Hjælp! Kaos i titel-linjen

http://www.eksperten.dk/spm/217997

Prøv at gå ind i tilføj / fjern programmer og se om der ikke er installeret et program der(searchingtheweb f.eks.)

tkmbh - Har prøvet, virkede ikke :'(

Du er blevet Hijacked.
Hent og kør Hijackthis, smid logfilen herind, så kigger vi på den.
http://www.spywarefri.dk/vaerktoj.htm#18
Det Ahv linker til vil ikke hjælpe dig.

Okay - her er logfilen:

Logfile of HijackThis v1.95.0
Scan saved at 19:12:23, on 23-07-03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\MESSENGER PLUS! 2\MSGPLUS.EXE
C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMER\LOGITECH\ITOUCH\ITOUCH.EXE
C:\WINDOWS\PATCH.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\LYXWPRFG.EXE
C:\PROGRAMMER\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAMMER\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BACKWEB-8876480.EXE
C:\PROGRAMMER\ULTIMATEZIP 2.7\UZQKST.EXE
C:\PROGRAMMER\WINBAR\WINBAR.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\TEMP\MYNF070.TMP
C:\PROGRAMMER\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\PROFILES\LASSE\DOKUMENTER\MODTAGNE FILER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://find.searchingtheweb.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://%73%65%61%72%63%68%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://%73%65%61%72%63%68%70%61%67%65%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%73%65%61%72%63%68%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://%63%75%73%74%6F%6D%69%7A%65%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://mysearchnow.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://%63%75%73%74%6F%6D%69%7A%65%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%73%65%61%72%63%68%2E%73%65%61%72%63%68%69%6E%67%74%68%65%77%65%62%2E%63%6F%6D
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Lasse's IE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {26115400-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: rxoajbllyfc - {26115401-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [PATCH] C:\WINDOWS\PATCH.EXE /nomsg
O4 - HKLM\..\Run: [NetBuster] C:\WINDOWS\TEMP\PFT3391~TMP\BUSTER.EXE
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [gcbp] C:\WINDOWS\PROFILES\LASSE\APPLIC~1\lyxwprfg.exe -QuieT
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: UltimateZip Quick Start.lnk = C:\Programmer\UltimateZip 2.7\uzqkst.exe
O4 - Startup: WinBar.lnk = C:\Programmer\WinBar\WinBar.exe
O4 - User Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - User Startup: UltimateZip Quick Start.lnk = C:\Programmer\UltimateZip 2.7\uzqkst.exe
O4 - User Startup: WinBar.lnk = C:\Programmer\WinBar\WinBar.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

1. Messenger plus er det agreste L... , det er smaskfyldt med Spyware og sponsoreret af Lop.com, et af de største firmaer i Spywareindustrien.
2. Hent og kør det her program.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Når du har gjort det, så genstart, kør Hijackthis igen, og lav en ny logfil, som du lægger her.

Messenger Plus:
http://www.spywareinfo.com/newsletter/archives/june-2003/3.php

Logfile of HijackThis v1.95.0
Scan saved at 19:30:32, on 23-07-03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\MESSENGER PLUS! 2\MSGPLUS.EXE
C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMER\LOGITECH\ITOUCH\ITOUCH.EXE
C:\WINDOWS\PATCH.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\LYXWPRFG.EXE
C:\PROGRAMMER\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BACKWEB-8876480.EXE
C:\PROGRAMMER\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\ULTIMATEZIP 2.7\UZQKST.EXE
C:\PROGRAMMER\WINBAR\WINBAR.EXE
C:\WINDOWS\TEMP\HIC91F1.TMP
C:\PROGRAMMER\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\PROFILES\LASSE\DOKUMENTER\MODTAGNE FILER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://find.searchingtheweb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://mysearchnow.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Lasse's IE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {26115400-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: rxoajbllyfc - {26115401-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [PATCH] C:\WINDOWS\PATCH.EXE /nomsg
O4 - HKLM\..\Run: [NetBuster] C:\WINDOWS\TEMP\PFT3391~TMP\BUSTER.EXE
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [gcbp] C:\WINDOWS\PROFILES\LASSE\APPLIC~1\lyxwprfg.exe -QuieT
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: UltimateZip Quick Start.lnk = C:\Programmer\UltimateZip 2.7\uzqkst.exe
O4 - Startup: WinBar.lnk = C:\Programmer\WinBar\WinBar.exe
O4 - User Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - User Startup: UltimateZip Quick Start.lnk = C:\Programmer\UltimateZip 2.7\uzqkst.exe
O4 - User Startup: WinBar.lnk = C:\Programmer\WinBar\WinBar.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

Det tog da toppen af det.
Nu får du nogle linier som du skal bruge Hijackthis til at "fixe"
Du får dem i små portioner, men du må ikke fixe før jeg/vi er færdige.

Okay

Fixes:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://find.searchingtheweb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://mysearchnow.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Lasse's IE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
O2 - BHO: (no name) - {26115400-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL  - Lop.
O3 - Toolbar: rxoajbllyfc - {26115401-b5ef-11d7-9a17-00080e7813eb} - C:\WINDOWS\PROFILES\LASSE\APPLICATION DATA\BRPCHBLCBY.DLL - mere Lop
O4 - HKLM\..\Run: [PATCH] C:\WINDOWS\PATCH.EXE /nomsg Kender du den ellers Fix.
O4 - HKLM\..\Run: [NetBuster] C:\WINDOWS\TEMP\PFT3391~TMP\BUSTER.EXE
O4 - HKLM\..\Run: [gcbp] C:\WINDOWS\PROFILES\LASSE\APPLIC~1\lyxwprfg.exe -QuieT
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart

Der kommer flere endnu, samt nogle programmer du skal have slettet.

O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe

Der kan komme flere endnu.

Nu er det gået væk.. Wierd! Nå, men tak for hjælpen

Der mangler alt det jeg har skrevet op.
Kør Hijackthis igen, sæt flueben ved alle de linier jeg har skrevet.
Tryk på Fix checked, genstart, kør HJT igen, lav en ny logfil og smid den her, det varer lidt endnu inden din PC er ren, der er også nogle programmer der skal slettes.