/ Forside/ Teknologi / Internet / Sikkerhed / Spørgsmål
Login
Glemt dit kodeord? 		Brugernavn

Kodeord


Reklame
Top 10 brugere
Sikkerhed
#NavnPoint
1  stl_s 37026
2  arlet 26827
3  miritdk 20260
4  o.v.n. 12167
5  als 8951
6  refi 8694
7  tedd 8272
8  BjarneD 7338
9  Klaudi 7257
10  molokyle 6481
Win32:partriot
Fra : Tonks24 		Vist : 583 gange
50 point
Dato : 24-10-07 14:54
hej

ja jeg har fået den lede virus ind der hedder Win32:partriot og det er gået ud over 2 vigtige filer,jeg bruger avast virus program så jeg vil høre om nogen ved hvordan jeg kan fjerne virussen uden at slette de 2 filer,forløbigt ligger de i virus kisten så den ikke laver mere ballade



 
 
Kommentar
Fra : Angelica

Dato : 24-10-07 15:02
skal lige sige at de ligger på et drev som har alle driverne til personens windows m.m. det er jo det der HP fis hvor de ligger det på maskinen og at man ikk får en feks xp cd med..

Kommentar
Fra : stl_s

Dato : 24-10-07 15:10
Det KAN måske være en fejldetektion fra Avast. Jeg kan se, at den virus lige er blevet tilføjet Avast`s signaturdatabase den 22-10.

Fortæl lige hvad filerne hedder.

Højreklik lige på Avast ikonet ved uret VRDB -> Generer VRDB nu, så du er sikker på, at Avast kender filens struktur, inden du evt skal rense filerne. Det tager lidt tid.

Men fortæl lige filnavnene, inden du renser eller sletter dem.

Kommentar
Fra : Tonks24

Dato : 24-10-07 15:33
hejsa

tror nok de hedder det her A0108580.dll og NAVOptRF.dll ja det skriver den udenfor filnavn så det må være det de hedder...oki jeg er hermed i gang dit råd så den er i fuld gang med at Generer

Kommentar
Fra : stl_s

Dato : 24-10-07 15:50
Den første er muligvis en fil i din systemgendannelse, og den anden er tilsyneladende en Norton fil http://www.softwaretipsandtricks.com/dll/17126-Navoptrfdll.html

Har du haft Norton installeret tidligere ?

Kommentar
Fra : Tonks24

Dato : 24-10-07 15:55
ja det har jeg da alle hp puter har det når man køber pceren,men bryder mig ikke om norton så afstall norton allerede selv samme dag som jeg fik puteren og install så avast som jeg altid har været glad for...og den anden kan godt passe det er en gendannelses fil da begge filer stammer fra drev E hvor alle gendannelses filer og driver ligger

Kommentar
Fra : stl_s

Dato : 24-10-07 16:14
Jeg kan godt forstå, at du foretrækker Avast. Også selv om jeg tror det "overreagerer" her. Filen i systemgendannelsen er mulivis en rest af en tidligere infektion den finder, så hvis du ønsker det, kan vi lave et tjek af din maskine:

1. Hent HijackThis ned til skrivebordet her
http://sptlarsenserious.googlepages.com/HJT-sfx.exe

2. Dobbeltklik på installationsfilen, og følg installationsvejledningen.

3. Dobbeltklik på det nye HijackThis ikon på skrivebordet.

4. På menuen der kommer op, klikker du på Do a systemscan and save a logfile.

5. Efter et kort øjeblik åbner en logfil i notesblok, og den kopierer du ind i det spørgsmål du har oprettet.

6. Hvis du ikke selv vælger at gemme loggen på skrivebordet, bliver den automatisk gemt på destinationen C:/Programmer/hijackthis.log hvor du senere kan finde den.

7. Hent derefter Rootchk ned til skrivebordet her http://www.uploads.ejvindh.net/rootchk.exe

Dobbeltklik på filen. Efter kort tid vil der dukke en logfil op, som efterfølgende kan findes her C:\rootlog txt. Kopier indholdet af denne log ind i tråden, i forlængelse af HijackThis loggen.


