Nu virker det igen. Så at køre combofix virkede. Tak for det - hvor er det bare dejligt. Fik lige pludselig øje på at jeg nu kunne se reklamerne øverst på siden, da jeg var ved at kopiere loggen ind fra scanningen.
Jeg kopierer lige loggen ind alligevel, for du kan sikkert se hvad det er præcis den har gjort for at det lykkedes. Tak for det hvor er det skønt. Dejligt at kunne få hjælp, når man selv er lidt lost i den slags!!!
Så du har fortjent mindst 100 point!!!!
ComboFix 10-04-17.07 - Anne Lise 18-04-2010 19:58:23.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.45.1030.18.1978.1159 [GMT 2:00]
Kører fra: c:\users\Anne Lise\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((( Filer skabt fra 2010-03-18 til 2010-04-18 )))))))))))))))))))))))))))))))))))
.
2010-04-18 18:25 . 2010-04-18 18:25 -------- d-----w- c:\users\Anne Lise\AppData\Local\temp
2010-04-18 18:25 . 2010-04-18 18:25 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-04-18 18:25 . 2010-04-18 18:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-15 19:54 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 19:11 . 2010-04-15 19:11 -------- d-----w- c:\program files\CCleaner
2010-04-14 19:17 . 2010-04-14 19:17 -------- d-----w- c:\users\Anne Lise\AppData\Local\Threat Expert
2010-04-14 19:12 . 2010-01-22 07:56 149456 ----a-w- c:\windows\SGDetectionTool.dll
2010-04-14 19:12 . 2010-01-22 07:55 767952 ----a-w- c:\windows\BDTSupport.dll
2010-04-14 19:12 . 2008-11-26 10:08 131 ----a-w- c:\windows\IDB.zip
2010-04-14 19:12 . 2010-01-22 07:56 165840 ----a-w- c:\windows\PCTBDRes.dll
2010-04-14 19:12 . 2010-01-22 07:56 1652688 ----a-w- c:\windows\PCTBDCore.dll
2010-04-14 19:12 . 2009-10-27 23:36 1152444 ----a-w- c:\windows\UDB.zip
2010-04-14 19:09 . 2010-02-05 07:18 100136 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2010-04-14 19:09 . 2010-02-05 07:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-04-14 19:09 . 2010-03-10 09:36 217032 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-04-14 19:09 . 2009-11-23 11:54 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-04-14 19:09 . 2010-02-05 07:25 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2010-04-14 19:09 . 2010-04-15 20:44 -------- d-----w- c:\program files\Spyware Doctor
2010-04-14 19:09 . 2010-04-14 19:09 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\PC Tools
2010-04-14 19:09 . 2010-04-14 19:09 -------- d-----w- c:\programdata\PC Tools
2010-04-14 13:33 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 13:33 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 13:33 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 13:33 . 2010-02-18 14:07 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-14 13:33 . 2010-02-18 14:07 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 13:33 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 13:33 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 13:33 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 13:33 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 13:32 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 13:31 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-12 14:45 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-12 14:45 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-12 14:45 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-12 14:45 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-12 14:45 . 2010-04-14 16:31 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-04-12 14:45 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-12 14:45 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-12 14:22 . 2010-04-12 14:22 -------- d-----w- c:\programdata\Alwil Software
2010-04-10 06:05 . 2010-04-10 06:05 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\Malwarebytes
2010-04-10 06:05 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-10 06:05 . 2010-04-10 06:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-10 06:05 . 2010-04-10 06:05 -------- d-----w- c:\programdata\Malwarebytes
2010-04-10 06:05 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-09 20:47 . 2004-08-04 06:00 506368 ----a-w- c:\windows\system32\msxml.dll
2010-04-09 20:47 . 2010-04-14 19:12 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-24 08:18 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-18 17:44 . 2008-08-03 14:33 589296 ----a-w- c:\windows\system32\perfh01D.dat
2010-04-18 17:44 . 2008-08-03 14:33 117296 ----a-w- c:\windows\system32\perfc01D.dat
2010-04-18 17:44 . 2008-08-03 14:27 76390 ----a-w- c:\windows\system32\perfc014.dat
2010-04-18 17:44 . 2008-08-03 14:27 443832 ----a-w- c:\windows\system32\perfh014.dat
2010-04-18 17:44 . 2008-08-03 14:22 80612 ----a-w- c:\windows\system32\perfc00B.dat
2010-04-18 17:44 . 2008-08-03 14:22 427118 ----a-w- c:\windows\system32\perfh00B.dat
2010-04-18 17:44 . 2008-08-03 14:16 77202 ----a-w- c:\windows\system32\perfc006.dat
2010-04-18 17:44 . 2008-08-03 14:16 463344 ----a-w- c:\windows\system32\perfh006.dat
2010-04-18 17:41 . 2009-02-06 19:02 -------- d-----w- c:\program files\NetSoftware
2010-04-15 19:54 . 2008-08-03 17:19 -------- d-----w- c:\program files\Java
2010-04-14 18:59 . 2009-01-27 16:05 68400 ----a-w- c:\users\Anne Lise\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-14 14:34 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-12 14:45 . 2009-06-07 16:37 -------- d-----w- c:\program files\Alwil Software
2010-04-09 23:37 . 2009-01-27 15:58 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\Hewlett-Packard
2010-04-09 23:33 . 2008-08-03 16:35 -------- d-----w- c:\programdata\Hewlett-Packard
2010-04-09 15:37 . 2009-02-02 14:38 -------- d-----w- c:\program files\Pippi
2010-03-31 20:52 . 2008-08-03 17:19 -------- d-----w- c:\program files\Common Files\Java
2010-03-19 23:44 . 2009-10-02 16:11 5972 ----a-w- c:\users\Anne Lise\AppData\Local\d3d9caps.dat
2010-03-16 20:05 . 2010-03-16 20:05 -------- d-----w- c:\program files\Ulead Systems
2010-02-28 16:51 . 2008-08-03 16:35 -------- d-----w- c:\programdata\WildTangent
2010-02-28 16:10 . 2010-02-28 16:10 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\Ludia
2010-02-28 16:10 . 2010-02-28 16:10 -------- d-----w- c:\programdata\Ludia
2010-02-28 16:07 . 2008-08-03 16:35 -------- d-----w- c:\program files\HP Games
2010-02-28 16:00 . 2009-01-27 20:30 1762568 ----a-w- c:\programdata\WildTangent\My HP Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2010-02-26 16:13 . 2010-04-09 23:27 17160 ----a-w- c:\windows\Help\OEM\scripts\HPHCDisableObject.exe
2010-02-24 19:43 . 2010-02-24 19:41 -------- d-----w- c:\program files\De Alfabetiske Lege
2010-02-24 19:43 . 2009-05-17 07:59 -------- d-----w- c:\programdata\IVANOFF
2010-02-24 19:41 . 2008-08-03 16:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-24 17:55 . 2010-02-01 16:23 -------- d-----w- c:\program files\Pixeline
2010-02-24 17:27 . 2010-02-24 17:27 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-02-24 09:16 . 2009-10-04 15:39 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-23 06:39 . 2010-03-31 13:25 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-03-31 13:25 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:33 . 2010-03-31 13:25 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 04:55 . 2010-03-31 13:25 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-22 12:28 . 2010-04-09 23:27 1282824 ----a-w- c:\windows\Help\OEM\scripts\SamsungHDDFW1HC.exe
2010-02-20 23:06 . 2010-03-10 08:42 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:05 . 2010-03-10 08:42 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-10 08:42 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-19 17:17 . 2010-02-19 17:13 -------- d-----w- c:\program files\Silke
2010-02-18 21:43 . 2010-02-18 21:42 -------- d-----w- c:\program files\Garmin
2010-02-18 21:42 . 2010-02-18 21:42 -------- d-----w- c:\programdata\GARMIN
2010-02-18 21:01 . 2010-02-18 09:27 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\Download Manager
2010-02-18 18:27 . 2009-12-29 18:52 -------- d-----w- c:\users\Anne Lise\AppData\Roaming\GARMIN
2010-02-17 08:00 . 2008-08-03 17:11 588472 ----a-w- c:\windows\system32\ezsvc7x.dll
2010-02-04 15:51 . 2010-04-09 23:27 49152 ----a-w- c:\windows\Help\OEM\scripts\Interop.TaskScheduler.dll
2010-01-31 16:44 . 2010-01-31 16:44 23552 ----a-w- c:\users\Anne Lise\xobglu32.dll
2010-01-28 23:16 . 2010-01-28 23:16 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbE4FA.tmp.exe
2010-01-25 12:00 . 2010-02-24 17:35 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:00 . 2010-02-24 17:35 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:00 . 2010-02-24 17:35 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:00 . 2010-02-24 17:35 471552 ----a-w- c:\windows\system32\secproc.dll
2010-01-25 11:58 . 2010-02-24 17:35 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:21 . 2010-02-24 17:35 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:21 . 2010-02-24 17:35 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:21 . 2010-02-24 17:35 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:21 . 2010-02-24 17:35 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-23 09:26 . 2010-02-24 17:36 2048 ----a-w- c:\windows\system32\tzres.dll
2008-08-03 14:36 . 2008-08-03 14:36 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-11 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 145944]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-06-12 468264]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-12 202032]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"KMCONFIG"="c:\program files\Mouse Driver\StartAutorun.exe" [2007-03-06 212992]
"NetSoftware"="c:\program files\NetSoftware\Starter.exe" [2010-03-12 139264]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2009-11-25 104408]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 21:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-30 16:00 77824 ----a-w- c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-11-25 13:42 292824 ----a-w- c:\program files\Registry Mechanic\RMTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-08-11 07:39 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):bf,ed,c6,97,fc,95,ca,01
R2 gupdate;Tjenesten Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 135664]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2010-03-11 366840]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-03-10 217032]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [2010-01-22 112592]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Mouse Driver\KMWDSrv.exe [2008-03-28 208896]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-04-09 632792]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-04-26 361808]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-04 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-02-26 22:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Indhold af mappen 'Planlagte Opgaver'
2010-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 23:25]
2010-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 23:25]
2010-04-10 c:\windows\Tasks\HPCeeScheduleForAnne Lise.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-08-03 22:14]
.
.
------- Yderligere scanning -------
.
uStart Page =
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=83&bd=Presario&pf=cnnbmStart Page =
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=da_dk&c=83&bd=Presario&pf=cnnbIE: &AOL Toolbar-søgning - c:\programdata\AOL\ieToolbar\resources\da-DK\local\search.html
DPF: Garmin Communicator Plug-In -
hxxps://static.garmincdn.com/gcp/ie/2.9.1.0/GarminAxControl.CAB.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-04-18 20:25
Windows 6.0.6002 Service Pack 2 NTFS
scanner skjulte processer ...
scanner skjulte autostarter ...
scanner skjulte filer ...
scanning gennemført med succes
skjulte filer: 0
**************************************************************************
.
--------------------- LÅSTE REGISTRERINGS NØGLER ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Gennemført tid: 2010-04-18 20:30:47
ComboFix-quarantined-files.txt 2010-04-18 18:30
ComboFix2.txt 2010-04-18 16:12
Pre-Kørsel: 150.963.728.384 byte ledig
Post-Kørsel: 151.250.657.280 byte ledig
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 3FC1729C686EA9243DDB86D25BCFBE42