Vinduer lukker ned automatisk

<citat af fromsej>

Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker og kører du Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den.
Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

</citat>

du har vel ikke installeret et porno filter
det kan godt lukke forkerte sider

Logfile of HijackThis v1.97.7
Scan saved at 19:25:33, on 18-02-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
E:\Programmer\NetPeeker\NPGUI.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
E:\Programmer\QuickTime\qttask.exe
C:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe
E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
E:\PROGRA~1\ICQ\ICQ.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
D:\- [ Underholdning ] -\- [ Appz ] -\Spy things\HijackThis.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmz.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - E:\PROGRA~1\Acronis\PRIVAC~1\POP-UP~1.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NetPeeker] E:\Programmer\NetPeeker\NPGUI.exe Minimize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-aware] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [APVXDWIN] "E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Ad-watch] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe"
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Acronis Pop-up Blocker (HKLM)
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38015.7296180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164

Du har spyware.

Det første du gør, er at installere Service Pack 1 til din Windows XP, og opdateringer til Internet Explorer:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/

Efter installationen af SP1, installer hotfixes:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D531BF00-D7BE-48E3-ABCC-961602BD72C2&displaylang=da

ok jeg prøver...vender tilbage når jeg har downloadet og installeret

Det virkede sku ikke med de hotfixes :(

Lad os få en ny hijackthis log.. så kigger vi på det..

Logfile of HijackThis v1.97.7
Scan saved at 21:58:28, on 18-02-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\MsPMSPSv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
E:\Programmer\NetPeeker\NPGUI.exe
E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
E:\Programmer\QuickTime\qttask.exe
C:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe
C:\WINDOWS\services.exe
C:\Programmer\Fælles filer\CMEII\CMESys.exe
E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
E:\PROGRA~1\ICQ\ICQ.exe
C:\Programmer\Fælles filer\GMT\GMT.exe
C:\Programmer\Internet Explorer\iexplore.exe
E:\Programmer\eDonkey2000\edonkey2000.exe
D:\- [ Underholdning ] -\- [ Appz ] -\Spy things\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmz.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - E:\PROGRA~1\Acronis\PRIVAC~1\POP-UP~1.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NetPeeker] E:\Programmer\NetPeeker\NPGUI.exe Minimize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-aware] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [APVXDWIN] "E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Ad-watch] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe"
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [CMESys] "C:\Programmer\Fælles filer\CMEII\CMESys.exe"
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: GStartup.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Acronis Pop-up Blocker (HKLM)
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38015.7296180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164

hmm.. du har ikke installeret Service Pack 1.. det skal du lige gøre først..

Logfile of HijackThis v1.97.7
Scan saved at 22:47:20, on 18-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\Explorer.EXE
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\MsPMSPSv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\System32\msiexec.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
E:\Programmer\NetPeeker\NPGUI.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\WINDOWS\System32\devldr32.exe
E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
E:\Programmer\QuickTime\qttask.exe
C:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe
C:\WINDOWS\services.exe
C:\Programmer\Fælles filer\CMEII\CMESys.exe
C:\Programmer\Fælles filer\GMT\GMT.exe
D:\- [ Underholdning ] -\- [ Appz ] -\Spy things\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmz.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - E:\PROGRA~1\Acronis\PRIVAC~1\POP-UP~1.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NetPeeker] E:\Programmer\NetPeeker\NPGUI.exe Minimize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-aware] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [APVXDWIN] "E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Ad-watch] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe"
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [CMESys] "C:\Programmer\Fælles filer\CMEII\CMESys.exe"
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: GStartup.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Acronis Pop-up Blocker (HKLM)
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38015.7296180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164

så skulle den være installeret

kigger på det

Deaktiver systemgendannelse:
http://www.spywarefri.dk/virusscannere.htm#alle


** Fixes i HijackThis:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe"
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [CMESys] "C:\Programmer\Fælles filer\CMEII\CMESys.exe"
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe


<citat aovergaard ( http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=403#3643 )>