Kom også med en log fra ComboFix:

Hent Combofix, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Kør så combofix.exe, og følg vejledningen i vinduet.

Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt som kan findes her-C:\combofix.txt

Kopier loggen her ind.



Kommentar
Fra : Tonks24

Dato : 24-10-07 16:34
r\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ulead Photo Express Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express My Scrapbook 2.0\calcheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.click4foto.dk/aurigma/ImageUploader4.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9849 bytes


********************************* ROOTCHK-(21-09-07)-LOG, by ejvindh
24-10-2007 16:27:06,75

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-24 16:27:07
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden services: 0
hidden files: 0



ComboFix 07-10-23.1 - HP_Administrator 2007-10-24 16:30:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1398 [GMT 2:00]
Running from: C:\Documents and Settings\HP_Administrator\My Documents\avast\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com\played_list.sol
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 )))))))))))))))))))))))))))))))
.

2007-10-24 16:29   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-10-24 16:26   <DIR>   d--------   C:\Program Files\min puter
2007-10-24 16:24   401,720   --a------   C:\Program Files\HJTrenamed.exe
2007-10-21 10:25   801,144   --a------   C:\WINDOWS\system32\aswBoot.exe
2007-10-21 10:25   95,608   --a------   C:\WINDOWS\system32\AvastSS.scr
2007-10-21 10:25   94,416   --a------   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-21 10:25   92,848   --a------   C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-21 10:25   42,912   --a------   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-21 10:25   26,624   --a------   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-21 10:25   23,152   --a------   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-21 05:57   <DIR>   d--------   C:\WINDOWS\system32\3Planesoft
2007-10-21 05:57   <DIR>   d--------   C:\Program Files\UltraISO
2007-10-21 05:57   <DIR>   d--------   C:\Program Files\Common Files\EZB Systems
2007-10-21 05:53   <DIR>   d--------   C:\Program Files\DIFX
2007-10-21 05:53   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2007-10-21 05:52   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\InstallShield
2007-10-21 05:50   <DIR>   d--------   C:\Program Files\Common Files\Jasc Software Inc
2007-10-21 05:50   <DIR>   d--------   C:\Program Files\Alien Skin
2007-10-21 05:49   <DIR>   d--------   C:\Drivers
2007-10-21 05:49   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\dvdcss
2007-10-21 05:49   <DIR>   dr-------   C:\Documents and Settings\HP_Administrator\Application Data\Brother
2007-10-21 05:48   <DIR>   d--------   C:\Program Files\Common Files\Skype
2007-10-21 05:48   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Jasc
2007-10-21 05:47   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\CyberLink
2007-10-21 05:21   <DIR>   d--------   C:\WINDOWS\Gigantlaan ScreenSaver dir
2007-10-21 05:21   <DIR>   d--------   C:\Program Files\Ulead Systems
2007-10-21 05:21   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2007-10-21 05:21   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Ulead Systems
2007-10-15 21:35   <DIR>   d--------   C:\Program Files\World of Warcraft
2007-10-15 21:01   <DIR>   d--------   C:\Program Files\Winamp
2007-10-15 20:06   <DIR>   d--------   C:\WINDOWS\LastGood(2)
2007-10-11 20:39   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2007-10-11 20:13   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Nokia
2007-10-11 20:12   90,624   --a------   C:\WINDOWS\system32\nmwcdcls.dll
2007-10-10 22:01   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\.LAViewer
2007-10-08 03:07   129,784   ---------   C:\WINDOWS\system32\pxafs.dll
2007-10-07 15:25   <DIR>   d--------   C:\Program Files\Corel
2007-10-07 15:25   <DIR>   d--------   C:\Program Files\Common Files\Corel
2007-10-07 15:09   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Corel
2007-10-07 15:09   6,580   --ahs----   C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-07 15:09   168   -r-hs----   C:\WINDOWS\system32\C087F140B7.sys
2007-10-07 14:16   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Jasc Software Inc
2007-10-07 00:06   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Alien Skin
2007-10-06 16:28   1,048,576   ---------   C:\WINDOWS\system32\ROBOEX32.DLL
2007-10-06 16:28   114,688   ---------   C:\WINDOWS\UPSCR.Scr
2007-10-06 16:28   114,688   ---------   C:\WINDOWS\system32\UPSCR.Scr
2007-10-06 16:28   48,640   ---------   C:\WINDOWS\system32\INETWH32.DLL
2007-10-06 16:28   40,960   --a------   C:\WINDOWS\system32\Ulead Photo Express ScreenSaver.scr
2007-10-03 01:08   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2007-10-02 17:44   796,672   --a------   C:\WINDOWS\GPInstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-24 14:25   9,850   ----a-w   C:\Program Files\hijackthis.log
2007-10-24 13:51   ---------   d-----w   C:\Documents and Settings\HP_Administrator\Application Data\Skype
2007-10-24 12:10   ---------   d-----w   C:\Program Files\Common Files\Wise Installation Wizard
2007-10-24 12:09   ---------   d-----w   C:\Program Files\IncrediMail
2007-10-21 04:01   ---------   d-----w   C:\Program Files\Java
