|
|
#11
16 september 2008, 15:28
|
|||
|
|||
Brug for hjælp med mystiske desktop "bar"
ComboFix 08-09-15.02 - Tom Stratman 2008-09-16 16:53:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.184 [GMT -5:00] Running from: C: \ Documents and Settings \ Tom Stratman \ Desktop \ ComboFix.exe * Skabt et nyt gendannelsespunkt ADVARSEL-maskinen IKKE HAR RECOVERY CONSOLE INSTALLERET!! . ((((((((((((((((((((((((((((((((((((((( Andre Bortfald ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ Documents and Settings \ Tom Stratman \ Application Data \ FNTS ~ 1 C: \ Documents and Settings \ Tom Stratman \ Application Data \ FNTS ~ 1 \ F? Er \ C: \ Documents and Settings \ Tom Stratman \ Application Data \ SSTEM ~ 1 C: \ Temp \ 1cb C: \ Temp \ 1cb \ syscheck.log C: \ Temp \ FSE C: \ Temp \ FSE \ tmpZTF.log C: \ test.txt C: \ WINDOWS \ system32 \ MSINET.oca C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak1 C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak2 C: \ WINDOWS \ SYSTEM32 \ rqtwa.ini C: \ WINDOWS \ system32 \ wnstsiit32.exe C: \ WINDOWS \ SYSTEM32 \ wyadd.bak1 C: \ WINDOWS \ SYSTEM32 \ wyadd.bak2 C: \ WINDOWS \ SYSTEM32 \ wyadd.ini C: \ WINDOWS \ SYSTEM32 \ wyadd.ini2 C: \ WINDOWS \ SYSTEM32 \ wyadd.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers / Services )))))))) ))))))))))))))))))))))))))))))))))))))))) . ------- \ Legacy_DOMAINSERVICE ((((((((((((((((((((((((( Files Created fra 2008-08-16 til 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 06:36. 2008-09-16 06:36 <DIR> d -------- C: \ Programmer \ Trend Micro 2008-09-15 21:25. 2008-09-15 21:27 <DIR> d -------- C: \ Programmer \ Malwarebytes 'Anti-Malware 2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ Tom Stratman \ Application Data \ Malwarebytes 2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes 2008-09-15 21:25. 2008-09-10 00:04 38.528 - a ------ C: \ WINDOWS \ SYSTEM32 \ DRIVERS \ mbamswissarmy.sys 2008-09-15 21:25. 2008-09-10 00:03 17.200 - a ------ C: \ WINDOWS \ SYSTEM32 \ DRIVERS \ mbam.sys 2008-09-14 11:13. 2008-09-14 11:13 107.888 - a ------ C: \ WINDOWS \ SYSTEM32 \ CmdLineExt.dll 2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Programmer \ iTunes 2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ (3276BE95_AF08_429F_A64F_CA64CB79BCF6) 2008-09-10 13:35. 2008-09-10 13:35 <DIR> d -------- C: \ Programmer \ Bonjour 2008-09-10 13:29. 2008-09-05 22:16 1.900.544 - a ------ C: \ WINDOWS \ SYSTEM32 \ usbaaplrc.dll 2008-09-06 15:09. 2008-09-06 15:09 90.112 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57.344 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTime.qts 2008-08-29 10:18. 2008-08-29 10:18 87.336 - a ------ C: \ WINDOWS \ SYSTEM32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61.440 - a ------ C: \ WINDOWS \ SYSTEM32 \ dnssd.dll 2008-08-27 02:30. 2008-08-27 02:56 <DIR> d -------- C: \ WINDOWS \ SYSTEM32 \ CatRoot_bak 2008-08-25 19:08. 2008-08-25 19:08 <DIR> d -------- C: \ Programmer \ AviSynth 2,5 2008-08-25 19:07. 2008-08-25 19:07 <DIR> d -------- C: \ Programmer \ Red Kawa . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 21:40 --------- d ----- w C: \ Documents and Settings \ Tom Stratman \ Application Data \ uTorrent 2008-09-16 06:42 --------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Google Updater 2008-09-15 20:53 --------- d - h - w C: \ Programmer \ InstallShield Installation Information 2008-09-15 20:53 --------- d ----- w C: \ Programmer \ Electronic Arts 2008-09-10 18:38 --------- d ----- w C: \ Programmer \ iPod 2008-09-10 18:34 --------- d ----- w C: \ Programmer \ QuickTime 2008-09-10 