SearchSprint browserproblemer

For at løse problemet skal du hente 2 programmer.

Du skal lige slette temporary internet files inden vi fortsætter.
Funktioner=>Internetindstillinger=>Slet filer, husk flueben i slet alt offline.

Først spybot : http://www.spywarefri.dk/vaerktoj.htm#spybot
direkte link : http://download.com.com/3000-2144-10122137.html?part=104443&subj=dlpage&tag=button

Installer og kør Spybot, opdater online, scan, alle filer den har fundet, der er røde skal markeres, tryk så på afhjælp valgte problemer, derefter genstarter du

Derefter hijackthis : http://www.spywarefri.dk/vaerktoj.htm#hijackthis
direkte link :         http://216.180.233.153/~merijn/files/HijackThis.exe
den udpakker du og kører Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den.


Du må ikke fixe noget selv. Når vi har tjekket loggen igennem fortæller vi dig hvad du skal slette..

Manual for installering af hijackthis:
http://www.spywarefri.dk/hijackthis.man.htm

Så går du bare direkte til hijackthis

HER KOMMER LOG'EN:

Logfile of HijackThis v1.97.7
Scan saved at 11:24:20, on 14-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Windows\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\mgabg.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\OfficeScan NT\ntrtscan.exe
C:\Windows\System32\svchost.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\ofcdog.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\PROMon.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Windows\System32\NMSSvc.exe
C:\Windows\System32\PDesk\PDesk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Windows\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Windows\System32\hphmon03.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\dpmw32.exe
C:\Windows\System32\NWTRAY.EXE
C:\Windows\System32\naldesk.exe
C:\OfficeScan NT\pccntmon.exe
C:\Windows\xcmon32.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Windows\sltwenia.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Internet Optimizer\optimize.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\program files\comsoft\dialers\easydates_dk\easydates_dk.exe
C:\Windows\System32\HPHipm09.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Documents and Settings\Søren Bjerre\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {0007F68E-91D9-42FE-8CC4-4D5BB20D7DDA} - C:\Windows\krodhhdl.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet3_88.dll
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\Windows\wsem216.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\Windows\nem214.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O3 - Toolbar: searchsprint - {AEE46806-2C5A-4A4E-A5DD-B4531F64A187} - C:\Windows\flpjgecs.dll
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\Windows\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft Hardware\Mouse\point32.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\Windows\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\Windows\System32\hphmon03.exe
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\Overnet.exe -t
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
O4 - HKLM\..\Run: [NDPS] C:\Windows\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [NAL] C:\Windows\System32\nalwin32.exe
O4 - HKLM\..\Run: [NAL Explorer] C:\Windows\System32\naldesk.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [DXAgent] C:\Windows\xcmon32.exe NO
O4 - HKLM\..\Run: [ikqhdjux] C:\Windows\sltwenia.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [EasyDates_dk] c:\program files\comsoft\dialers\easydates_dk\easydates_dk.exe /noconnect
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\Windows\Cpqdiag\CpqDfwAg.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/compaq/vet_install_popup.pl?1&04.00.05.04&http://www.smb.compaq.com/dstore/html/interactive/n800/evo800.html?c=3DDemo_Notebooks&n=D_I_IN_X_V_X_N800v&r=smb_NotebookFamily_B&t=ad
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab
O16 - DPF: {ABCCB0F0-514E-4BA6-989D-C67E5DBC2946} - https://download.danskebank.dk/download/keydownload/DB/KeyDownload.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F420A442-7538-48DF-A3F1-C55BDE3BBB56} (jimmyload.jimmycont) - http://www.roings.com/sec.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kbhamt.dk
O17 - HKLM\Software\..\Telephony: DomainName = kbhamt.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC63975A-4C98-4387-B485-24D1849C265F}: Domain = Z2808.sbvr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kbhamt.dk



Mvh Søren

Løber den lige igennem

Du skal hente Lspfix http://www.cexx.org/LSPFix.exe og trykke gem og lægge den på dit skrivebord. Du har noget snavs der når vi fjerner det måske ødelægger din netforbindelse. Hvis du mister internetforbindelsen når du fixer de ting jeg kommer med skal du kører det lspfix, starte det, klik til fuld skærm, markere I know what I am doing og klikke på finish, genstart og lav en ny logfil, som du smider herind.