2007-10-21 03:53   ---------   d-----w   C:\Program Files\PC Connectivity Solution
2007-10-21 03:53   ---------   d-----w   C:\Program Files\Nokia
2007-10-21 03:48   ---------   d-----w   C:\Program Files\Skype
2007-10-21 03:48   ---------   d-----w   C:\Program Files\ColorCop
2007-10-21 03:47   ---------   d-----w   C:\Program Files\TEXTware
2007-10-21 03:21   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-21 03:20   ---------   d-----w   C:\Program Files\GemMaster
2007-10-21 00:15   ---------   d-----w   C:\Program Files\Common Files\Blizzard Entertainment
2007-10-15 18:02   ---------   d-----w   C:\Program Files\Common Files\Ahead
2007-10-07 13:49   ---------   d-----w   C:\Program Files\Jasc Software Inc
2007-09-29 22:35   48,920   ----a-w   C:\Documents and Settings\HP_Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-09-07 10:07   ---------   d-----w   C:\Documents and Settings\HP_Administrator\Application Data\Sony Corporation
2007-09-07 09:58   ---------   d-----w   C:\Program Files\Sony
2007-09-06 10:00   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-22 12:55   96,256   ------w   C:\WINDOWS\system32\dllcache\inseng.dll
2007-08-22 12:55   665,600   ------w   C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-22 12:55   617,984   ------w   C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-22 12:55   55,808   ------w   C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-22 12:55   532,480   ------w   C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-22 12:55   474,112   ------w   C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-08-22 12:55   449,024   ------w   C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-22 12:55   39,424   ------w   C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-08-22 12:55   357,888   ------w   C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-08-22 12:55   3,064,832   ------w   C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-22 12:55   251,904   ------w   C:\WINDOWS\system32\dllcache\iepeers.dll
2007-08-22 12:55   205,824   ------w   C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-22 12:55   16,384   ------w   C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-22 12:55   151,040   ------w   C:\WINDOWS\system32\dllcache\cdfview.dll
2007-08-22 12:55   146,432   ------w   C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-22 12:55   1,498,112   ------w   C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-08-22 12:55   1,054,208   ------w   C:\WINDOWS\system32\dllcache\danim.dll
2007-08-22 12:55   1,022,976   ------w   C:\WINDOWS\system32\dllcache\browseui.dll
2007-08-22 05:55   2,759,438   ----a-w   C:\WINDOWS\Sim AQUARIUM 2.scr
2007-08-21 10:19   18,432   ------w   C:\WINDOWS\system32\dllcache\iedw.exe
2007-08-21 06:15   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15   683,520   ------w   C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-17 10:00   626,688   ----a-w   C:\WINDOWS\system32\msvcr80.dll
2007-08-17 10:00   548,864   ----a-w   C:\WINDOWS\system32\msvcp80.dll
2007-08-17 10:00   1,101,824   ----a-w   C:\WINDOWS\system32\mfc80.dll
2007-07-30 17:19   92,504   ----a-w   C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 17:19   92,504   ----a-w   C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19   549,720   ----a-w   C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19   549,720   ----a-w   C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 17:19   53,080   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19   53,080   ----a-w   C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 17:19   43,352   ----a-w   C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19   43,352   ----a-w   C:\WINDOWS\system32\wups2(2)(2)(2).dll
2007-07-30 17:19   325,976   ----a-w   C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19   325,976   ----a-w   C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 17:19   203,096   ----a-w   C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19   203,096   ----a-w   C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 17:19   1,712,984   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:19   1,712,984   ----a-w   C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\wups.dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\wups(2)(2)(2).dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\dllcache\wups.dll
2006-02-19 02:28   12,288   ----a-w   C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 16:34]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-20 06:05]
"nwiz"="nwiz.exe" [2007-04-20 06:05 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-20 06:05]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-02 14:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"Ulead Photo Express Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express My Scrapbook 2.0\calcheck.exe" [2003-09-19 20:23]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-16 12:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 19:43]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-08-15 17:42]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"IETI"=C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-09-07 11:58:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
ARPWRMSG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
"c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ftutil2]
rundll32.exe ftutil2.dll,SetWriteCacheMode