18:33 --------- d ----- w C: \ Programmer \ Common Files \ Apple 2008-09-06 03:16 36.864 ---- aw C: \ WINDOWS \ system32 \ drivers \ usbaapl.sys 2008-08-21 21:36 --------- d ----- w C: \ Programmer \ Apple Software Update 2008-08-11 21:22 --------- d ----- w C: \ Programmer \ Microsoft Silverlight 2008-08-07 16:37 --------- d ----- w C: \ Programmer \ Google 2008-03-01 20:28 75.496-c - aw C: \ Documents and Settings \ Tom Stratman \ Application Data \ GDIPFONTCACHEV1.DAT 2007-09-26 01:26 45.422-c - aw C: \ Documents and Settings \ Tom Stratman \ Application Data \ wklnhst.dat 2007-06-28 21:37 7.248-c - aw C: \ Documents and Settings \ All Users \ Application Data \ ypinfo.bin 2007-04-15 04:54 32-c - ar C: \ Documents and Settings \ All Users \ hash.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Note * empty entries & legit default entries er ikke vist REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "DellSupport" = "C: \ Programmer \ DellSupport \ DSAgnt.exe" [2007-03-15 460784] "LDM" = "C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Programmer \ LogitechDesktopMessenger. Exe" [2007-02-23 67128] "MSMSGS" = "C: \ Programmer \ Messenger \ msmsgs.exe" [2004-10-13 1694208] "DellSupportCenter" = "C: \ Programmer \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "QuickTime Task" = "C: \ Programmer \ Dell \ Media Experience \ PCMService.exe" [2004-04-11 290816] "DVDLauncher" = "C: \ Programmer \ CyberLink \ PowerDVD \ DVDLauncher.exe" [2004-08-23 57344] "dla" = "C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe" [2004-08-13 122939] "Apoint" = "C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup" [2005-09-20 94208] "igfxhkcmd" = "C: \ WINDOWS \ system32 \ NeroCheck.exe" [2005-09-20 77824] "igfxpers" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2005-09-20 114688] "CanonMyPrinter" = "C: \ Programmer \ Canon \ MyPrinter \ BJMyPrt.exe" [2006-03-21 1191936] "SSBkgdUpdate" = "C: \ Programmer \ Common Files \ Scansoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe" [2003-09-30 155648] "OpwareSE4" = "C: \ Programmer \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" [2006-03-21 69632] "IMJPMIG8.1" = "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.E XE" [2004-08-04 208952] "MSPY2002" = "C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScI nst.exe" [2004-08-04 59392] "PHIME2002ASync" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TIN TSETP.EXE" [2004-08-04 455168] "SoundMAXPnP" = "C: \ Programmer \ Analog Devices \ Core \ smax4pnp.exe" [2004-10-14 1404928] "Adobe Reader Speed Launcher" = "C: \ Programmer \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" [2008-01-11 39792] "dscactivate" = "C: \ Programmer \ Dell Support Center \ gs_agent \ custom \ dsca.exe" [2007-11-15 16384] "DellSupportCenter" = "C: \ Programmer \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] "QuickTime Task" = "C: \ Programmer \ QuickTime \ QTTask.exe" [2008-09-06 413696] "AppleSyncNotifier" = "C: \ Programmer \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe" [2008-09-03 111936] "CTFMON.EXE" = "C: \ Programmer \ iTunes \ iTunesHelper.exe" [2008-09-08 289576] "Logitech Hardware Abstraction Layer" = "KHALMNPR.EXE" [2008/02/29 C: \ WINDOWS \ KHALMNPR.Exe] "Kernel og Hardware Abstraction Layer" = "KHALMNPR.EXE" [2008/02/29 C: \ WINDOWS \ KHALMNPR.Exe] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "DWQueuedReporting" = "C: \ PROGRA ~ 1 \ FÆLLES ~ 1 \ mikroer ~ 1 \ DW \ dwtrig20.exe" [2007-03-13 39264] C: \ Documents and Settings \ Tom Stratman \ Menuen Start \ Programmer \ Start \ SpywareGuard.lnk - C: \ Programmer \ SpywareGuard \ sgmain.exe [2003-08-29 360448] C: \ Documents and Settings \ All Users \ Menuen Start \ Programmer \ Start \ Logitech Desktop Messenger.lnk - C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Programmer \ LogitechDesktopMessenger. Exe [2007-02-23 67128] Logitech SetPoint.lnk - C: \ Programmer \ Logitech \ SetPoint \ SetPoint.exe [2008-08-09 805392] Microsoft Office.lnk - C: \ Programmer \ Microsoft Office \ Office10 \ OSA.EXE [2001-02-13 83360] WinZip Quick Pick.lnk - C: \ Programmer \ WinZip \ WZQKPICK.EXE [2005-02-11 118784] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ anmelde \ LBTWlgn] 2008-05-02 02:42 72208 C: \ Programmer \ Common Files \ Logitech \ Bluetooth \ LBTWLgn.dll [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ SafeBoot \ Minimal \ WdfLoadGroup] @ = "" [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "C: \ \ Programmer \ \ Windows Media Player \ \ wmplayer.exe" = "C: \ \ Programmer \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "C: \ \ Programmer \ \ PopCap Games \ \ Bookworm Deluxe \ \ BookWorm.exe" = "C: \ \ Programmer \ \ AIM \ \ aim.exe" = "C: \ \ Programmer \ \ AIM6 \ \ aim6.exe" = "C: \ \ Programmer \ \ Logitech \ \ Desktop Messenger \ \ 8876480 \ \ Programmer \ \ LogitechDesktopMessen ger.exe" = "C: \ \ Programmer \ \ uTorrent \ \ uTorrent.exe" = "C: \ \ Programmer \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ \ Programmer \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "17770: TCP" = 17770: TCP: BitComet 17770 TCP "17770: UDP" = 17770: UDP: BitComet 17770 UDP R1 aswSP; avast! Self Protection; C: \ Windows \ System32 \ Drivers \ aswSP.sys [2008-07-19 78416] R2 aswFsBlk; aswFsBlk; C: \ Windows \ System32 \ Drivers \ aswF sBlk.sys [2008-07-19 20560] R2 npkcmsvc; npkcmsvc C: \ Nexon \ Mabinogi \ npkcmsvc.exe [2007-08-02 80528] R2 synspunkt Manager Service; synspunkt Manager Service; C: \ Programmer \ synspunkt \ Common \ ViewpointService.exe [2007-01-04 24652] S2 DP1112; DP1112; C: \ WINDOWS \ system32 \ Drivers \ DP.sys [] S3 FTD2XX; Outlaw Audio Model 990 Device Driver; C: \ WINDOWS \ system32 \ Drivers \ FTD2XX.sys [2003-01-24 24197] S3 XDva020; XDva020 C: \ WINDOWS \ system32 \ XDva020.sys [] . Indhold af "Planlagte opgaver" mappe . - - - - Forældreløse FJERNES - - - -- HKCU-Run-updateMgr - C: \ Programmer \ Adobe \ Acrobat 7.0 \ Reader \ AdobeUpdateManager.exe HKCU-Run-Aim6 - (no file) . ------- Supplerende Scan ------- . FireFox -: Profile - C: \ Documents and Settings \ Tom Stratman \ Application Data \ Mozilla \ Firefox \ Profiles \ e41ez35c.default \ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp: / / dsl.sbc.yahoo.com / . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detector ved Gmer, http://www.gmer.net Rootkit scan 2008-09-16 17:01:58 Windows 5.1.2600 Service Pack 2 NTFS scanning skjulte processer ... scanning skjulte autostart entries ... scanning skjulte filer ... scanning afsluttet med succes skjulte filer: 0 ************************************************** ************************ . ------------------------ Other Running Processes ----------------------- -- . C: \ Programmer \ Windows Defender \ MsMpEng.exe C: \ Programmer \ Alwil Software \ Avast4 \ aswUpdSv.exe C: \ Programmer \ Alwil Software \ Avast4 \ ashServ.exe C: \ Programmer \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Programmer \ Bonjour \ mDNSResponder.exe C: \ Programmer \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Programmer \ Dell Support Center \ bin \ sprtsvc.exe C: \ PROGRA ~ 1 \ WinZip \ WZQKPICK.EXE C: \ Programmer \ Alwil Software \ Avast4 \ ashMaiSv.exe C: \ Programmer \ Alwil Software \ Avast4 \ ashWebSv.exe C: \ Programmer \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.exe C: \ Programmer \ iPod \ bin \ iPodService.exe . ************************************************** ************************ . Completion time: 2008-09-16 17:13:41 - maskinen blev genstartet ComboFix-quarantined-files.txt 2008-09-16 22:13:22 Pre-Run: 263.151.616 bytes free Post-Run: 674.275.328 bytes free 180 --- EOF --- 2008-09-16 11:27:11 ============= SLUT COMBO FOX ================================== Logfile af Trend Micro HijackThis v2.0.2 Scan gemt på 5:26:48, den 9/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Kørende processer: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ Programmer \ Windows Defender \ MsMpEng.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Programmer \ Alwil Software \ Avast4 \ aswUpdSv.exe C: \ Programmer \ Alwil Software \ Avast4 \ ashServ.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ Programmer \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Programmer \ Bonjour \ mDNSResponder.exe C: \ Programmer \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Nexon \ Mabinogi \ npkcmsvc.exe C: \ Programmer \ Dell \ Media Experience \ PCMService.exe C: \ Programmer \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ WINDOWS \ system32 \ hkcmd.exe C: \ WINDOWS \ system32 \ igfxpers.exe C: \ Programmer \ Canon \ MyPrinter \ BJMyPrt.exe C: \ Programmer \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe C: \ Programmer \ Dell Support Center \ bin \ sprtsvc.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ Programmer \ Analog Devices \ Core \ smax4pnp.exe C: \ Programmer \ synspunkt \ Common \ ViewpointService.exe C: \ Programmer \ Dell Support Center \ bin \ sprtcmd.exe C: \ Programmer \ QuickTime \ QTTask.exe C: \ Programmer \ iTunes \ iTunesHelper.exe C: \ Programmer \ DellSupport \ DSAgnt.exe C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Programmer \ LogitechDesktopMessenger. Exe C: \ Programmer \ Messenger \ msmsgs.exe C: \ Programmer \ Logitech \ SetPoint \ SetPoint.exe C: \ Programmer \ WinZip \ WZQKPICK.EXE C: \ Programmer \ SpywareGuard \ sgmain.exe C: \ Programmer \ Alwil Software \ Avast4 \ ashMaiSv.exe C: \ Programmer \ Alwil Software \ Avast4 \ ashWebSv.exe C: \ Programmer \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.EXE C: \ Programmer \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ WINDOWS \ explorer.exe C: \ Programmer \ Mozilla Firefox \ firefox.exe C: \ Programmer \ Trend Micro \ HijackThis \ HijackThis.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://dsl.sbc.yahoo.com/ R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.dell4me.com/mywaybiz R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyServer = 0.0.0.0 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyOverride = *. lokale R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - (no file) O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Programmer \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Programmer \ Google \ GoogleToolbarNotifier \ 2.1.1119.1736 \ s wg.dll O3 - Toolbar: (no name) - (BA52B914-B692-46c4-B683-905236F6F655) - (no file) O3 - Toolbar: (no name) - (E0E899AB-F487-11D5-8D29-0050BA6940E3) - (no file) O4 - HKLM \ .. \ Run: [PCMService] "C: \ Programmer \ Dell \ Media Experience \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Programmer \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [igfxtray] C: \ WINDOWS \ system32 \ igfxtray.exe O4 - HKLM \ .. \ Run: [igfxhkcmd] C: \ WINDOWS \ system32 \ hkcmd.exe