Till Cecilia ;)

18 december, 2006

Hej!

Tack för att du tar dig tid att kolla!

//Daniel

Här är nu loggen då:

[log]Logfile of HijackThis v1.99.1

Scan saved at 16:44:32, on 2006-12-18

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\svchosts.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\WINDOWS\system32\UAService7.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\Program\DAEMON Tools\daemon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program\Microsoft IntelliPoint\ipoint.exe

C:\Program\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Program\Microsoft IntelliType Pro\type32.exe

C:\Program\Delade filer\{38B9853F-089C-1053-0329-04062803002e}\Update.exe

C:\Program\Bluetack\ProtoWall\ProtoWall.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\Nikon\NkView6\NkvMon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\WINDOWS\explorer.exe

C:\Program\Spyware Terminator\SpywareTerminator.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Outlook Express\msimn.exe

C:\Documents and Settings\Administratör\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {F2ADC15D-50C4-286E-9F1B-09E52D1C1591} - C:\WINDOWS\system32\buidzy.dll (file missing)

F2 - REG:system.ini: Shell=

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program\DELADE~1\{38B98~1\Bar888.dll

O2 - BHO: (no name) - {F2ADC15D-50C4-286E-9F1B-09E52D1C1591} - C:\WINDOWS\system32\buidzy.dll (file missing)

O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program\DELADE~1\{38B98~1\Bar888.dll

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [intelliPoint] "C:\Program\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [Avast!] C:\Program\Alwil Software\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [type32] "C:\Program\Microsoft IntelliType Pro\type32.exe"

O4 - HKLM\..\Run: [{38B9853F-089C-1053-0329-04062803002e}] "C:\Program\Delade filer\{38B9853F-089C-1053-0329-04062803002e}\Update.exe" mc-110-12-0001291

O4 - HKLM\..\Run: [{38B9853F-089D-1053-0329-04062803002e}] "C:\Program\Delade filer\{38B9853F-089D-1053-0329-04062803002e}\Update.exe" mc-110-12-0001291

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [ProtoWall] C:\Program\Bluetack\ProtoWall\ProtoWall.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: NkvMon.exe.lnk = C:\Program\Nikon\NkView6\NkvMon.exe

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MIC273~1\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by115fd.bay115.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136822709091

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program\Delade filer\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program\DELADE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001291 (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\Win32\RpcDataSrv.exe

O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\RpcSandraSrv.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

[/log]

[bild bifogad 2006-12-18 18:23:31 av kingmooze]

18 december, 2006

Gå till http://www.virustotal.com/ klistra in ett av följande filnamn i rutan, tryck på Send och vänta tills resultatet är klart (Status blir Finished). Klistra in resultatet (inkl. filstorlek) här. Upprepa med nästa filnamn.

C:\WINDOWS\system32\svchosts.exe

HijackThis ska ligga i sin egen mapp så att dess säkerhetskopior inte kommer bort. Antingen skapar du en ny mapp dit du flyttar HijackThis eller så installerar du denna variant av HijackThis:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Spyware Terminator vet jag för lite om för att rekommendera vad man ska göra med det. Jag väljer i stället detta program i detta fall:

Ladda hem och installera gratisversionen av SUPERAntiSpyware Free Edition:

http://www.superantispyware.com/download.html

Starta programmet, klicka på Check for updates.

Avsluta programmet när uppdateringen är klar.

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

Starta SUPERAntiSpyware och klicka på Scan your Computer.

Bocka för alla hårddiskar (fixed drive/disk).

Välj Perform complete scan

Nästa/Next

När skanningen är klar som kommer det upp en sammanfattning, tryck på OK

Nästa/Next

Utför eller liknande

Ett fönster med Quarantine and removal Complete kommer upp

OK

Utför eller liknande

Avsluta programmet.

Starta om i normalt läge.

Starta programmet, tryck på Preferences, välj filken Statistics/Logs

Dubbelklicka på den nyaste SUPERAntiSpyware Scan Log så att loggen kommer upp i Anteckningar.

Klistra in loggen i ditt svar samt en ny HijackThis-logg.

18 december, 2006

Hej!

Här kommer nya loggar o info efter att ha gjort som du sa.

Jag får upp via Avast! detta mess: C:\DOCUME~1\ADMINI~1\LOKALA~1\Temp\b116.exe (Win32:Adware-gen. [Adw]).

Det är då b116.exe som är skum men jag har tagit bort det flera gg... Ja, tydligen inte då..

Jag har en "extra" explorer.exe som ligger i mina dokument som jag inte kommer åt.

Den ligger i en under mapp som verkar heta w?ndows.

Hittar inget om det men den finns där iaf.

Jag trodde jag fick bort svcdhosts.exe men tydligen inte.

Här är det jag kunde kopiera från sidan du sa (alla andra progg sa att den var ren):

Norman 5.80.02 12.18.2006 W32/Softomate.EH.dropper

Panda 9.0.0.4 12.18.2006 Adware/Mytoolbar

Prevx1 V2 12.19.2006 Trojan.SystemPoser

Aditional Information

File size: 36864 bytes

MD5: 3fe5755470a1c9c223ac25944c0161fd

SHA1: 36c92adc1ca2ee0211124187cb2678c008b85958

Jag har nyss haft en fulingfil som hette scvhost.exe som jag tror är borta.

Om du nu behövde veta det!