Kender du selv denne, jeg kan ikke finde noget på den. Hvis ikke så fix den.
O4 - HKLM\..\Run: [NetPeeker] C:\Programmer\NetPeeker\NPGUI.exe Minimize

</citat>


** Fixes i HijackThis (overflødigt):
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: GStartup.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000


** Slettes i fejlsikret tilstand (Tryk F8 ved opstart og vælg fejlsikret tilstand):
C:\Programmer\Common files\updater\wupdater.exe
C:\documents and settings\orangehaze\lokale indstillinger\temp\~vis0001\fsg_4104.exe
C:\WINDOWS\services.exe
C:\Programmer\Fælles filer\CMEII (HELE mappen)
C:\Programmer\Fælles filer\GMT (HELE mappen)
E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe


** Jeg er ikke sikker på den her.. er det noget du har installeret?
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - E:\PROGRA~1\Acronis\PRIVAC~1\POP-UP~1.DLL (file missing)


-- Fix, slet, enstart og smid en ny log herind.

Filerne/mapper kan være skjulte, så:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Ifølge aovergaard skal denne også fixes:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab

Logfile of HijackThis v1.97.7
Scan saved at 00:08:32, on 19-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
E:\Programmer\NetPeeker\NPGUI.exe
C:\WINDOWS\System32\devldr32.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
E:\PROGRA~1\ICQ\ICQ.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
D:\- [ Underholdning ] -\- [ Appz ] -\Spy things\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmz.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NetPeeker] E:\Programmer\NetPeeker\NPGUI.exe Minimize
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-aware] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [Ad-watch] "E:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [APVXDWIN] "E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38015.7296180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164

så skulle de være klaret....

Du havde selv installeret "NetPeeker"?

ja det har jeg selv installeret :)

hmm den lukker stadig vinduet ned?

Mystisk.. jeg synes at din log er ren nu.

<citat fromsej>

http://www.eksperten.dk/artikler/144
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.

</citat>

Vent lidt med at genaktivere systemgendannelse.. jeg får fromsej til at kigge på loggen i morgen.. sender ham en besked nu.

ok takker...

HJÆLP! Jeg vil meget gerne have det her til at virke hurtigst muligt!!!! har nogen vigtige ting jeg skal ordne på de sider der bliver ved med at lukke ned....jeg smidder 200 ekstra point i puljen til den der kan løse problemet!

prøv lige at scan med hijackthis igen og kom med en ny log

Ok her er den nye log :

Logfile of HijackThis v1.97.7
Scan saved at 12:57:05, on 19-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Fælles filer\Panda Software\PavShld\pavprsrv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\System32\devldr32.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
E:\PROGRA~1\ICQ\ICQ.exe
E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
E:\Programmer\eDonkey2000\edonkey2000.exe
E:\Programmer\mIRC\ZaiIRC.exe
E:\Programmer\Winamp\winamp.exe
D:\- [ Underholdning ] -\- [ Appz ] -\Spy things\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmz.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NetPeeker] E:\Programmer\NetPeeker\NPGUI.exe Minimize
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [APVXDWIN] "E:\Programmer\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38015.7296180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1320767D-7EF2-4282-ADB0-82DDB7CDA573}: NameServer = 194.239.134.83,193.162.153.164

thesurfer har gjort arbejdet, for der er ikke noget i loggen.

Du bliver nok nødt til at reinstaller din Internet explorer: http://www.arlet.dk/reinstaller_ie.htm

hmmm prøvede metode 1 den virkede ikke...problemet er der stadig :(

metode 2..virkede heller ikke...det er sku da mystisk!

Tjekker dig igennem i morgen.

Skal fixes:
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab

Ved du selv hvad den her er?
E:\Programmer\mIRC\ZaiIRC.exe

Prøv at deaktivere Netpeeker, og se om det ændrer noget.

ok har fixet -> 016-DPF

Ja det er IRC (chatprogram) jeg har installeret

Jeg har afinstalleret netpeeker, men uden resultat :(

Prøv i internet Explorer at tjekke her:
Funktioner=>Internetindstillinger=>Sikkerhed.
Sæt indstillinger til standardniveau.

lukket