O4 - HKLM \ .. \ Run: [igfxpers] C: \ WINDOWS \ system32 \ igfxpers.exe O4 - HKLM \ .. \ Run: [CanonMyPrinter] C: \ Programmer \ Canon \ MyPrinter \ BJMyPrt.exe / logon O4 - HKLM \ .. \ Run: [SSBkgdUpdate] "C: \ Programmer \ Fælles filer \ ScanSoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe"-Embedding-boot O4 - HKLM \ .. \ Run: [OpwareSE4] "C: \ Programmer \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" O4 - HKLM \ .. \ Run: [IMJPMIG8.1] "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.EXE" / forkæle / RemAdvDef / Migration32 O4 - HKLM \ .. \ Run: [MSPY2002] C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScInst.exe / SYNC O4 - HKLM \ .. \ Run: [PHIME2002ASync] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / SYNC O4 - HKLM \ .. \ Run: [PHIME2002A] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / IMEName O4 - HKLM \ .. \ Run: [SoundMAXPnP] C: \ Programmer \ Analog Devices \ Core \ smax4pnp.exe O4 - HKLM \ .. \ Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Kernel og Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Programmer \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" O4 - HKLM \ .. \ Run: [dscactivate] "C: \ Programmer \ Dell Support Center \ gs_agent \ brugerdefinerede \ dsca.exe" O4 - HKLM \ .. \ Run: [DellSupportCenter] "C: \ Programmer \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Programmer \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [AppleSyncNotifier] C: \ Programmer \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Programmer \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [DellSupport] "C: \ Programmer \ DellSupport \ DSAgnt.exe" / start O4 - HKCU \ .. \ Run: [LDM] C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Programmer \ LogitechDesktopMessenger. Exe O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Programmer \ Messenger \ msmsgs.exe" / baggrund O4 - HKCU \ .. \ Run: [DellSupportCenter] "C: \ Programmer \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKUS \ S-1-5-18 \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ FÆLLES ~ 1 \ mikroer ~ 1 \ DW \ dwtrig20.exe"-t (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ FÆLLES ~ 1 \ mikroer ~ 1 \ DW \ dwtrig20.exe"-t (User 'Default user') O4 - Startup: SpywareGuard.lnk = C: \ Programmer \ SpywareGuard \ sgmain.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Programmer \ LogitechDesktopMessenger. Exe O4 - Global Startup: Logitech SetPoint.lnk = C: \ Programmer \ Logitech \ SetPoint \ SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C: \ Programmer \ Microsoft Office \ Office10 \ OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Programmer \ WinZip \ WZQKPICK.EXE O6 - HKCU \ Software \ Policies \ Microsoft \ Internet Explorer \ Control Panel stede O8 - Extra sammenhæng menupunktet: & AIM Search - res: / / C: \ Programmer \ AIM Toolbar \ AIMBar.dll / aimsearch.htm O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Programmer \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Programmer \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Ekstra knap: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Programmer \ AIM \ aim.exe O9 - Ekstra knap: Musicmatch MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (filen mangler) O9 - Ekstra knap: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Programmer \ Messenger \ msmsgs.exe O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Programmer \ Messenger \ msmsgs.exe O16 - DPF: (149E45D8-163E-4189-86FC-45022AB2B6C9) (Spintop DRM Control) - file: / / C: \ Programmer \ Scrabble \ Images \ stg_drm.ocx