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCDMon]
"C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LGDCore]
"C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /installquiet /keeploaded /nodetect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
"C:\Windows\Creator\Remind_XP.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=0 (0x0)
"NVSvc"=2 (0x2)
"LightScribeService"=2 (0x2)
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

R1 ISODrive;ISO DVD/CD-ROM Device Driver;\??\C:\Program Files\UltraISO\drivers\ISODrive.sys
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5e041af-4166-11db-9cd6-806d6172696f}]
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4853bfe-2021-11dc-9ea3-0016ecc79928}]
AutoRun\command - L:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-10-18 20:40:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-24 16:36:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-24 16:36:59
.
   --- E O F ---



Kommentar
Fra : Tonks24

Dato : 24-10-07 16:46
der mangler vist noget i alt det jeg pastede så paster dem lige hver for sig

Kommentar
Fra : Tonks24

Dato : 24-10-07 16:47
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:47, on 24-10-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HJTrenamed.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ulead Photo Express Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express My Scrapbook 2.0\calcheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.click4foto.dk/aurigma/ImageUploader4.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9849 bytes

Kommentar
Fra : Tonks24

Dato : 24-10-07 16:48
********************************* ROOTCHK-(21-09-07)-LOG, by ejvindh
24-10-2007 16:27:06,75

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-24 16:27:07
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden services: 0
hidden files: 0

Kommentar
Fra : Tonks24

Dato : 24-10-07 16:50
ComboFix 07-10-23.1 - HP_Administrator 2007-10-24 16:30:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1398 [GMT 2:00]
Running from: C:\Documents and Settings\HP_Administrator\My Documents\avast\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com\played_list.sol
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\#SharedObjects\DFRM53DE\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\HP_Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 )))))))))))))))))))))))))))))))
.

