hjælp til fjernelse af i search

http://www.spywarefri.dk/vaerktoj.htm#hijackthis
Hent hijackthis. Scan og save log
Kopier den herind så fjerner vi snavset

http://www.spywarefri.dk/vaerktoj.htm#spybot
Du kan eventuelt starte med at hente spybot
Opdater det og scan din pc. Afhjælp problemer den har fundet (med rødt) og genstart.
Kom derefter med log filen fra hijackthis....

her var så loggen... håber du kan hjælpe mig..


Logfile of HijackThis v1.97.7
Scan saved at 21:32:25, on 26-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\valve\steam\steam.exe
C:\WINDOWS\System32\LVComS.exe
C:\Programmer\SEC\Natural Color\NaturalColorLoad.exe
C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\Executive Software\Diskeeper\DkService.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Thomas\Lokale indstillinger\Temporary Internet Files\Content.IE5\DGGEVGWH\hijackthis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.isearch.com/index.php?ref=none
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O1 - Hosts: 127.0.0.0 localhost
O1 - Hosts: 127.0.0.2 auditmypc.com
O1 - Hosts: 127.0.0.3 boards.cexx.org
O1 - Hosts: 127.0.0.4 bulletproofsoft.net
O1 - Hosts: 127.0.0.5 camtech2000.net
O1 - Hosts: 127.0.0.6 cexx.org
O1 - Hosts: 127.0.0.7 computercops.us
O1 - Hosts: 127.0.0.8 ct7support.com
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.20 kellys-korner-xp.com
O1 - Hosts: 127.0.0.21 kephyr.com
O1 - Hosts: 127.0.0.22 lavasoft.de
O1 - Hosts: 127.0.0.23 lavasoftusa.com
O1 - Hosts: 127.0.0.24 lurkhere.com
O1 - Hosts: 127.0.0.25 majorgeeks.com
O1 - Hosts: 127.0.0.26 merijn.org
O1 - Hosts: 127.0.0.27 mjc1.com
O1 - Hosts: 127.0.0.28 moosoft.com
O1 - Hosts: 127.0.0.29 mvps.org
O1 - Hosts: 127.0.0.30 net-integration.net
O1 - Hosts: 127.0.0.31 noadware.net
O1 - Hosts: 127.0.0.32 no-spybot.com
O1 - Hosts: 127.0.0.33 onlinepcfix.com
O1 - Hosts: 127.0.0.34 pchell.com
O1 - Hosts: 127.0.0.35 pestpatrol.com
O1 - Hosts: 127.0.0.36 safer-networking.org
O1 - Hosts: 127.0.0.37 secure.spykiller.com
O1 - Hosts: 127.0.0.38 secureie.com
O1 - Hosts: 127.0.0.39 security.kolla.de
O1 - Hosts: 127.0.0.40 spybot.info
O1 - Hosts: 127.0.0.41 spychecker.com
O1 - Hosts: 127.0.0.42 spychecker.com
O1 - Hosts: 127.0.0.43 spycop.com
O1 - Hosts: 127.0.0.44 spyguard.com
O1 - Hosts: 127.0.0.45 spykiller.com
O1 - Hosts: 127.0.0.46 spyware.co.uk
O1 - Hosts: 127.0.0.47 spyware-cop.com
O1 - Hosts: 127.0.0.48 spywareinfo.com
O1 - Hosts: 127.0.0.49 spywarenuker.com
O1 - Hosts: 127.0.0.50 spywareremove.com
O1 - Hosts: 127.0.0.51 spywareremove.com
O1 - Hosts: 127.0.0.52 stopzillapro.com
O1 - Hosts: 127.0.0.53 sunbelt-software.com
O1 - Hosts: 127.0.0.54 thiefware.com
O1 - Hosts: 127.0.0.55 tomcoyote.org
O1 - Hosts: 127.0.0.56 unwantedlinks.com
O1 - Hosts: 127.0.0.57 webattack.com
O1 - Hosts: 127.0.0.58 wilders.org
O1 - Hosts: 127.0.0.59 www.auditmypc.com
O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net
O1 - Hosts: 127.0.0.61 www.cexx.org
O1 - Hosts: 127.0.0.62 www.computercops.us
O1 - Hosts: 127.0.0.63 www.ct7support.com
O1 - Hosts: 127.0.0.64 www.doxdesk.com
O1 - Hosts: 127.0.0.65 www.eblocs.com
O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com
O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com
O1 - Hosts: 127.0.0.68 www.free-web-browsers.com
O1 - Hosts: 127.0.0.69 www.grc.com
O1 - Hosts: 127.0.0.70 www.grisoft.com
O1 - Hosts: 127.0.0.71 www.hackfaq.org
O1 - Hosts: 127.0.0.72 www.hazeleger.net
O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com
O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com
O1 - Hosts: 127.0.0.75 www.kephyr.com
O1 - Hosts: 127.0.0.76 www.lavasoft.de
O1 - Hosts: 127.0.0.77 www.lavasoftusa.com
O1 - Hosts: 127.0.0.78 www.lurkhere.com
O1 - Hosts: 127.0.0.79 www.majorgeeks.com
O1 - Hosts: 127.0.0.80 www.merijn.org
O1 - Hosts: 127.0.0.81 www.mjc1.com
O1 - Hosts: 127.0.0.82 www.moosoft.com
O1 - Hosts: 127.0.0.83 www.mvps.org
O1 - Hosts: 127.0.0.84 www.net-integration.net
O1 - Hosts: 127.0.0.85 www.noadware.net
O1 - Hosts: 127.0.0.86 www.no-spybot.com
O1 - Hosts: 127.0.0.87 www.onlinepcfix.com
O1 - Hosts: 127.0.0.88 www.pchell.com
O1 - Hosts: 127.0.0.89 www.pestpatrol.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Highlight Zone II.lnk = C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38017.3710648148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Jeg kigger på den :O)
http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
Hent cwshredder. Scan og fix hvad den finder.
Genstart og ny log please

Læg lige mærke til de 01-hosts, det er faktisk revl og krat af internationale fora til spywarebekæmpelse der bliver lukket for, der er kun et dækkende udtryk her:
RØVHULLER!(Undskyld sproget).

Found Hosts file: C:\WINDOWS\system32\drivers\etc\hosts (3233 bytes, A)
Hosts file: 127.0.0.0    localhost
Hosts file: 127.0.0.2    auditmypc.com
Hosts file: 127.0.0.3    boards.cexx.org
Hosts file: 127.0.0.4    bulletproofsoft.net
Hosts file: 127.0.0.5    camtech2000.net
Hosts file: 127.0.0.6    cexx.org
Hosts file: 127.0.0.7    computercops.us
Hosts file: 127.0.0.8    ct7support.com
Hosts file: 127.0.0.20    kellys-korner-xp.com
Hosts file: 127.0.0.21    kephyr.com
Hosts file: 127.0.0.22    lavasoft.de
Hosts file: 127.0.0.23    lavasoftusa.com
Hosts file: 127.0.0.24    lurkhere.com
Hosts file: 127.0.0.25    majorgeeks.com
Hosts file: 127.0.0.26    merijn.org
Hosts file: 127.0.0.27    mjc1.com
Hosts file: 127.0.0.28    moosoft.com
Hosts file: 127.0.0.29    mvps.org
Hosts file: 127.0.0.30    net-integration.net
Hosts file: 127.0.0.31    noadware.net
Hosts file: 127.0.0.32    no-spybot.com
Hosts file: 127.0.0.33    onlinepcfix.com
Hosts file: 127.0.0.34    pchell.com
Hosts file: 127.0.0.35    pestpatrol.com
Hosts file: 127.0.0.36    safer-networking.org
Hosts file: 127.0.0.37    secure.spykiller.com
Hosts file: 127.0.0.38    secureie.com
Hosts file: 127.0.0.39    security.kolla.de
Hosts file: 127.0.0.40    spybot.info
Hosts file: 127.0.0.41    spychecker.com
Hosts file: 127.0.0.42    spychecker.com
Hosts file: 127.0.0.43    spycop.com
Hosts file: 127.0.0.44    spyguard.com
Hosts file: 127.0.0.45    spykiller.com
Hosts file: 127.0.0.46    spyware.co.uk
Hosts file: 127.0.0.47    spyware-cop.com
Hosts file: 127.0.0.48    spywareinfo.com
Hosts file: 127.0.0.49    spywarenuker.com
Hosts file: 127.0.0.50    spywareremove.com
Hosts file: 127.0.0.51    spywareremove.com
Hosts file: 127.0.0.52    stopzillapro.com
Hosts file: 127.0.0.53    sunbelt-software.com
Hosts file: 127.0.0.54    thiefware.com
Hosts file: 127.0.0.55    tomcoyote.org
Hosts file: 127.0.0.56    unwantedlinks.com
Hosts file: 127.0.0.57    webattack.com
Hosts file: 127.0.0.58    wilders.org
Hosts file: 127.0.0.59    www.auditmypc.com
Hosts file: 127.0.0.60    www.bulletproofsoft.net
Hosts file: 127.0.0.61    www.cexx.org
Hosts file: 127.0.0.62    www.computercops.us
Hosts file: 127.0.0.63    www.ct7support.com
Hosts file: 127.0.0.64    www.doxdesk.com
Hosts file: 127.0.0.65    www.eblocs.com
Hosts file: 127.0.0.66    www.enigmasoftwaregroup.com
Hosts file: 127.0.0.67    www.free-spyware-scan.com
Hosts file: 127.0.0.68    www.free-web-browsers.com
Hosts file: 127.0.0.69    www.grc.com
Hosts file: 127.0.0.70    www.grisoft.com
Hosts file: 127.0.0.71    www.hackfaq.org
Hosts file: 127.0.0.72    www.hazeleger.net
Hosts file: 127.0.0.73    www.javacoolsoftware.com
Hosts file: 127.0.0.74    www.kellys-korner-xp.com
Hosts file: 127.0.0.75    www.kephyr.com
Hosts file: 127.0.0.76    www.lavasoft.de
Hosts file: 127.0.0.77    www.lavasoftusa.com
Hosts file: 127.0.0.78    www.lurkhere.com
Hosts file: 127.0.0.79    www.majorgeeks.com
Hosts file: 127.0.0.80    www.merijn.org
Hosts file: 127.0.0.81    www.mjc1.com
Hosts file: 127.0.0.82    www.moosoft.com
Hosts file: 127.0.0.83    www.mvps.org
Hosts file: 127.0.0.84    www.net-integration.net
Hosts file: 127.0.0.85    www.noadware.net
Hosts file: 127.0.0.86    www.no-spybot.com
Hosts file: 127.0.0.87    www.onlinepcfix.com
Hosts file: 127.0.0.88    www.pchell.com
Lige en log mere


Hosts file: 127.0.0.89    www.pestpatrol.com
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINDOWS\win.ini (615 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (231 bytes, A)

hasuum1->kør cwshredder og genstart. Kom derefter med en ny log...

har genstartet


ound Hosts file: C:\WINDOWS\system32\drivers\etc\hosts (3233 bytes, A)
Hosts file: 127.0.0.0    localhost
Hosts file: 127.0.0.2    auditmypc.com
Hosts file: 127.0.0.3    boards.cexx.org
Hosts file: 127.0.0.4    bulletproofsoft.net
Hosts file: 127.0.0.5    camtech2000.net
Hosts file: 127.0.0.6    cexx.org
Hosts file: 127.0.0.7    computercops.us
Hosts file: 127.0.0.8    ct7support.com
Hosts file: 127.0.0.20    kellys-korner-xp.com
Hosts file: 127.0.0.21    kephyr.com
Hosts file: 127.0.0.22    lavasoft.de
Hosts file: 127.0.0.23    lavasoftusa.com
Hosts file: 127.0.0.24    lurkhere.com
Hosts file: 127.0.0.25    majorgeeks.com
Hosts file: 127.0.0.26    merijn.org
Hosts file: 127.0.0.27    mjc1.com
Hosts file: 127.0.0.28    moosoft.com
Hosts file: 127.0.0.29    mvps.org
Hosts file: 127.0.0.30    net-integration.net
Hosts file: 127.0.0.31    noadware.net
Hosts file: 127.0.0.32    no-spybot.com
Hosts file: 127.0.0.33    onlinepcfix.com
Hosts file: 127.0.0.34    pchell.com
Hosts file: 127.0.0.35    pestpatrol.com
Hosts file: 127.0.0.36    safer-networking.org
Hosts file: 127.0.0.37    secure.spykiller.com
Hosts file: 127.0.0.38    secureie.com
Hosts file: 127.0.0.39    security.kolla.de
Hosts file: 127.0.0.40    spybot.info
Hosts file: 127.0.0.41    spychecker.com
Hosts file: 127.0.0.42    spychecker.com
Hosts file: 127.0.0.43    spycop.com
Hosts file: 127.0.0.44    spyguard.com
Hosts file: 127.0.0.45    spykiller.com
Hosts file: 127.0.0.46    spyware.co.uk
Hosts file: 127.0.0.47    spyware-cop.com
Hosts file: 127.0.0.48    spywareinfo.com
Hosts file: 127.0.0.49    spywarenuker.com
Hosts file: 127.0.0.50    spywareremove.com
Hosts file: 127.0.0.51    spywareremove.com
Hosts file: 127.0.0.52    stopzillapro.com
Hosts file: 127.0.0.53    sunbelt-software.com
Hosts file: 127.0.0.54    thiefware.com
Hosts file: 127.0.0.55    tomcoyote.org
Hosts file: 127.0.0.56    unwantedlinks.com
Hosts file: 127.0.0.57    webattack.com
Hosts file: 127.0.0.58    wilders.org
Hosts file: 127.0.0.59    www.auditmypc.com
Hosts file: 127.0.0.60    www.bulletproofsoft.net
Hosts file: 127.0.0.61    www.cexx.org
Hosts file: 127.0.0.62    www.computercops.us
Hosts file: 127.0.0.63    www.ct7support.com
Hosts file: 127.0.0.64    www.doxdesk.com
Hosts file: 127.0.0.65    www.eblocs.com
Hosts file: 127.0.0.66    www.enigmasoftwaregroup.com
Hosts file: 127.0.0.67    www.free-spyware-scan.com
Hosts file: 127.0.0.68    www.free-web-browsers.com
Hosts file: 127.0.0.69    www.grc.com
Hosts file: 127.0.0.70    www.grisoft.com
Hosts file: 127.0.0.71    www.hackfaq.org
Hosts file: 127.0.0.72    www.hazeleger.net
Hosts file: 127.0.0.73    www.javacoolsoftware.com
Hosts file: 127.0.0.74    www.kellys-korner-xp.com
Hosts file: 127.0.0.75    www.kephyr.com
Hosts file: 127.0.0.76    www.lavasoft.de
Hosts file: 127.0.0.77    www.lavasoftusa.com
Hosts file: 127.0.0.78    www.lurkhere.com
Hosts file: 127.0.0.79    www.majorgeeks.com
Hosts file: 127.0.0.80    www.merijn.org
Hosts file: 127.0.0.81    www.mjc1.com
Hosts file: 127.0.0.82    www.moosoft.com
Hosts file: 127.0.0.83    www.mvps.org
Hosts file: 127.0.0.84    www.net-integration.net
Hosts file: 127.0.0.85    www.noadware.net
Hosts file: 127.0.0.86    www.no-spybot.com
Hosts file: 127.0.0.87    www.onlinepcfix.com
Hosts file: 127.0.0.88    www.pchell.com
Hosts file: 127.0.0.89    www.pestpatrol.com
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINDOWS\win.ini (615 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (231 bytes, A)

Når du kører CWShredder skal du klikke på fix, ikke på scan only.
Gør lige det, genstart og lav en ny Hijackthis log.

:O)
Undskylder hvis jeg ikke fik forklaret det godt nok, men som fromsej siger, skal du fixe det der bliver fundet :O)

hmm når jeg klikker på de links åbner det der isearch en ny side op hvor der ligesom er en søgeboks hvor adressen på linket stadig står... det ligner en prof side fra
firmaert i serach så skriver den DNS Error: Site Not Found

det virker som om den blokere for linket ?


DNS Error: Site Not Found
 

Search Our Popular Categories 
Gambling Relationships Travel
Blackjack, Betting, Online Casino, Slots, Poker, Bingo, Craps, Horse Racing, Sportsbook, Roulette … Online Dating, Divorce, Personals, Relationship Advice, Love, Dating Romance Sex … Airline Tickets, Hotel, Airfare, Cruises, Banner Car Rental Vacations Travel Agent …
 
E-Commerce Finance Auto
Web Hosting, Shopping Cart Internet, eBusiness, Web Site Design, Web Site Promotion, Shopping Cart … Credit Cards, Investing, Insurance, Stocks, Real Estate, Loan, Financial Services …
Auto Dealers, Car Financing, Car Insurance, Car Parts, New Cars, Used Cars, …

 
Entertainment Electronics Health
Gambling, Concert Tickets, Sportsbook, Movies, Television, MP3, Sports, Music, …
Cell Phones, Computers, Digital Camera, Laptops, MP3 Players, DVD Players … Weight Loss, Viagra, Online Drugstore, Nutrition, Health Care, Injuries, Hair Loss, Exercise …

--------------------------------------------------------------------------------

Home | Bookmark | Make this your Homepage | FAQ

her kommer så den nye log.. men det der i search er jeg ikke sluppet af med..

ttp://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows XP (5.01.2600 SP1)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\system32
AppData folder: C:\Documents and Settings\Thomas\Application Data
Username: Thomas

Found Hosts file: C:\WINDOWS\system32\drivers\etc\hosts (915 bytes, A)
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINDOWS\win.ini (615 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (231 bytes, A)

Ja der bliver blokeret....
Det er det isearch gør ;O)
Kom med en ny log fra hijackthis.....
Så fortæller jeg dig hvad der skal slettes...

tjaaa kan jo ikke åbne det link kan kun få cwshredder linket til at køre, har fundet et removal tool på google der har fjernet det der i serach men nu er jeg sku lidt nysgerrig på om der er andet spyware på min maskine og hvordan jeg forhindre det i fremtiden..

hmm fandt linket et andet sted loggen er som følger

Logfile of HijackThis v1.97.7
Scan saved at 22:09:05, on 27-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\valve\steam\steam.exe
C:\WINDOWS\System32\LVComS.exe
C:\Programmer\SEC\Natural Color\NaturalColorLoad.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Executive Software\Diskeeper\DkService.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\WinRAR\WinRAR.exe
C:\DOCUME~1\Thomas\LOKALE~1\Temp\Rar$EX00.969\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.edbpriser.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Highlight Zone II.lnk = C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38017.3710648148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Der er mere.
Jeg kommer med svar om 5 minutter ;O)

Først opretter du en mappe kun til hijackthis og lægger programmet derover.

Du skal nu til at i gang med at fixe. Allerførst skal du slå systemgendannelse fra. Hvis du ikke ved hvordan du gør det så kig her: http://www.arlet.dk/systemgendannelsen.htm derefter skal du åbne hijackthis. Du skal at sætte en vinge ud for disse filer jeg har skrevet nedeunder. Når du har gjort det så lukker du alle andre vinduer ned, det er meget vigtigt at det eneste vindue som er åbent er HijackThis vinduet. Klik på Fix checkede.

Her er de filer, du skal fixe:
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk

O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - Startup: PowerReg Scheduler.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} -

Genstart og giv mig en ny log, så jeg kan se om du er blevet helt ren.

Logfile of HijackThis v1.97.7
Scan saved at 22:47:44, on 27-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\ctfmon.exe
C:\valve\steam\steam.exe
C:\Programmer\SEC\Natural Color\NaturalColorLoad.exe
C:\WINDOWS\System32\LVComS.exe
C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Executive Software\Diskeeper\DkService.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\WinRAR\WinRAR.exe
C:\Documents and Settings\Thomas\Skrivebord\Ny mappe\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.edbpriser.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 127.0.0.9 doxdesk.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Highlight Zone II.lnk = C:\Programmer\Samsung\Highlight Zone II\Highlight.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38017.3710648148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

O1 - Hosts: 127.0.0.9 doxdesk.com
Denne mangler. Så er du ren
Når du har fixet den kan du godt slå systemgendannelsen til igen

så skulle det være gjort... men hvordan faaaaaen undgår man det sker igen ?
og tak for hjælpen forresten....

Du får lige et par artikler at læse på til imorgen ;O)
http://www.eksperten.dk/artikler/144
http://www.eksperten.dk/artikler/254
Og husk at gå forbi windows update jævnligt og sørg for at have ALLE sikkerhedsopdateringer.
Helvede bryder snart løs igen.
Efter at den sidste sikkerhedsopdatering er blevet frigivet, vil virusmagere forsøge at udnytte disse huller. Det er jo ikke alle der opdaterer. Og dem der ikke gør får virus. Ligesom med blaster...

Det var så lidt i øvrigt ;O)