Kan man opdatere svchost.exe?

Lyder som om du har besøg af enten Blaster eller Gaobot.

Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker og kører du Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den.
Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Jeg har gjort ovenstående, og kopieret log filen herunder. Den er også sendt til din E-mail adresse, hvis den er nemmere at overse på den måde. Jeg har forsøgt at opdatere min Windows2000 via windowsupdate, fik fejlmeddelse på svchost.exe, fortsate opdateringen, som så mislykkedes efter 3 timers opdatering på 48 kbps! Mit Antivir program fandt 3 blaster vira, som jeg slettede. Spybot fandt 70 mistænkelige emner, afhjulpet. Herefter holdt min IExplorer op med at virke, har geninstalleret, og nu virken den 90%. Undskyld det lange skriv, håber du har ide om hvad mit problem er!?

Logfile of HijackThis v1.97.7
Scan saved at 23:42:02, on 11-01-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\ahead\InCD\InCD.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\internat.exe
C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
C:\Programmer\MailWasher\MailWasher.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\Iexplore.exe
C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dr.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAMMER\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Microsoft Explorer2] system.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Explorer2] system.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Image Transfer.lnk = C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Search Using Copernic - C:\Programmer\Copernic 2001 Basic\Search Extension.htm
O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM)
O9 - Extra button: Copernic (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.5.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/ProductUpdates/content/opuc.cab
O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/danmark/templateGallery/msotd.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdccommon/download/IbmEgath.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://130.228.229.67/ecwplugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.es/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37990.5549189815
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab
O16 - DPF: {FAC462CF-7E63-4042-8620-312D71652326} (SpeedTestSmall Control) - http://130.228.2.107/speedtest/SpeedTest_1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F367A0BD-265F-43AD-868B-A155270066E0}: NameServer = 212.88.64.199 212.88.64.14

Jeg kigger den igennem i aften.*S*

Hent cwsschredder her:
http://www.spywareinfo.com/~merijn/junk/CWShredder.exe
Kør programmet, tjek for updates, luk alle vinduer, undtaget cwsschredder, klik på Next, den scanner nu, når den er færdigt klik på Fix, klik på Exit.
Genstart og ny logfil fra Hijackthis, vi skal lige have det værste væk først.

cwsschredder melder clean. her er den nye logfil fra hijackthis. jeg får stadig fejl fra svchost.exe.

Logfile of HijackThis v1.97.7
Scan saved at 23:18:37, on 12-01-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\ahead\InCD\InCD.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\internat.exe
C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dr.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAMMER\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Microsoft Explorer2] system.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Explorer2] system.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Image Transfer.lnk = C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Search Using Copernic - C:\Programmer\Copernic 2001 Basic\Search Extension.htm
O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM)
O9 - Extra button: Copernic (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.5.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/ProductUpdates/content/opuc.cab
O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/danmark/templateGallery/msotd.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdccommon/download/IbmEgath.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://130.228.229.67/ecwplugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.es/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37990.5549189815
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab
O16 - DPF: {FAC462CF-7E63-4042-8620-312D71652326} (SpeedTestSmall Control) - http://130.228.2.107/speedtest/SpeedTest_1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F367A0BD-265F-43AD-868B-A155270066E0}: NameServer = 212.88.64.199 212.88.64.14

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret(Tryk <F8> under opstart) og slet filerne listet nederst.
Dobbelttjek, så alt kommer med.

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAMMER\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMER\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [Microsoft Explorer2] system.exe
O4 - HKLM\..\RunServices: [Microsoft Explorer2] system.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.5.cab


---------------------------------------
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

---------------------------------------
Slettes i fejlsikret.
C:\PROGRAMMER\MYWEBSEARCH <= Mappen.
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe <= Filen.
teekids.exe => Brug Start=>Søg.


---------------------------------------
Genstart og kom med en ny logfil, så jeg kan se om alt er med.

Se at få hentet og installeret Servicepack 4 til win2000, den kan hentes her:
http://www.it-service.sdu.dk/vis.php?side=84
Hent Dcombobulator, og få lukket et sikkerhedshul mere, den finder du her sammen med en dansk brugervejledning.
http://www.spywarefri.dk/tipsogtricks.htm#DCom

teekids.exe => Blastervariant.
system.exe => Net Controller 1.08 trojan.
Din browserhijacker er de små "søde" Smileys fra Smileycentral.

System.exe, skal selvfølgelig også findes og slettes i fejlsikret.