Når det fix ligger på dit skrivebord skal du gå i kontrolpanel og tilføj/fjern og slet new.net og/eller new.dot. Derefter går du videre i min vejledning:



Der var en del snavs:
Du skal nu til at i gang med at fixe. Men først skal du lige have noget instruktion. Allerførst skal du slå systemgendannelse fra. Hvis du ikke ved hvordan du gør det så kig her: http://www.spywarefri.dk/virusscannere.htm#alle derefter skal du åbne hijackthis. Du får herunder nogle filer som du skal fixe, det du skal gøre er at sætte en vinge ud for disse filer jeg har skrevet nedeunder. IKKE FIXE endnu. Når du har gjort det så lukker du alle andre vinduer ned, det er meget vigtigt at det eneste vindue som er åbent er HijackThis vinduet. Husk også at lukke dette vindue når du har markeret filerne. Nu må du fixe. Klik på Fix chekede. Efter fix skal du genstarte din computer.
Her er de filer, du skal fixe :


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {0007F68E-91D9-42FE-8CC4-4D5BB20D7DDA} - C:\Windows\krodhhdl.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet3_88.dll
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\Windows\wsem216.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\Windows\nem214.dll
O3 - Toolbar: searchsprint - {AEE46806-2C5A-4A4E-A5DD-B4531F64A187} - C:\Windows\flpjgecs.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\Overnet.exe -t
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
O4 - HKLM\..\Run: [ikqhdjux] C:\Windows\sltwenia.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [EasyDates_dk] c:\program files\comsoft\dialers\easydates_dk\easydates_dk.exe /noconnect
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {F420A442-7538-48DF-A3F1-C55BDE3BBB56} (jimmyload.jimmycont) - http://www.roings.com/sec.cab

----------------------------------------------------
Du har en del ting, som jeg ikke kender og ikke kan finde noget på. kender du nogle af dem her, hvis ikke skal de fixes:


O4 - HKLM\..\Run: [NAL] C:\Windows\System32\nalwin32.exe
O4 - HKLM\..\Run: [NAL Explorer] C:\Windows\System32\naldesk.exe
O4 - HKLM\..\Run: [DXAgent] C:\Windows\xcmon32.exe NO




Derefter Genstarter du i fejlsikret tilstand(Fejlsikret tilstand kommer du i ved at trykke på <F8> når maskinen starter op, lige inden den begynder at indlæse Windows.) Find følgende fil i Stifinder og slet den:


C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\sltwenia.exe
C:\program files\comsoft\dialers\easydates_dk\easydates_dk.exe
C:\Program Files\Internet Optimizer <- hele mappen

----------------------------------------------------
Du har en del ting, som jeg ikke kender og ikke kan finde noget på. kender du nogle af dem her, hvis ikke skal de slettes:

C:\Windows\System32\NWTRAY.EXE
C:\Windows\System32\naldesk.exe
C:\Windows\xcmon32.exe


Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Først når din log er endelig godkendt, må du aktiver din systemgendannelse igen.

NY LOG:


Logfile of HijackThis v1.97.7
Scan saved at 13:55:41, on 14-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Windows\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\mgabg.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\Windows\System32\NMSSvc.exe
C:\OfficeScan NT\ntrtscan.exe
C:\Windows\System32\svchost.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\ofcdog.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\PROMon.exe
C:\Windows\System32\PDesk\PDesk.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Windows\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Windows\System32\hphmon03.exe
C:\Windows\System32\dpmw32.exe
C:\Windows\System32\NWTRAY.EXE
C:\Windows\System32\naldesk.exe
C:\OfficeScan NT\pccntmon.exe
C:\Windows\xcmon32.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Windows\System32\HPHipm09.exe
C:\WINDOWS\System32\dllhost.exe
C:\Windows\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Søren Bjerre\Desktop\BOX FIX\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O3 - Toolbar: searchsprint - {AEE46806-2C5A-4A4E-A5DD-B4531F64A187} - C:\Windows\flpjgecs.dll
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\Windows\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft Hardware\Mouse\point32.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\Windows\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\Windows\System32\hphmon03.exe
O4 - HKLM\..\Run: [NDPS] C:\Windows\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [NAL] C:\Windows\System32\nalwin32.exe
O4 - HKLM\..\Run: [NAL Explorer] C:\Windows\System32\naldesk.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [DXAgent] C:\Windows\xcmon32.exe NO
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\Windows\Cpqdiag\CpqDfwAg.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab
O16 - DPF: {ABCCB0F0-514E-4BA6-989D-C67E5DBC2946} - https://download.danskebank.dk/download/keydownload/DB/KeyDownload.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kbhamt.dk
O17 - HKLM\Software\..\Telephony: DomainName = kbhamt.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC63975A-4C98-4387-B485-24D1849C265F}: Domain = Z2808.sbvr.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kbhamt.dk

Hvis du kendte de 3 tvivlsomme, så er du ren og kan aktiver din systemgendannelse igen

Bedre beskyttelse i fremtiden: http://arlet.frac.dk/minpakkeloesning.htm