2007-10-24 16:29   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-10-24 16:26   <DIR>   d--------   C:\Program Files\min puter
2007-10-24 16:24   401,720   --a------   C:\Program Files\HJTrenamed.exe
2007-10-21 10:25   801,144   --a------   C:\WINDOWS\system32\aswBoot.exe
2007-10-21 10:25   95,608   --a------   C:\WINDOWS\system32\AvastSS.scr
2007-10-21 10:25   94,416   --a------   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-21 10:25   92,848   --a------   C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-21 10:25   42,912   --a------   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-21 10:25   26,624   --a------   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-21 10:25   23,152   --a------   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-21 05:57   <DIR>   d--------   C:\WINDOWS\system32\3Planesoft
2007-10-21 05:57   <DIR>   d--------   C:\Program Files\UltraISO
2007-10-21 05:57   <DIR>   d--------   C:\Program Files\Common Files\EZB Systems
2007-10-21 05:53   <DIR>   d--------   C:\Program Files\DIFX
2007-10-21 05:53   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2007-10-21 05:52   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\InstallShield
2007-10-21 05:50   <DIR>   d--------   C:\Program Files\Common Files\Jasc Software Inc
2007-10-21 05:50   <DIR>   d--------   C:\Program Files\Alien Skin
2007-10-21 05:49   <DIR>   d--------   C:\Drivers
2007-10-21 05:49   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\dvdcss
2007-10-21 05:49   <DIR>   dr-------   C:\Documents and Settings\HP_Administrator\Application Data\Brother
2007-10-21 05:48   <DIR>   d--------   C:\Program Files\Common Files\Skype
2007-10-21 05:48   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Jasc
2007-10-21 05:47   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\CyberLink
2007-10-21 05:21   <DIR>   d--------   C:\WINDOWS\Gigantlaan ScreenSaver dir
2007-10-21 05:21   <DIR>   d--------   C:\Program Files\Ulead Systems
2007-10-21 05:21   <DIR>   d--------   C:\Program Files\Common Files\Ulead Systems
2007-10-21 05:21   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Ulead Systems
2007-10-15 21:35   <DIR>   d--------   C:\Program Files\World of Warcraft
2007-10-15 21:01   <DIR>   d--------   C:\Program Files\Winamp
2007-10-15 20:06   <DIR>   d--------   C:\WINDOWS\LastGood(2)
2007-10-11 20:39   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2007-10-11 20:13   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Nokia
2007-10-11 20:12   90,624   --a------   C:\WINDOWS\system32\nmwcdcls.dll
2007-10-10 22:01   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\.LAViewer
2007-10-08 03:07   129,784   ---------   C:\WINDOWS\system32\pxafs.dll
2007-10-07 15:25   <DIR>   d--------   C:\Program Files\Corel
2007-10-07 15:25   <DIR>   d--------   C:\Program Files\Common Files\Corel
2007-10-07 15:09   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Corel
2007-10-07 15:09   6,580   --ahs----   C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-07 15:09   168   -r-hs----   C:\WINDOWS\system32\C087F140B7.sys
2007-10-07 14:16   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Jasc Software Inc
2007-10-07 00:06   <DIR>   d--------   C:\Documents and Settings\HP_Administrator\Application Data\Alien Skin
2007-10-06 16:28   1,048,576   ---------   C:\WINDOWS\system32\ROBOEX32.DLL
2007-10-06 16:28   114,688   ---------   C:\WINDOWS\UPSCR.Scr
2007-10-06 16:28   114,688   ---------   C:\WINDOWS\system32\UPSCR.Scr
2007-10-06 16:28   48,640   ---------   C:\WINDOWS\system32\INETWH32.DLL
2007-10-06 16:28   40,960   --a------   C:\WINDOWS\system32\Ulead Photo Express ScreenSaver.scr
2007-10-03 01:08   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2007-10-02 17:44   796,672   --a------   C:\WINDOWS\GPInstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-24 14:25   9,850   ----a-w   C:\Program Files\hijackthis.log
2007-10-24 13:51   ---------   d-----w   C:\Documents and Settings\HP_Administrator\Application Data\Skype
2007-10-24 12:10   ---------   d-----w   C:\Program Files\Common Files\Wise Installation Wizard
2007-10-24 12:09   ---------   d-----w   C:\Program Files\IncrediMail
2007-10-21 04:01   ---------   d-----w   C:\Program Files\Java
2007-10-21 03:53   ---------   d-----w   C:\Program Files\PC Connectivity Solution
2007-10-21 03:53   ---------   d-----w   C:\Program Files\Nokia
2007-10-21 03:48   ---------   d-----w   C:\Program Files\Skype
2007-10-21 03:48   ---------   d-----w   C:\Program Files\ColorCop
2007-10-21 03:47   ---------   d-----w   C:\Program Files\TEXTware
2007-10-21 03:21   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-10-21 03:20   ---------   d-----w   C:\Program Files\GemMaster
2007-10-21 00:15   ---------   d-----w   C:\Program Files\Common Files\Blizzard Entertainment
2007-10-15 18:02   ---------   d-----w   C:\Program Files\Common Files\Ahead