Herunder er den nye hijackthis log fil. Under forsøg på at hente servicepack 4 fik jeg igen: svchost har genereret en fejl og lukkes af Windows. Programmet skal genstartes. Der oprettes en fejllog. Jeg afbrød opdateringen idet jeg ved at jeg kan vente timer på at downloade til ingen nytte. Hvad gør jeg ved dette problem, hvordan får jeg rettet min svchost.exe så den virker?

Logfile of HijackThis v1.97.7
Scan saved at 20:21:34, on 13-01-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.exe
C:\Programmer\ahead\InCD\InCD.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\internat.exe
C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dr.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmer\Copernic 2001 Basic\Search Bar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Image Transfer.lnk = C:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Search Using Copernic - C:\Programmer\Copernic 2001 Basic\Search Extension.htm
O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM)
O9 - Extra button: Copernic (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/ProductUpdates/content/opuc.cab
O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/danmark/templateGallery/msotd.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdccommon/download/IbmEgath.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://130.228.229.67/ecwplugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.es/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37990.5549189815
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab
O16 - DPF: {FAC462CF-7E63-4042-8620-312D71652326} (SpeedTestSmall Control) - http://130.228.2.107/speedtest/SpeedTest_1.cab

Mine officeprogrammer virker heller ikke, systemet beder hele tiden om at blive installeret, hvilket jeg nu har gjort flere gange!?

Hent Dcombobulator, og få lukket et sikkerhedshul mere, den finder du her sammen med en dansk brugervejledning.
http://www.spywarefri.dk/tipsogtricks.htm#DCom
Når du har den hentet ned, så følg vejledningen her, umiddelbart efter, og inden du går på nettet, lukker du Dcom med bobulatoren.
prøv med en Repair

1:Det første du skal gøre er at boote op på din Windows XP/2000 CD, husk at din bios skal stå til at være first bootdevice cdrom.
Når den har installeret nogle foreløbige filer skal du;

2: springe det første tilbud om repair i Consolemode over og fortsætte din installation (nyindstalation)

3: Nu kan du så vælge hvilket drev din nye installation skal ligge på og her er det gerne dit C drev.

4: Og nu fortæller den dig der er et styresystem på dette drev og om du vil slette det (L) eller du vil lave en repair (R) - det er her du skal trykke på R.

5: Og du vil nu se at den laver en helt ny indstalation men det dejlige er bare den beholder alle dine indstillinger og dit skrive bord intakt men nu har du sluppet for alle dine fejl og mangler :-)

6:Lav kaffe, og slap lidt af i ventetiden.

7:PS husk at have din CD-Key klar, denne skal bruges da det jo er en "nyinstallation"

dcom er deaktiveret (har været det hele tiden).
hvorfor optræder svchost.exe 2 gange på den sidste logfil? Se ovenfor.
jeg er helt blank: hvordan sættes first bootdevice til cdrom?

Svchost.exe er en af de allervigtigste filer i windows XP og 2K, det er ikke unormalt at den optræder både 4 og 5 gange i en logfil.
For at sætte CDRom til First Boot Device, skal du i BIOS og finde noget med Bootrækkefølge.

Jeg har nu fulgt pkt. 1 - 7 (sprang kaffen over). Alt gik fint og jeg startede glad med at gå på Windows update side for at hente servicepack 4, så kom fejlmeddelsen fra svchost.exe IGEN!!! Hvad er det mon der generer denne fejl?

Bare jeg vidste det, er din AV opdateret?
Prøv evt en fuld scanning for virus.
Bor du i eller i nærheden af Odense, kan du hente en CD med SP4 hos mig.

Min AV har fundet en virus i motor.cab:
--> imscan.dll Contains code of the Windows virus W32/Kenston-1895.X
Den kan ikke slette den. Se i bunden af logfilen.
Måske har du også en kommentar til "Bad header" info?
Jeg har reinstalleret win2000 igen-igen og det hele kører fint, så længe jeg ikke går på nettet.
Hvis jeg kan få slettet W32 virus begynder det måske at ligne noget!?
Jeg er MEGET interesseret i din CD med SP4, kan jeg evt. downloade den her til min arbejds PC og tage den med hjem? Alternativt vil jeg naturligvis betale din omkostning for forsendelse (donation til din Spywarefri.dk?).

Her begynder AV logfilen (problemerne er i bunden):

Creation date of the report file: 16.01.2004  06:42

AntiVir®/XP (2000 + NT) Personal Edition v6.22.09.09 of 28.11.2003
VDF file v6.23.0.27 (0) of 08.01.2004


This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.


Scanning for 78277 virus strains and unwanted programs.

