgrammerGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:WINDOWSsystem32HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:ProgrammerPC Connectivity SolutionServiceLayer.exe

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/01/2008 at 03:46 PM

Application Version : 4.0.1154

Core Rules Database Version : 3428
Trace Rules Database Version: 1420

Scan type      : Complete Scan
Total Scan Time : 00:31:05

Memory items scanned      : 181
Memory threats detected  : 0
Registry items scanned    : 5272
Registry threats detected : 0
File items scanned        : 13025
File threats detected    : 3

Adware.Tracking Cookie
    C:Documents and SettingsSigne DyrdalCookiessigne_dyrdal@doubleclick[1].txt
    C:Documents and SettingsSigne DyrdalCookiessigne_dyrdal@statse.webtrendslive[1].txt
    C:Documents and SettingsSigne DyrdalCookiessigne_dyrdal@atdmt[2].txt

Håber i kan hjælpe....

Vil lige gøre opmærksom på at det link til SUPERANTISPYWARE er til PRO versionen, burde det ikke rettes til FREEversionen???

Hej Fromsej. Godt arbejde, men linket http://www.spywarefri.dk/ (...) er til en gammel version af Hijackthis.

Jeg har et spørgsmål. Når jeg dobbeltklikker på ikonet til Combofix.exe, bliver jeg bedt om at finde et program at åbne filen med. Hvilket program skal jeg åbne den med?

Let forståeligt og superbrugbart. Tak for, at I gider hjælpe alle os andre. :o)
/sasso

Rigtig dejlig artikel. Har brugt den flere gange, og er altid top-of-mind når der skal fjernes skidt.

hvorfor siger mit antivirus program at combofix er vira?

Som sædvanlig et godt stykke arbejde.

smashlotus: det er derfor der findes antispyware, antivirus m.m. Browserne nu til dags er fyldt med huller, som disse programmer hjælper med til at få fyldt ud så godt det kan lade sig gøre.
lqnne - du skal selvfølgelig oprette et spørgsmål som indeholder dine logs :)
ohhelpme - en falsk positiv!!! hvilken antivirus bruger du?