SPYware der bare IKKE vil væk

Hent Hijackthis, læg det i en mappe til formålet.
Kør det, scan , save log og kopier loggen herind, så kigger vi på det.
Slet venligst ikke noget selv, det gør opgaven sværere for os.
Hijackthis: http://danborg.org/spyware/HJT/hijackthis.exe

Har du installeret MessengerPlus?
Det er nemlig min gamle hårdtprøvede "ven" Lop.com der er på spil, dem har jeg ikke tabt til endnu. ;o)

Nej jeg kører Trillian.pro. men har en følelse af at Messenger også godt kan lide at invitere venner på besøg!!!

Logfile of HijackThis v1.97.7
Scan saved at 09:51:20, on 20-02-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Microsoft Hardware\Keyboard\type32.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
C:\Programmer\tweaks\RivaTuner\RivaTuner.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
E:\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
E:\NetLimiter\NetLimiter.exe
E:\planetscott.ca\PopupBlock\PopupBlock.exe
E:\MusicMatch Jukebox plus 8\mmtask.exe
E:\skype\Skype.exe
C:\Programmer\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
E:\Adobe\Distillr\AcroTray.exe
C:\WINDOWS\System32\rundll32.exe
C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
E:\Office\Office10\OUTLOOK.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
E:\Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\FTP\flashfxp.exe
C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\OPScan.exe
C:\Programmer\Messenger\msmsgs.exe
E:\Hijacks\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchexe.com/passthrough/index.html?http://about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchexe.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Memo axis - {AAF07782-C579-E4A7-F321-7514D273F08B} - C:\PROGRA~1\SECTHE~1\SIZETRAY.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Programmer\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ServiceLayer] C:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
O4 - HKLM\..\Run: [DataLayer] E:\Nokia\Nokia PC Suite 5\DataLayer\Application\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [oo4] RunDLL32.EXE C:\WINDOWS\oo4.dll,DllRun
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Programmer\tweaks\RivaTuner\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Programmer\tweaks\RivaTuner\RivaTuner.exe" /T
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINDOWS\bsx5.dll,DllRun
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [BootWarn] C:\Programmer\Norton Internet Security Professional\Norton AntiVirus\BootWarn.exe /a
O4 - HKLM\..\Run: [NetLimiter] E:\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [PopupBlock] E:\planetscott.ca\PopupBlock\PopupBlock.exe
O4 - HKLM\..\Run: [mmtask] E:\MusicMatch Jukebox plus 8\mmtask.exe
O4 - HKLM\..\Run: [Cddrv32] c:\windows\system32\cddrv32.exe
O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~2\AUTOUP~1\AUTOUP~1.EXE
O4 - HKLM\..\Run: [SpyBotSnD] "E:\Spybot - Search & Destroy 1.1\SpybotSD.exe" /autoclose
O4 - HKLM\..\Run: [JoyBows] C:\PROGRA~1\BOLTRO~1\ballskipdeaf.exe
O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\DOCUME~1\David\APPLIC~1\apropos.exe" C:\DOCUME~1\David\APPLIC~1\apropos.exe /HideUninstIcon /HideDir /UninstallName="Software Apropos" /PC=PLUS
O4 - HKCU\..\Run: [Cddrv32] c:\windows\system32\cddrv32.exe
O4 - HKCU\..\Run: [Skype] "E:\skype\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [PeerGuardian] C:\Programmer\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
O4 - HKCU\..\Run: [PopupBlock] E:\planetscott.ca\PopupBlock\PopupBlock.exe
O4 - Startup: BHO Cop.lnk = E:\Programmer\BHOCop\BHOCop.exe
O4 - Global Startup: Acrobat Assistant.lnk = E:\Adobe\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://E:\Office\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {358DFA15-D48C-4296-8D16-7405F918333B} (Fronter Open-Edit-Save Control (VersionControl)) - http://www2.fronter.com/kts/links/Fronter_oes_prj.cab
O16 - DPF: {71AEE1E3-1B65-41FA-BBD2-565CBD1359D8} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSPInstall0703.exe
O16 - DPF: {8602608F-EECD-471F-9D3E-7638F332154E} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-1103.exe
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.geekpages.com/msrdp.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E1089BC-1AE8-4685-8D77-6721E5C318A8} - http://217.73.66.1/del/loader.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37943.0330902778
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/ActiveData.cab

Flyt først filen Hijackthis til en mappe oprettet kun til den.

Deaktiver systemgendannelse:
http://www.spywarefri.dk/virusscannere.htm#alle

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret(Tryk <F8> under opstart) og slet filerne listet nederst.
Dobbelttjek, så alt kommer med.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchexe.com/passthrough/index.html?http://about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchexe.com/searchbar.html
O3 - Toolbar: Memo axis - {AAF07782-C579-E4A7-F321-7514D273F08B} - C:\PROGRA~1\SECTHE~1\SIZETRAY.dll (file missing)
O4 - HKLM\..\Run: [oo4] RunDLL32.EXE C:\WINDOWS\oo4.dll,DllRun
O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINDOWS\bsx5.dll,DllRun
O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~2\AUTOUP~1\AUTOUP~1.EXE
O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\DOCUME~1\David\APPLIC~1\apropos.exe" C:\DOCUME~1\David\APPLIC~1\apropos.exe /HideUninstIcon /HideDir /UninstallName="Software Apropos" /PC=PLUS
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {9E1089BC-1AE8-4685-8D77-6721E5C318A8} - http://217.73.66.1/del/loader.cab


---------------------------------------
Kender du? Ellers fixes.
O4 - HKLM\..\Run: [JoyBows] C:\PROGRA~1\BOLTRO~1\ballskipdeaf.exe
O16 - DPF: {358DFA15-D48C-4296-8D16-7405F918333B} (Fronter Open-Edit-Save Control (VersionControl)) - http://www2.fronter.com/kts/links/Fronter_oes_prj.cab

---------------------------------------
Har du selv lavet nogle restriktioner på Internet Explorer, ellers væk.
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

---------------------------------------
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

---------------------------------------
Slettes i fejlsikret.
C:\PROGRA~1\SECTHE~1 << Mappen.
C:\WINDOWS\oo4.dll,DllRun << Filen.
C:\WINDOWS\bsx5.dll << Filen.
C:\PROGRA~2\AUTOUP~1 << Mappen.
C:\DOCUME~1\David\APPLIC~1\apropos.exe << Filen.
---------------------------------------
Du skal også lige hente og installere programmet Ad-aware. Opdater det straks efter installationen, og inden du kører en scanning med denne. Fjern alt hvad den finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware

Genstart og kom med en ny logfil, så jeg kan se om alt er med.

Okay, men jeg vil prøve som du siger men, jeg har allerede kørt Ad-ware pro 6.0 så det kan jeg ikke se nogen fordele i, men ok.

Så bare drop ad-aware.

Hvordan sletter jeg de linjer du har listet? og jeg kan se at IKKE alle linjerne er noget bad shit, såsom http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
..men den skal væk alligevel eller?

Du scanner med hijackthis, sætter et flueben ved de linier jeg har skrevet, lukker alle vinduer undtaget Hijackthis og klikker på fix checked.

Jeg er igang med det, vender tilbage med et svar om kort tid....

Det virker sku, skidegodt fromsej, sender pointene til dig snarest muligt

Bare så du ikke kommer til at nakke pointsne selv:
Det er svaren (fromsej) der skal lægge et svar, og ikke spørgeren (dlc).. :)

Se evt: http://expfaq.1go.dk/?id=3#behandling_af_svar

Lægger lige et svar så.*S*

Tak for point.