Licensed for:  AntiVir Personal Edition
Serial number: 0000149996-ADJIE-0001
FUSE:            Basic license

Please enter the workstation and
contact name with phone number in this form:

Name        ___________________________________________

Street      ___________________________________________

Town        ___________________________________________

Phone/Fax  ___________________________________________

EMail      ___________________________________________

Platform:        Windows NT Workstation
Windows version: 5.0 Build 2195 ()
Username:        Administrator
Computername:    NIELS
Processor:      Pentium
Working memory:  65056 KB free

Version information:
AVEWIN32.DLL  : v6.23.0.1      348672  04.12.2003  11:13:00
AVGNT.EXE      : v6.22.00.01    118824  17.09.2003  19:25:26
AVGUARD.EXE    : v6.22.00.01    180264  12.09.2003  09:11:16
GUARDMSG.DLL  : v6.22.00.01      90152  12.09.2003  09:11:16
AVGCMSG.DLL    : v6.22.00.02    241704  17.09.2003  19:25:26
AVGNTDD.SYS    : v6.21.00.02      39844  12.08.2003  21:07:34
AVPACK32.DLL  : v6.22.00.03    413736  03.11.2003  19:45:56
AVGETVER.DLL  : v6.22.00.00      24576  24.09.2003  15:30:00
AVWIN.DLL      : v6.22.00.09    553000  28.11.2003  14:40:28
AVSHLEXT.DLL  : v6.22.00.00      57344  17.09.2003  15:56:46
AVSched32.EXE  : v6.22.00.01    110632  05.11.2003  12:31:08
AVSched32.DLL  : v6.22.00.00    122880  17.09.2003  15:56:46
AVREG.DLL      : v6.22.00.00      41000  17.09.2003  15:56:46
AVRep.DLL      : v6.23.00.04    299048  23.12.2003  15:31:58
INETUPD.EXE    : v6.22.00.09    188416  28.11.2003  14:40:36
INETUPD.DLL    : v6.22.00.09    143360  28.11.2003  14:40:36
CTL3D32.DLL    : v2.31.000        27136  16.02.2000  01:00:00
MFC42.DLL      : v6.00.8665.0    995383  16.02.2000  01:00:00
MSVCRT.DLL    : v6.10.8637.0    295000  16.02.2000  01:00:00
CTL3DV2.DLL    : No information

Configuration file:

Name of configuration file: C:\Programmer\AVPersonal\AVWIN.INI
Name of report file:        C:\Programmer\AVPersonal\LOGFILES\AVWIN.LOG
Start path:                C:\Programmer\AVPersonal
Command line:             
Start mode:                  unknown

Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report

Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information

Abridge report file:
[ ] Abridge report file

Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged

Summary report:
[X] Create summary report
    Output file: AVWIN.ACT
    Maximum number of entries: 100

Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[ ] All files
[X] Program files
    Extensions:  .386 .ACM .ADE .ADP .APP .ASP .AWX .AX .BAT .BIN .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CSH .DLL .DLO .DO? .DRV .EML .EXE .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .JS .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PDR .PGM .PIF .PKG .POT .PPS .PPT .PRG .RPL .RTF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TSP .TTF .VB? .VLM .VXD .VXO .WIZ .WLL .WPC .WSC .WSF .WSH .WWK .XL? .XML

Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm

Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore

Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date

Suspicious macros:
[ ] Delete all suspicious macros
[ ] Delete all macros if one is suspicious
[X] Confirm action

Convert template:
[ ] Never
[ ] Only .DOC files
[X] Always
[ ] Confirm
[X] Compress format table

Drag&drop settings:
[X] Scan subdirectories

Profile settings:
[X] Scan subdirectories

Archive options
[X] Search archive
[X] All archive types

Miscellaneous options:
Temporary path: %TEMP% -> C:\DOCUME~1\ADMINI~1\LOKALE~1\Temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/NT Guard on System start

General settings:
[X] Save options on exiting AntiVir
Priority: medium

Drives:
A: Floppy drive
C: Hard disk
D: CD-ROM

Start of scan: 16.01.2004  06:42

Memory test                          OK
Master boot record of hard disk HD0  OK
Boot record of drive C:            OK


