w32.randex.gen

Der er en rimelig beskrivelse her :

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.DO

http://www.spywarefri.dk/vaerktoj.htm#spybot
http://www.spywarefri.dk/vaerktoj.htm#spybot
Hennt disse to programmer
Først spybot. Installer og opdater. Scan og afhjælp det den finder (markeret med rødt)
Derefter henter du hijackthis og scanner og gemmer loggen. Kopier den herind,  så kigger vi på den. Du må ikke fixe noget selv. Det kan gå grueligt galt :O)

http://www.spywarefri.dk/vaerktoj.htm#adaware

Andersenph-> samme link du smider :))
De skal hentes, installeres og updateres og så køres

Ups
http://www.spychecker.com/program/hijackthis.html

treode det var adaware du manglede

Jeg prøver lige det som der er skrevet hidtil, når jeg kommer hjem fra arbejde. Sender loggen efterfølgende.

Foreløbig tak

Her er så logfilen som kommer frem i Hijackthis:

Logfile of HijackThis v1.97.7
Scan saved at 16:09:14, on 30-03-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\msgfix.exe
C:\WINNT\SYSTEM32\winload.exe
C:\WINNT\system32\ixplores.exe
C:\WINNT\system32\msgfix.exe
C:\WINNT\system32\msclock.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\msgfix.exe
C:\WINNT\system32\ixplores.exe
C:\WINNT\system32\msgfix.exe
C:\WINNT\system32\svchosts.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Thomas Olsen\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts file is located at: C:\WINNT\System32\drivers\etc\hosts
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\wsftppro\wsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Explorer] msl.exe
O4 - HKLM\..\Run: [System Executable DLL Library] EXECDLL32.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CXMon] "c:\hp\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Windows WKS] wsass.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft IE Execute shell] C:\WINNT\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
O4 - HKLM\..\Run: [Synchronization Agent] mobsynca.exe
O4 - HKLM\..\Run: [Microsoft Firewall Settings Loader] conf32.exe
O4 - HKLM\..\Run: [Msg Fixed] msgfix.exe
O4 - HKLM\..\Run: [Windows Subsys] "C:\WINNT\SYSTEM32\winload.exe" rundll32.dll,loadsubsys,loadwin32,loadsys,win32
O4 - HKLM\..\Run: [ixplores] ixplores.exe
O4 - HKLM\..\Run: [Configuration Loader] msgfix.exe
O4 - HKLM\..\Run: [Internal software checker] C:\WINNT\system32\frgts32.exe
O4 - HKLM\..\Run: [Microsoft Digital Clock] msclock.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Randex virus built for IRBMe] irbme.exe
O4 - HKLM\..\Run: [Microsoft Update] svchosts.exe
O4 - HKLM\..\RunServices: [Microsoft Explorer] msl.exe
O4 - HKLM\..\RunServices: [System Executable DLL Library] EXECDLL32.EXE
O4 - HKLM\..\RunServices: [Windows WKS] wsass.exe
O4 - HKLM\..\RunServices: [Synchronization Agent] mobsynca.exe
O4 - HKLM\..\RunServices: [Microsoft Firewall Settings Loader] conf32.exe
O4 - HKLM\..\RunServices: [Msg Fixed] msgfix.exe
O4 - HKLM\..\RunServices: [Windows Subsys] "C:\WINNT\SYSTEM32\winload.exe" rundll32.dll,loadsubsys,loadwin32,loadsys,win32
O4 - HKLM\..\RunServices: [ixplores] ixplores.exe
O4 - HKLM\..\RunServices: [Configuration Loader] msgfix.exe
O4 - HKLM\..\RunServices: [Microsoft Digital Clock] msclock.exe
O4 - HKLM\..\RunServices: [Randex virus built for IRBMe] irbme.exe
O4 - HKLM\..\RunServices: [Microsoft Update] svchosts.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Msg Fixed] msgfix.exe
O4 - HKCU\..\Run: [ixplores] ixplores.exe
O4 - HKCU\..\Run: [Configuration Loader] msgfix.exe
O4 - HKCU\..\Run: [Microsoft Update] svchosts.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Save with Download Manager... - file://C:\Media Center\DMDownload.htm
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.1391435185
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Håber I fortsat kan hjælpe mig.

Flyt først filen Hijackthis til en mappe oprettet kun til den.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret(Tryk <F8> under opstart) og slet filerne listet nederst.
Dobbelttjek, så alt kommer med.