2007-10-07 13:49   ---------   d-----w   C:\Program Files\Jasc Software Inc
2007-09-29 22:35   48,920   ----a-w   C:\Documents and Settings\HP_Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-09-07 10:07   ---------   d-----w   C:\Documents and Settings\HP_Administrator\Application Data\Sony Corporation
2007-09-07 09:58   ---------   d-----w   C:\Program Files\Sony
2007-09-06 10:00   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-22 12:55   96,256   ------w   C:\WINDOWS\system32\dllcache\inseng.dll
2007-08-22 12:55   665,600   ------w   C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-22 12:55   617,984   ------w   C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-22 12:55   55,808   ------w   C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-22 12:55   532,480   ------w   C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-22 12:55   474,112   ------w   C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-08-22 12:55   449,024   ------w   C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-22 12:55   39,424   ------w   C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-08-22 12:55   357,888   ------w   C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-08-22 12:55   3,064,832   ------w   C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-22 12:55   251,904   ------w   C:\WINDOWS\system32\dllcache\iepeers.dll
2007-08-22 12:55   205,824   ------w   C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-22 12:55   16,384   ------w   C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-22 12:55   151,040   ------w   C:\WINDOWS\system32\dllcache\cdfview.dll
2007-08-22 12:55   146,432   ------w   C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-22 12:55   1,498,112   ------w   C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-08-22 12:55   1,054,208   ------w   C:\WINDOWS\system32\dllcache\danim.dll
2007-08-22 12:55   1,022,976   ------w   C:\WINDOWS\system32\dllcache\browseui.dll
2007-08-22 05:55   2,759,438   ----a-w   C:\WINDOWS\Sim AQUARIUM 2.scr
2007-08-21 10:19   18,432   ------w   C:\WINDOWS\system32\dllcache\iedw.exe
2007-08-21 06:15   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15   683,520   ------w   C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-17 10:00   626,688   ----a-w   C:\WINDOWS\system32\msvcr80.dll
2007-08-17 10:00   548,864   ----a-w   C:\WINDOWS\system32\msvcp80.dll
2007-08-17 10:00   1,101,824   ----a-w   C:\WINDOWS\system32\mfc80.dll
2007-07-30 17:19   92,504   ----a-w   C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 17:19   92,504   ----a-w   C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19   549,720   ----a-w   C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19   549,720   ----a-w   C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 17:19   53,080   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19   53,080   ----a-w   C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 17:19   43,352   ----a-w   C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19   43,352   ----a-w   C:\WINDOWS\system32\wups2(2)(2)(2).dll
2007-07-30 17:19   325,976   ----a-w   C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19   325,976   ----a-w   C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 17:19   203,096   ----a-w   C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19   203,096   ----a-w   C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 17:19   1,712,984   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:19   1,712,984   ----a-w   C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\wups.dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\wups(2)(2)(2).dll
2007-07-30 17:18   33,624   ----a-w   C:\WINDOWS\system32\dllcache\wups.dll
2006-02-19 02:28   12,288   ----a-w   C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 16:34]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-20 06:05]
"nwiz"="nwiz.exe" [2007-04-20 06:05 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-20 06:05]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-02 14:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"Ulead Photo Express Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express My Scrapbook 2.0\calcheck.exe" [2003-09-19 20:23]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 C:\WINDOWS\KHALMNPR.Exe]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-16 12:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 19:43]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-08-15 17:42]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"IETI"=C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-09-07 11:58:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
ARPWRMSG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
"c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ftutil2]
rundll32.exe ftutil2.dll,SetWriteCacheMode

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCDMon]
"C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LGDCore]
"C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /installquiet /keeploaded /nodetect

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
"C:\Windows\Creator\Remind_XP.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=0 (0x0)
"NVSvc"=2 (0x2)
"LightScribeService"=2 (0x2)
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

R1 ISODrive;ISO DVD/CD-ROM Device Driver;\??\C:\Program Files\UltraISO\drivers\ISODrive.sys
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5e041af-4166-11db-9cd6-806d6172696f}]
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4853bfe-2021-11dc-9ea3-0016ecc79928}]
AutoRun\command - L:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-10-18 20:40:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-24 16:36:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-24 16:36:59
.
   --- E O F ---


Kommentar
Fra : Tonks24

Dato : 24-10-07 16:52
så ser det mere rigtigt ud,der var åbenbart ikke plads nok til det hele i et indlæg

Accepteret svar
Fra : stl_s
Modtaget 50 point
Dato : 24-10-07 17:34
Combofix slettede lidt "småtterier", ellers ingen problemer.

Dog behøver dine søgninger ikke at gå igennem HP, så du kan gøre dette:

Kør HijackThis (Do a systemscan only), og maksimer vinduet. Luk alle andre vinduer. Sæt et flueben ved disse linier, og klik FIX CHECKED:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

Bemærk, at denne som ligger inde midt i det hele, i HJT loggen, skal du [U]IKKE[/U] fixe. Det er din startside:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/

----------------------------------------------------------------------------

De filer der ligger i Avast`s kiste, kan du lade Avast slette, og så kan det være en god ide, at tjekke for rester af Norton:

Gå her ind og følg vejledningen http://service1.symantec.com/support/inter/tsgeninfointl.nsf/dk_docid/20050411155241924

Når du er færdig med proceduren, så gå i Start/Søg og kopier denne linie ind norton;symantec og start søgningen. Slet alle de mapper søgningen finder.

Slut gerne af med trin 5 og 6 her http://www.malwarecheck.dk/forum/viewtopic.php?t=11

Så skulle det være i orden.




Kommentar
Fra : Tonks24

Dato : 24-10-07 18:00
hmm kan ikke rigtig finde den der hedder

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DA_DK&c=63&bd=PAVILION&pf=desktop

de andre er fundet og sat flueben i men den sidste kan jeg ikke finde

Kommentar
Fra : Tonks24

Dato : 24-10-07 18:03
men kan da godt se den er med i den første scanning men det er da sjovt den ikke er der nu

Kommentar
Fra : stl_s

Dato : 24-10-07 18:13
Bare fix de andre, genstart maskinen, og kom så lige med en frisk HJT bagefter, så ser vi om den er væk.

Kommentar
Fra : Tonks24

Dato : 24-10-07 18:28
så er det hele gjort som du skrev og makinen er genstartet

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:33:38, on 24-10-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HJTrenamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ulead Photo Express Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express My Scrapbook 2.0\calcheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilslutningshjælp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.click4foto.dk/aurigma/ImageUploader4.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8448 bytes


Kommentar
Fra : stl_s

Dato : 24-10-07 18:32
Det ser fint ud. Skulle den linie dukke op igen, kan du bare fixe den. Kører det hele som det skal ?

Kommentar
Fra : Tonks24

Dato : 24-10-07 18:43
alså end til nu ser det hele fint ud,skal bare lige scanne E igennem igen men der burde ikke være noget for de 2 filer er jo væk,så nu kan jeg forhåblig lave de gendannelse cder for bliver nok nød til at formatere min puter da der ligger nogle programmer inden i tilføj/fjern som jeg ikke kan slette og så havde min puter problemmer med at starte op forleden dag,den nåde lige til windows opstart alså der hvor man ser den der loader,så genstartede puteren og sådan blev den ved...nu starter den dog op men er utrolig langsom om det,hvad den ikke plejer at være for puteren er kun 1år gammel så alderdom er det næppe hehe...men siger tak for hjælpen af at redde mine filer osv og nu er norton helt væk fra puteren så den ikke laver ballade,nu skal jeg bare gøre det samme på min gamles puter da hendes osse er en HP med gammel norton filer liggende


Godkendelse af svar
Fra : Tonks24

Dato : 24-10-07 18:53
Tak for svaret stl_s.

Du har følgende muligheder
Eftersom du ikke er logget ind i systemet, kan du ikke skrive et indlæg til dette spørgsmål.

Hvis du ikke allerede er registreret, kan du gratis blive medlem, ved at trykke på "Bliv medlem" ude i menuen.
Søg
Reklame
Statistik
Spørgsmål : 177429
Tips : 31962
Nyheder : 719565
Indlæg : 6407948
Brugere : 218878
Månedens bedste
Årets bedste
Sidste års bedste
Copyright © 2000-2024 kandu.dk. Alle rettigheder forbeholdes.