O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: (288C5F13-7E52-4ADA-A32E-F5BF9D125F98) (CR64Loader Object) -- http://miniclip.com/platypus/miniclipGameLoader.dll O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Programmer \ Yahoo! \ Common \ Yinsthelper.dll O16 - DPF: (406B5949-7190-4245-91A9-30A17DE16AD0) (Snapfish Activia) -- http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: (48884C41-EFAC-433D-958A-9FADAC41408E) (EGamesPlugin klasse) -- https: / / www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: (5F5F9FB8-878E-4455-95E0-F64B2314288A) -- http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: (5F8469B4-B055-49DD-83F7-62B522420ECC) (Facebook Photo Uploader Control) -- http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: (CC450D71-CC90-424C-8638-1F2DBAC87A54) (ArmHelper Control) - file: / / C: \ Programmer \ Scrabble \ Images \ armhelper.ocx O16 - DPF: (CD995117-98E5-4169-9920-6C12D4C0B548) -- http://gamedownload.ijjimax.com/game...Plugin9USA.cab O18 - Protocol: bwfile-8876480 - (9462A756-7B47-47BC-8C80-C34B9B80B32B) - C: \ Programmer \ Logitech \ Desktop Messenger \ 8876480 \ Program \ GAPlugProtocol-8876480.dll O23 - Service: Apple Mobile Device - Apple Inc. - C: \ Programmer \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Programmer \ Alwil Software \ Avast4 \ aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C: \ Programmer \ Alwil Software \ Avast4 \ ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Programmer \ Alwil Software \ Avast4 \ ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Programmer \ Alwil Software \ Avast4 \ ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C: \ Programmer \ Bonjour \ mDNSResponder.exe O23 - Service: DSBrokerService - Ukendt ejer - C: \ Programmer \ DellSupport \ brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Programmer \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Tabel Manager (IDriverT) - Macrovision Corporation - C: \ Programmer \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Programmer \ iPod \ bin \ iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C: \ Programmer \ Common Files \ Logitech \ Bluetooth \ LBTServ.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel (R) Corporation - C: \ Programmer \ Intel \ PROSetWired \ NCS \ Sync \ NetSvc.exe O23 - Service: npkcmsvc - INCA Internet Co, Ltd - C: \ Nexon \ Mabinogi \ npkcmsvc.exe O23 - Service: SupportSoft kædehjul Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C: \ Programmer \ Dell Support Center \ bin \ sprtsvc.exe O23 - Service: synspunkt Manager Service - synspunkt Corporation - C: \ Programmer \ synspunkt \ Common \ ViewpointService.exe -- End of file - 10.675 bytes |
|
#12
16 september 2008, 16:03
|
|||
|
|||
Brug for hjælp med mystiske desktop "bar"
---------- Downloade ViewpointKiller.zip
---------- Din Java er forældet. Ældre versioner har sårbarheder at ondsindede websteder kan bruge til at inficere dit system. Først installere de nye Søndag Java Runtime Environment Sørg for at lukke alle browservinduer, før du begynder installationen. Fjern den gamle version (s)
---------- Downloade ATF Cleaner ved Atribune til dit skrivebord. Alternativ download link Bemærk: Vista-brugere skal bruge Kør som administrator