O1 - Hosts file is located at: C:\WINNT\System32\drivers\etc\hosts
O4 - HKLM\..\Run: [Microsoft Explorer] msl.exe
O4 - HKLM\..\Run: [System Executable DLL Library] EXECDLL32.EXE
O4 - HKLM\..\Run: [Windows WKS] wsass.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Agent] mobsynca.exe
O4 - HKLM\..\Run: [Microsoft Firewall Settings Loader] conf32.exe
O4 - HKLM\..\Run: [Msg Fixed] msgfix.exe
O4 - HKLM\..\Run: [Windows Subsys] "C:\WINNT\SYSTEM32\winload.exe" rundll32.dll,loadsubsys,loadwin32,loadsys,win32
O4 - HKLM\..\Run: [ixplores] ixplores.exe
O4 - HKLM\..\Run: [Configuration Loader] msgfix.exe
O4 - HKLM\..\Run: [Internal software checker] C:\WINNT\system32\frgts32.exe
O4 - HKLM\..\Run: [Microsoft Digital Clock] msclock.exe
O4 - HKLM\..\Run: [Randex virus built for IRBMe] irbme.exe
O4 - HKLM\..\Run: [Microsoft Update] svchosts.exe
O4 - HKLM\..\RunServices: [Microsoft Explorer] msl.exe
O4 - HKLM\..\RunServices: [System Executable DLL Library] EXECDLL32.EXE
O4 - HKLM\..\RunServices: [Windows WKS] wsass.exe
O4 - HKLM\..\RunServices: [Synchronization Agent] mobsynca.exe
O4 - HKLM\..\RunServices: [Microsoft Firewall Settings Loader] conf32.exe
O4 - HKLM\..\RunServices: [Msg Fixed] msgfix.exe
O4 - HKLM\..\RunServices: [Windows Subsys] "C:\WINNT\SYSTEM32\winload.exe" rundll32.dll,loadsubsys,loadwin32,loadsys,win32
O4 - HKLM\..\RunServices: [ixplores] ixplores.exe
O4 - HKLM\..\RunServices: [Configuration Loader] msgfix.exe
O4 - HKLM\..\RunServices: [Microsoft Digital Clock] msclock.exe
O4 - HKLM\..\RunServices: [Randex virus built for IRBMe] irbme.exe
O4 - HKLM\..\RunServices: [Microsoft Update] svchosts.exe
O4 - HKCU\..\Run: [Msg Fixed] msgfix.exe
O4 - HKCU\..\Run: [ixplores] ixplores.exe
O4 - HKCU\..\Run: [Configuration Loader] msgfix.exe
O4 - HKCU\..\Run: [Microsoft Update] svchosts.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
---------------------------------------
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
---------------------------------------
Slettes i fejlsikret, filerne.
:\WINNT\system32\msgfix.exe
C:\WINNT\SYSTEM32\winload.exe
C:\WINNT\system32\ixplores.exe
C:\WINNT\system32\msgfix.exe
C:\WINNT\system32\msclock.exe
C:\WINNT\system32\svchosts.exe
C:\WINNT\system32\frgts32.exe
Brug Start->Søg til at finde de her og slet dem.
msl.exe
EXECDLL32.EXE
mobsynca.exe
conf32.exe
msclock.exe
irbme.exe
wsass.exe
---------------------------------------
Genstart og kom med en ny logfil, så jeg kan se om alt er med.

Ny logfil efter ovenstående er gjort:

Logfile of HijackThis v1.97.7
Scan saved at 06:01:40, on 31-03-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\hp\Photo Imaging\Hpi_Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINNT\system32\ctfmon.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tdc.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\wsftppro\wsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CXMon] "c:\hp\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Microsoft IE Execute shell] C:\WINNT\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.1391435185
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Når jeg søgte efter filerne i det sidste beskrevne punkt fandt jeg ingen af dem.

Denne fil  C:\WINNT\system32\frgts32.exe  var heller ikke at finde.

Din log er fin ren

Din log er ren nu, som andersenph også siger, vi har lavet en artikel der kan hjælpe med at holde skidtet ude:
http://www.eksperten.dk/artikler/144
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Mvh:
Fromsej/Team Spywarefri.

http://www.eksperten.dk/spm/484242
Kigger du ind her fromsej?

Att Skau.

Jeg beklager at have begået en fejl da jeg skulle tildele pointene. De burde være tildelt andersenph og fromsej, så hvis du lige giver en lyd fra dig så vi kan få rettet fejlen.

Salgado76

Hej fromsej og andersenph

Selvom jeg har gjort som beskrevet af fromsej tidligere så er disse filer nu at finde på min pc igen:

C:\WINNT\system32\msgfix.exe
C:\WINNT\SYSTEM32\winload.exe
C:\WINNT\system32\ixplores.exe
C:\WINNT\system32\msclock.exe

Er det godt eller dårligt?

Salgado76

Kom med en ny log fra hijack, så kigger vi på det :O)

Her er så den nyeste log og den ser vel ren og fin ud, men jeg har stadig det problem, at når jeg åbner joblisten, så lukker den ned med det samme.

Logfile of HijackThis v1.97.7
Scan saved at 19:01:40, on 02-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINNT\system32\explorer.exe
C:\WINNT\system32\ctfmon.exe
C:\Winamp\winamp.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tdc.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\wsftppro\wsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft IE Execute shell] C:\WINNT\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [Shell32] explorer.exe
O4 - HKLM\..\RunServices: [Shell32] explorer.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.1391435185
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Håber I kan se hvad der er galt

Mvh Salgado76

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Jeg kan ikke se at du skulle have de filer liggende ud fra den log...
Prøv at tage et onlinescan hos panda...

O4 - HKLM\..\Run: [Shell32] explorer.exe
O4 - HKLM\..\RunServices: [Shell32] explorer.exe
Skal fixes.
Hent og kør Dcombobulator, så burde hullet blive lukket.
http://www.spywarefri.dk/tipsogtricks.htm#DCom

Hej igen

Har kørt DCom og har disabled det, genstartet computeren og kørt Hijackthis igen, men de to ovennævnte linier er stadig at finde.

Og derudover så kan jeg stadig ikke åbne joblisten.

Håber ikke jeg er til for meget besvær.

Og med hensyn til pointene, så har jeg intet hørt fra Skau siden sidst

Prøv at komme med den nye logfil, så må vi til bunds i det her.
Fred være med de point, det kommer der nok en løsning på.

Ny log:

Logfile of HijackThis v1.97.7
Scan saved at 07:57:32, on 03-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\AV\sygate\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINNT\system32\explorer.exe
C:\WINNT\system32\ctfmon.exe
C:\AV\Spamihilator\spamihilator.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tdc.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\AV\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\wsftppro\wsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft IE Execute shell] C:\WINNT\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [Shell32] explorer.exe
O4 - HKLM\..\Run: [SmcService] C:\AV\sygate\smc.exe -startgui
O4 - HKLM\..\RunServices: [Shell32] explorer.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Spamihilator] "C:\AV\Spamihilator\spamihilator.exe"
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.1391435185
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Har installeret Sygate Firewall og den fortæller mig at C:\WINNT\system32\explorer.exe forsøger at connecte til wick3d.nailed.org (68.51.17.139) ved at bruge remote port 7181

Tjek lige C:\WINNT\system32\explorer.exe her:
http://www.kaspersky.com/remoteviruschk.html

Har prøvet det og her er hvad den skrev:

Current object:  explorer.exe

explorer.exe Packed: FSG
explorer.exe Infected: Backdoor.SdBot.gen


Skal jeg så slette den eller hvad??

Ja, den skal du slette, den skal ikke ligge der alligevel, den rigtige Explorer.exe ligger i C:\Winnt, hvis du ikke får lov, så brug Dr.Delete til det:
http://spywarefri.dk/tipsogtricks.htm#dr.delete
Derefter kører du hijackthis igen og fixer de to her:
O4 - HKLM\..\Run: [Shell32] explorer.exe
O4 - HKLM\..\RunServices: [Shell32] explorer.exe

Genstart og en ny log.

Ny logfil efter ovenstående er gjort:

Logfile of HijackThis v1.97.7
Scan saved at 05:32:25, on 05-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\AV\sygate\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINNT\system32\ctfmon.exe
C:\AV\Spamihilator\spamihilator.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tdc.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\AV\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\wsftppro\wsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft IE Execute shell] C:\WINNT\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\AV\sygate\smc.exe -startgui
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Spamihilator] "C:\AV\Spamihilator\spamihilator.exe"
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.1391435185
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Nu er din log i hvert fald ren, er dine problemer med jobliste osv. løst?
Vi(Aovergaard) har lavet en artikel om sikker surfing.
http://www.eksperten.dk/artikler/144
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Mvh:
Fromsej/Team Spywarefri.