Min computer kører mega langsomt!

Vi kan lige tjekke efter for snavs.
Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker og kører du Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den.
Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Start med, at køre en diskoprydning og defragmentering.

Logfile of HijackThis v1.97.7
Scan saved at 13:25:11, on 13-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\Steffen\D-Tools\daemon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Steffen\Winamp\Winampa.exe
C:\Programmer\ClearSearch\Loader.exe
C:\WINDOWS\BEHKOR.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\System32\63964480.exe
C:\Steffen\Creative\SBAudigy\TaskBar\CTLTray.exe
C:\Steffen\Creative\SBAudigy\TaskBar\CTLTask.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Steffen\Eyeball\Eyeball Chat\EyeballChat.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Steffen\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Steffen\WinZip\WZQKPICK.EXE
C:\Steffen\WinBar\WinBar.exe
C:\Programmer\Logitech\ImageStudio\LowLight.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\DOCUME~1\STEFFE~1\LOKALE~1\Temp\Rar$EX00.407\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file)
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {000E7270-CC7A-0786-8E7A-DA09B51938A6} - C:\WINDOWS\System32\n3tpa1.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Steffen\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Clear Search - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\Programmer\ClearSearch\IE_ClrSch.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Steffen\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmer\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Steffen\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Steffen\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [ClrSchLoader] C:\Programmer\ClearSearch\Loader.exe
O4 - HKLM\..\Run: [BEHKOR] C:\WINDOWS\BEHKOR.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [74718874.exe] C:\WINDOWS\System32\74718874.exe
O4 - HKCU\..\Run: [TaskTray] C:\Steffen\Creative\SBAudigy\TaskBar\CTLTray.exe
O4 - HKCU\..\Run: [TaskBar] C:\Steffen\Creative\SBAudigy\TaskBar\CTLTask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Eyeball Chat] "C:\Steffen\Eyeball\Eyeball Chat\EyeballChat.exe" -min
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: WinBar.lnk = C:\Steffen\WinBar\WinBar.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Steffen\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Steffen\WinZip\WZQKPICK.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Descargas (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nwprovau.dll' missing
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/en/SysWebTelecom.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://66.98.166.50/speciale.com/ingresso/dialit/89/varieactive.exe

Deaktiver systemgendannelse:
http://www.spywarefri.dk/virus.htm#alle

Når du har fixet og genstartet ryger din internetforbindelse, hent og kør det her program for at genoprette den.
http://members.shaw.ca/techcd/WinsockXPFix.exe - Winsockfix.
---------------------------------------

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret(Tryk <F8> under opstart) og slet filerne listet nederst.
Dobbelttjek, så alt kommer med.

O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file)
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {000E7270-CC7A-0786-8E7A-DA09B51938A6} - C:\WINDOWS\System32\n3tpa1.dll
O2 - BHO: Clear Search - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\Programmer\ClearSearch\IE_ClrSch.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ClrSchLoader] C:\Programmer\ClearSearch\Loader.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nwprovau.dll' missing
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/en/SysWebTelecom.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://66.98.166.50/speciale.com/ingresso/dialit/89/varieactive.exe
---------------------------------------
Kender du? Ellers fixes.
O4 - HKLM\..\Run: [BEHKOR] C:\WINDOWS\BEHKOR.exe
O4 - HKLM\..\Run: [74718874.exe] C:\WINDOWS\System32\74718874.exe

---------------------------------------
Slettes i fejlsikret.
C:\Programmer\ClearSearch\Loader.exe => Mappen ClearSearch.
C:\WINDOWS\BEHKOR.exe => Hvis du ikke kender den.



---------------------------------------

Genstart og kom med en ny logfil, så vi kan se om alt er med.

Logfile of HijackThis v1.97.7
Scan saved at 14:33:52, on 13-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\Steffen\D-Tools\daemon.exe
C:\Steffen\Winamp\Winampa.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\Steffen\Creative\SBAudigy\TaskBar\CTLTray.exe
C:\Steffen\Creative\SBAudigy\TaskBar\CTLTask.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Steffen\Eyeball\Eyeball Chat\EyeballChat.exe
C:\Steffen\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Steffen\WinZip\WZQKPICK.EXE
C:\Steffen\WinBar\WinBar.exe
C:\Programmer\Logitech\ImageStudio\LowLight.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Documents and Settings\Steffen Andersen\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Steffen\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Steffen\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmer\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Steffen\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Steffen\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Steffen\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [TaskTray] C:\Steffen\Creative\SBAudigy\TaskBar\CTLTray.exe
O4 - HKCU\..\Run: [TaskBar] C:\Steffen\Creative\SBAudigy\TaskBar\CTLTask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Eyeball Chat] "C:\Steffen\Eyeball\Eyeball Chat\EyeballChat.exe" -min
O4 - Startup: WinBar.lnk = C:\Steffen\WinBar\WinBar.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Steffen\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Steffen\WinZip\WZQKPICK.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Descargas (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O10 - Unknown file in Winsock LSP: c:\steffen\panda software\panda titanium antivirus 2004\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\steffen\panda software\panda titanium antivirus 2004\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\steffen\panda software\panda titanium antivirus 2004\pavlsp.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Den her overså jeg sidste gang, fix den, så er du ren.
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

For at holde skidtet ude af din PC, kan du hente flg. programmer:
Spywareblaster, Spywareguard, IE-Spyad og Empty Temp Folders, dem finder du, sammen med danske vejledninger her:
http://www.spywarefri.dk/vaerktoj.htm
Læs især om IE-Spyad, så du får det fulde udbytte af dette lille geniale program.
Hent Dcombobulator, og få lukket et sikkerhedshul mere, den finder du her sammen med en dansk brugervejledning.
http://www.spywarefri.dk/tipsogtricks.htm#DCom
Hent og installér Servicepack 1 til XP her:
http://www.it-service.sdu.dk/vis.php?side=84
Samt få opdateret fra Microsoft Update.

Mvh:
Fromsej/Team Spywarefri.

Tak for hjælpen!

Velbekomme, og tak for point.*S*