Bemærk, at dit system vil køre langsommere for en genstart eller to efter at have brugt dette værktøj så ikke panik. Vigtigt: Genstart computeren, inden du fortsætter. ---------- Kør dette online scanning. Kræver Internet Explorer Brug ESET Nod32 Online Scanner 1. Marker afkrydsningsfeltet ved siden af JA, jeg accepterer Terms of Use. 2. Klik på Start 3. Adspurgt, tillade ActiveX-objekt til at installere 4. Klik på Start 5. Sørg for, at optionen Fjern fundet trusler og muligheden Scan uønskede programmer er tjekke mærket. 6. Klik på Scan 7. Vent til scanningen for at afslutte 8. Brug Notesblok til at åbne logfile placeret på C: \ Programmer \ EsetOnlineScanner \ Log.txt 9. Tilføj den C: \ Programmer \ EsetOnlineScanner \ Log.txt Log ind på din næste svar
__________________
 |
|
#13
17 september 2008, 04:20
|
|||
|
|||
|
Brug for hjælp med mystiske desktop "bar"
# Version = 4 # OnlineScanner.ocx = 1.0.0.635 # OnlineScannerDLLA.dll = 1, 0, 0, 79 # OnlineScannerDLLW.dll = 1, 0, 0, 78 # OnlineScannerUninstaller.exe = 1, 0, 0, 49 # vers_standard_module = 3447 (20080916) # vers_arch_module = 1,064 (20080214) # vers_adv_heur_module = 1,064 (20070717) # EOSSerial = 8983b3a42701b342bf8e75ec7f82c98f # udgangen = færdig # remove_checked = true # unwanted_checked = true # utc_time = 2008-09-17 05:39:16 # local_time = 2008-09-17 12:39:16 (-0600, Central Daylight Time) # land = "USA" # OSVer = 5.1.2600 NT Service Pack 2 # scannet = 226.155 # fundet = 0 # scan_time = 4.934
|
|
#14
17 september 2008, 08:40
|
|||
|
|||
|
Brug for hjælp med mystiske desktop "bar"
Indstille en ny gendannelsespunkt for at forhindre eventuel fornyet fra en gammel en
Indstilling af et nyt gendannelsespunkt efter rensning dit system vil gøre det muligt for computeren at roll-back til et rent arbejder tilstand, hvis det er nødvendigt.
Windows XP System Restore Guide eller Windows Vista System Restore Guide ---------- Brug Secunia Software Inspector at kontrollere, om der er forældet software. Uaktuel software har sikkerhedssvagheder, at malware kan udnytte.
Gå til Microsoft Windows Update og få alle kritiske opdateringer. ---------- Her er nogle store gratis værktøjer til at hjælpe dig med at holde fra at blive smittet igen. Disse værktøjer bruge lidt eller ingen ressourcer så vil ikke sinke din pc. Bekymret over browsersikkerhed? Overvej at bruge Mozilla Firefox 3.0. At forhindre ukendte applikationer fra at blive installeret på computeren installere WinPatrol 2008 * Brug Winpatrol at beskytte din computer mod skadelig software Jeg vil foreslå at bruge SiteAdvisor. SiteAdvisor satser på de steder på forretningsmetoder og spam. Sikkerhed ratings fra McAfee SiteAdvisor er baseret på automatiserede uskadelighedsforsøg af websteder. SpywareBlaster - Secure din Internet Explorer til at gøre det sværere for disse ActiveX-programmer til at køre på din computer. Også stoppe visse cookies i at blive tilføjet til din computer, når du kører Mozilla baserede browsere som Firefox. * Brug SpywareBlaster at beskytte din computer mod spyware og malware * Hvis du ikke ved hvad ActiveX kontroller, jf. her Check out Holde Yourself sikkert på internettet for tips og gratis værktøjer til at holde dig sikker i fremtiden. Se også Langsom computer? Den må ikke være Malware gratis rengøring / vedligeholdelse af værktøjer til at hjælpe med at holde din computer kører glat. Brug kun betroede sikkerhed software ligesom de programmer, der findes på denne side. Trusted sikkerhedsværktøjer & ressourcer
__________________
|
|
#15
17 september 2008, 14:24
|
|||
|
|||
|
Brug for hjælp med mystiske desktop "bar"
Jeg kan ikke takke dig nok. Jeg føler mig meget mere sikker på min computer nu takket være dig.
Jeg er meget imponeret over den overvældende mængde af viden på dette site og vil fortsætte med at bruge det for min computing behov. 
|
|
#16
17 september 2008, 14:27
|
|||
|
|||
|
Brug for hjælp med mystiske desktop "bar"
Glad det fungerede.
Sikker surfing ... 
__________________
|