C:\
  pagefile.sys
      Access denied! Error during file opening!
      This is a Windows swap file. This file is locked by Windows.
      Error code: 0x000D
      WARNING! Access error/file locked!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
  Advertisingcom.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom10.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom11.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom12.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom13.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom14.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom15.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom16.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom4.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom5.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom6.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom7.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom8.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  Advertisingcom9.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  AlexaRelated.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  AlexaRelated1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  AvenueAInc.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  AvenueAInc1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BFast.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BFast1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BonziBuddy.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BonziBuddy1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  CommissionJunction.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  CommissionJunction1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  CommissionJunction2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  CommissionJunction3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DoubleClick.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DoubleClick1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DoubleClick2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DoubleClick3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DSOExploit.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  DSOExploit1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  FastClick.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  FastClick1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  FastClick2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HellzLittleSpy.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox10.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox11.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox12.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox13.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox14.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox4.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox5.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox6.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox7.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox8.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  HitBox9.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  LinkSynergy.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex4.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  MediaPlex5.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  TargetNet.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  TargetNet1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  ValueClick.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  ValueClick1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WebDialer.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WebDialer1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WebTrendslive.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WebTrendslive1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WindowsMediaPlayer.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WindowsMediaPlayer1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WindowsMediaPlayer2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  WindowsMediaPlayer3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
C:\Documents and Settings\Niels\Lokale indstillinger\Temp\cs185DE.tmp
  macro.cab
  ArchiveType: CAB (Microsoft)
    --> macro.inf
        NOTE! Bad header
C:\Documents and Settings\Niels\Lokale indstillinger\Temporary Internet Files\Content.IE5\1BQE1NS0
  hijackthis[1].zip
  ArchiveType: ZIP
      NOTE! No files to extract.
C:\Documents and Settings\Niels\Lokale indstillinger\Temporary Internet Files\Content.IE5\QYWC1V3K
  macro[2].cab
  ArchiveType: CAB (Microsoft)
    --> macro.inf
        NOTE! Bad header
C:\Documents and Settings\Niels\Lokale indstillinger\Temporary Internet Files\Content.IE5\RBIOT3Z0
  sony_usb010[1].zip
  ArchiveType: ZIP
      NOTE! No files to extract.
C:\Programmer\Macromedia\Flash 5\Players
  Flash 5 Player Installer.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
C:\Programmer\Macromedia\Flash 5\Players\Debug
  Flash 5 Player Installer.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
C:\Programmer\Macromedia\Flash 5\Players\Release
  Flash 5 Player Installer.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
Error! Could not change directory: System Volume Information
C:\WINDOWS\option\cabs
  DRIVER14.CAB
  ArchiveType: CAB (Microsoft)
      NOTE! The archive is created by multiple volumes
C:\WINDOWS\TEMP\_ASC2F3.TMP
  motor.cab
  ArchiveType: CAB (Microsoft)
    --> AS.DLL
        NOTE! Bad header
    --> imscan.dll
        Contains code of the Windows virus W32/Kenston-1895.X
    --> pavexcom.dll
        NOTE! Bad header
    --> pavoe.dll
        NOTE! Bad header
    --> tcpvfile.dll
        NOTE! Bad header
    --> qrvkrn.dll
        NOTE! Bad header
    --> qrvkrn.ini
        NOTE! Bad header
    --> port32.dll
        NOTE! Bad header
    --> port16.dll
        NOTE! Bad header
    --> asmdat.dll
        NOTE! Bad header
    --> assetup.inf
        NOTE! Bad header

End of scan: 16.01.2004  07:10
Time taken:        28:00 min


4212 directories were scanned
47429 files were scanned
  1 warning message was issued
  0 files were deleted
  0 files were repaired
  1 detection

daco. Har du en brænder kan du hente SP4 her: http://www.it-service.sdu.dk/vis.php?side=84

Tak! Det bliver spændende, har du et bud på hvordan jeg kommer af med W32?

C:\WINDOWS\TEMP skal tømmes, det kan IE Privacy Keeper klare for dig, hvis du ikke får lov selv i stifinder.
Hent IE privacy keeper her:
http://unhsolutions.net/IEPK/
Måske skal du i fejlsikret for at klare det.
Ang. at sende en CD til dig, nu er vi lidt ude i noget copyright noget her, ikke at jeg i min vildeste fantasi kan se noget odiøst i det, men jeg får lige en Coadmin ind og sige ja eller nej.

Bingo! Hvem siger at stædighed ikke lønner sig. Min pc er nu clean og 100% opdateret fra windowsupdate. STINGER fandt 4 vira, herunder at svchost.exe var inficeret med en W32 variant - filen blev slettet! 2 vira måtte jeg selv slette. Herefter sikrede jeg mig at mit virusprogram AntiVir virkede og var aktivt og gik på nettet for at opdatere. AntiVir fandt og slettede undervejs en Lovesan virus.
Tak til fromsej - point til dig.

Det var godt det lykkedes.*S*
Tak for point.
Du bør lige kigge på vores pakkeløsning, for at blive endnu mere sikker på nettet.
Selvfølgelig skal du ikke skifte virusscanner, hvis du er tilfreds med Antivir, den har kun et handicap, at man selv skal opdatere den.
http://www.spywarefri.dk/pakken.htm
Mvh:
Fromsej/Team Spywarefri.