***********************************************************

Här är en logg från Avast! om den är bra att ha:

*

* avast! Report

* This file is generated automatically

*

* Task 'Scanna C: med alla rar osv.' used

* Started on den 18 december 2006 19:26:49

* VPS: 0659-1, 2006-12-16

*

C:\Documents and Settings\Administratör\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat [E] Det går inte att komma åt filen eftersom den (32)

C:\Documents and Settings\Administratör\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG [E] Det går inte att komma åt filen eftersom den (32)

C:\Documents and Settings\Administratör\Mina dokument\M?crosoft\explorer.exe\[uPX] [L] Win32:Purityscan-Q [Trj] (0)

C:\Documents and Settings\Administratör\NTUSER.DAT [E] Det går inte att komma åt filen eftersom den (32)

C:\Documents and Settings\Administratör\NTUSER.DAT.LOG [E] Det går inte att komma åt filen eftersom den (32)

Infected files: 1

Total files: 28294

Total folders: 1423

Total size: 22,6 GB

*

* Task stopped: den 18 december 2006 20:25:08

* Run-time was 58 minute(s), 19 second(s)

**************************************************************

SUPERAntiSpyware Scan Log

Generated 12/18/2006 at 11:44 PM

Application Version : 3.4.1000

Core Rules Database Version : 3149

Trace Rules Database Version: 1165

Scan type : Complete Scan

Total Scan Time : 00:20:06

Memory items scanned : 167

Memory threats detected : 0

Registry items scanned : 7066

Registry threats detected : 36

File items scanned : 26004

File threats detected : 10

Trojan.Update-Mcboo

[{38B9853F-089C-1053-0329-04062803002e}] C:\PROGRAM\DELADE FILER\{38B9853F-089C-1053-0329-04062803002E}\UPDATE.EXE

C:\PROGRAM\DELADE FILER\{38B9853F-089C-1053-0329-04062803002E}\UPDATE.EXE

[{38B9853F-089D-1053-0329-04062803002e}] C:\PROGRAM\DELADE FILER\{38B9853F-089D-1053-0329-04062803002E}\UPDATE.EXE

C:\PROGRAM\DELADE FILER\{38B9853F-089D-1053-0329-04062803002E}\UPDATE.EXE

C:\WINDOWS\Prefetch\UPDATE.EXE-0AA67669.pf

Unclassified.Oreans32

HKLM\System\ControlSet003\Services\oreans32

C:\WINDOWS\SYSTEM32\DRIVERS\OREANS32.SYS

HKLM\System\ControlSet004\Services\oreans32

HKLM\System\CurrentControlSet\Services\oreans32

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32#NextInstance

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Service

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Legacy

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ConfigFlags

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Class

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ClassGUID

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#DeviceDesc

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Capabilities

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Driver

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\LogConf

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\Control

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Type

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#Start

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ErrorControl

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#ImagePath

HKLM\SYSTEM\CurrentControlSet\Services\oreans32#DisplayName

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security#Security

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#0

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#Count

HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum#NextInstance

Adware.Toolbar888

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\InprocServer32

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\InprocServer32#ThreadingModel

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\ProgID

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\Programmable

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\TypeLib

HKCR\CLSID\{C1B4DEC2-2623-438E-9CA2-C9043AB28508}\VersionIndependentProgID

Unclassified.Unknown Origin/System

C:\DOCUMENTS AND SETTINGS\ADMINISTRATöR\LOKALA INSTäLLNINGAR\TEMP\B116.EXE

Trojan.Freeprod

C:\DOCUMENTS AND SETTINGS\ADMINISTRATöR\SKRIVBORD\DOWNLOAD\WINDOWS.GENUINE.ADVANTAGE.VALIDATION.V1.5.723.1.CRACKED-ETH0\PATCH.EXE (denna ser mindre bra ut Ska den verkligen bort?)

Trojan.Hacktool

C:\PROGRAM\DELADE FILER\{38B9853F-089C-1053-0329-04062803002E}\SYSTEM.DLL

C:\PROGRAM\DELADE FILER\{38B9853F-089D-1053-0329-04062803002E}\SYSTEM.DLL

C:\RECYCLER\S-1-5-18\DC1\SYSTEM.DLL

C:\RECYCLER\S-1-5-18\DC2\SYSTEM.DLL

*******************************************************************************

[log]Logfile of HijackThis v1.99.1

Scan saved at 00:15:19, on 2006-12-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\svchosts.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\WINDOWS\system32\UAService7.exe

C:\Program\DAEMON Tools\daemon.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program\Microsoft IntelliPoint\ipoint.exe

C:\Program\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Program\Microsoft IntelliType Pro\type32.exe

C:\Program\Delade filer\{38B9853F-089C-1053-0329-04062803002e}\Update.exe

C:\Program\Bluetack\ProtoWall\ProtoWall.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\Nikon\NkView6\NkvMon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program\Opera\Opera.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\Administratör\Skrivbord\Hi LogFile\HJT1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {F2ADC15D-50C4-286E-9F1B-09E52D1C1591} - C:\WINDOWS\system32\buidzy.dll (file missing)

F2 - REG:system.ini: Shell=

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [intelliPoint] "C:\Program\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [Avast!] C:\Program\Alwil Software\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [type32] "C:\Program\Microsoft IntelliType Pro\type32.exe"

O4 - HKLM\..\Run: [{38B9853F-089C-1053-0329-04062803002e}] "C:\Program\Delade filer\{38B9853F-089C-1053-0329-04062803002e}\Update.exe" mc-110-12-0001291

O4 - HKCU\..\Run: [ProtoWall] C:\Program\Bluetack\ProtoWall\ProtoWall.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe