startside ændre sig, og cpu-forbrug helt oppe på 100

her er logfil af hijack.
Logfile of HijackThis v1.97.7
Scan saved at 19:39:20, on 08-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Logi_MwX.Exe
C:\tommy programmer\daemon tools\daemon.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\StartupMonitor.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\scvhost.exe
C:\Programmer\CPUCooL\CooLSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\sw32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\tommy regner\Lokale indstillinger\Temp\Midlertidig mappe 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kvikstart.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.efinder.cc/hp/" target="_blank">http://homepage.com
%00@www.efinder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\tommy programmer\adobe 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\PopupPopper\PopLib.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\tommy programmer\daemon tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AdvertisingCleaner] C:\Programmer\ProductsFoundry\AdvertisingCleaner\AdvCleaner.exe
O4 - HKLM\..\Run: [Configuration Loader] sw32.exe
O4 - HKLM\..\Run: [ivr] winupdate.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmer\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [Configuration Loader] sw32.exe
O4 - HKLM\..\RunServices: [ivr] winupdate.exe
O4 - HKCU\..\Run: [AddClass] C:\WINDOWS\AddClass.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O8 - Extra context menu item: Save Large Picture    &Q - res://C:\Programmer\UnH Solutions\SavePicNoAsk Standard\SavePicNoAsk.exe/130
O8 - Extra context menu item: Save Picture    &Z - res://C:\Programmer\UnH Solutions\SavePicNoAsk Standard\SavePicNoAsk.exe/131
O9 - Extra button: PopupPopper Control Panel (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: SavePicNoAsk Standard (HKCU)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW. Prefix: http://%65%68%74%74%70%2E%63%63/?
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38024.3410300926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/html/activex/danskesikker/DB/DanskeSikker.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Smid log'en herind..

Det er noget adware/spyware der ligger på din com..

kør:

Spyblaster
Searct and destroy og Ad-Ware

De skulle kunne klare det...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kvikstart.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.efinder.cc/hp/" target="_blank">http://homepage.com
%00@www.efinder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com
%

Det kan du fjerne

har kørt ad-aware og x cleaner og div... men stadig det samme..
hvad kan jeg slette...

ok... prøver lige

se evt. her (jeg havde samme problem)

http://www.eksperten.dk/spm/426073

ok så er de fjernede...
hvad med min cpu-forbrug... hvordan laver jeg en logfil af win jobliste?

"print screen"

:-)

er det nomalt at den fare fra o til 100 hele tiden? kan se udsving som næsten ryger ud af skærmen

Start med at kikke i din start mappe under programmer i win menu.

Undersøg hvad der starter op når win starter...
Se derefter det du har installeret igennem i kontrolpanelet under tilføj/fjern programmer. Fjern det du ved du ikke bruger, eller er sikker på du "aldrig" har installeret..

Nej - meget unormalt.
Tyder på der er noget der kører i baggrunden..

har jeg gjordt....

Well..

har du Norton Systemworks ??

print screen ?

ved stadig ikke lige hvordan jeg laver en copi af win log...

ingen norton pt...

ja. knappen der sidder ved siden af F12 :-)

Derefter åbner du et billedprogram ig indsætter billedet (ctrl+v)

Derefter gemmer du og ligger det ud et sted så jeg kan se det...

Nu tjekker jeg din log, for der er agabot virus i den og det er det, der er dit problem

Øø min printscreen virker vist ikke,, der sker intet når jeg trykker på den..

arlet har fundet noget... vent lige på hvad han finder ud af... (tror jeg har overset noget)

Der var en del snavs:
Du skal nu til at i gang med at fixe. Men først skal du lige have noget instruktion. Allerførst skal du slå systemgendannelse fra. Hvis du ikke ved hvordan du gør det så kig her: http://www.arlet.dk/systemgendannelsen.htm derefter skal du åbne hijackthis. Du får herunder nogle filer som du skal fixe, det du skal gøre er at sætte en vinge ud for disse filer jeg har skrevet nedeunder. IKKE FIXE endnu. Når du har gjort det så lukker du alle andre vinduer ned, det er meget vigtigt at det eneste vindue som er åbent er HijackThis vinduet. Husk også at lukke dette vindue når du har markeret filerne. Nu må du fixe. Klik på Fix chekede. Efter fix skal du genstarte din computer.
Her er de filer, du skal fixe :


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.efinder.cc/hp/" target="_blank">http://homepage.com
%00@www.efinder.cc/hp/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = www.efinder.cc/search/" target="_blank">http://homepage.com
%00@www.efinder.cc/search/ (obfuscated)

O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\PopupPopper\PopLib.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Configuration Loader] sw32.exe
O4 - HKLM\..\Run: [ivr] winupdate.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\RunServices: [Configuration Loader] sw32.exe
O4 - HKLM\..\RunServices: [ivr] winupdate.exe
O4 - HKCU\..\Run: [AddClass] C:\WINDOWS\AddClass.exe

O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW. Prefix: http://%65%68%74%74%70%2E%63%63/?

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab



Derefter Genstarter du i fejlsikret tilstand(Fejlsikret tilstand kommer du i ved at trykke på <F8> når maskinen starter op, lige inden den begynder at indlæse Windows.) Find følgende fil i Stifinder og slet den:


C:\WINDOWS\System32\scvhost.exe
c:\windows\sysyem32\winupdate.exe
C:\WINDOWS\System32\sw32.exe



Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Først når din log er endelig godkendt, må du aktiver din systemgendannelse igen.

HVORDAN HULEN FIK DU FAT I ALT DET?

ok... går i gang..

"HVORDAN HULEN FIK DU FAT I ALT DET?"

Det er ikke mig, der har lagt det på din computer, så du må spørge dig selv*S*

her er ny log..

Logfile of HijackThis v1.97.7
Scan saved at 20:22:42, on 08-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Logi_MwX.Exe
C:\tommy programmer\daemon tools\daemon.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\StartupMonitor.exe
C:\Programmer\CPUCooL\CooLSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Documents and Settings\tommy regner\Lokale indstillinger\Temp\Midlertidig mappe 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kvikstart.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\tommy programmer\adobe 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\tommy programmer\daemon tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AdvertisingCleaner] C:\Programmer\ProductsFoundry\AdvertisingCleaner\AdvCleaner.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmer\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O8 - Extra context menu item: Save Large Picture    &Q - res://C:\Programmer\UnH Solutions\SavePicNoAsk Standard\SavePicNoAsk.exe/130
O8 - Extra context menu item: Save Picture    &Z - res://C:\Programmer\UnH Solutions\SavePicNoAsk Standard\SavePicNoAsk.exe/131
O9 - Extra button: PopupPopper Control Panel (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: SavePicNoAsk Standard (HKCU)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38024.3410300926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/html/activex/danskesikker/DB/DanskeSikker.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Så er du ren og kan aktiver din systemgendannelse igen

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

Tusinde Tak..

Velbekommen

hvordan lukker jeg ?

du marker et navn i boksen til venstre og trykker accepter

Selvfølgelig det navn, du mener, der skal have pointene