Vira som ikke vil væk

Følg vejledningen her:
Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker du Hijackthis og smider filen i en mappe, oprettet kun til den. Kør filen, scan, save log og kopier logfilen herind, så kigger vi på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Manual for installering af hijackthis:
http://www.spywarefri.dk/hijackthis.man.htm

Logfile of HijackThis v1.97.7
Scan saved at 13:26:49, on 19-05-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\programmer\powerstrip\pstrip.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\D-Tools\daemon.exe
C:\programmer\steam\steam.exe
C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe
C:\Programmer\SpeedFan\speedfan.exe
C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Ventrilo\Ventrilo.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xplayn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: 66.98.178.19 06272002-dbase.hitcountz.net
O1 - Hosts: 66.98.178.19 1ca.cqcounter.com
O1 - Hosts: 66.98.178.19 2001-007.com
O1 - Hosts: 66.98.178.19 ad-logics.com
O1 - Hosts: 66.98.178.19 ad.trafficmp.com
O1 - Hosts: 66.98.178.19 adclient.rottentomatoes.com
O1 - Hosts: 66.98.178.19 adcounter.globeandmail.com
O1 - Hosts: 66.98.178.19 adcounter.theglobeandmail.com
O1 - Hosts: 66.98.178.19 adlog.com.com
O1 - Hosts: 66.98.178.19 admanmail.com
O1 - Hosts: 66.98.178.19 ads.specificpop.com
O1 - Hosts: 66.98.178.19 adtech.de
O1 - Hosts: 66.98.178.19 askmen.thruport.com
O1 - Hosts: 66.98.178.19 banner.0catch.com
O1 - Hosts: 66.98.178.19 bilbo.counted.com
O1 - Hosts: 66.98.178.19 c1.statcounter.com
O1 - Hosts: 66.98.178.19 c1.thecounter.com
O1 - Hosts: 66.98.178.19 c2.gostats.com
O1 - Hosts: 66.98.178.19 c2.thecounter.com
O1 - Hosts: 66.98.178.19 c3.thecounter.com
O1 - Hosts: 66.98.178.19 c3.xxxcounter.com
O1 - Hosts: 66.98.178.19 cashcounter.com
O1 - Hosts: 66.98.178.19 cgi.hotstat.nl
O1 - Hosts: 66.98.178.19 clit6.sextracker.com
O1 - Hosts: 66.98.178.19 clit8.sextracker.com
O1 - Hosts: 66.98.178.19 cookies.cmpnet.com
O1 - Hosts: 66.98.178.19 counter.aaddzz.com
O1 - Hosts: 66.98.178.19 counter.bloke.com
O1 - Hosts: 66.98.178.19 counter.hitslink.com
O1 - Hosts: 66.98.178.19 counter.yadro.ru
O1 - Hosts: 66.98.178.19 counter14.sextracker.com
O1 - Hosts: 66.98.178.19 counter16.bravenet.com
O1 - Hosts: 66.98.178.19 counter17.bravenet.com
O1 - Hosts: 66.98.178.19 counter2.hitslink.com
O1 - Hosts: 66.98.178.19 counter26.bravenet.com
O1 - Hosts: 66.98.178.19 counter32.bravenet.com
O1 - Hosts: 66.98.178.19 counter34.breavenet.com
O1 - Hosts: 66.98.178.19 counter41.bravenet.com
O1 - Hosts: 66.98.178.19 counter47.bravenet.com
O1 - Hosts: 66.98.178.19 counter6.sextracker.com
O1 - Hosts: 66.98.178.19 counter8.bravenet.com
O1 - Hosts: 66.98.178.19 data.coremetrics.com
O1 - Hosts: 66.98.178.19 delivery.loopingclick.com
O1 - Hosts: 66.98.178.19 dwclick.com
O1 - Hosts: 66.98.178.19 ebay.doubleclick.net
O1 - Hosts: 66.98.178.19 ehg-amerix.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-bestbuy.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-crain.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-dig.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-eckounlimited.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-espn.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-idg.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-liveperson.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-oreilley.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-space.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-sportsline.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-techtarget.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-tigerdirect.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-uniontrib.hitbox.com
O1 - Hosts: 66.98.178.19 ehg-viacom.hitbox.com
O1 - Hosts: 66.98.178.19 ehg.commjun.hitbox.com
O1 - Hosts: 66.98.178.19 ehg.hitbox.com
O1 - Hosts: 66.98.178.19 fastclick.net
O1 - Hosts: 66.98.178.19 fcstats.bcentral.com
O1 - Hosts: 66.98.178.19 flycast.com
O1 - Hosts: 66.98.178.19 g-wizzads.net
O1 - Hosts: 66.98.178.19 gostats.com
O1 - Hosts: 66.98.178.19 gtcc1.acecounter.com
O1 - Hosts: 66.98.178.19 hc2.humanclick.com
O1 - Hosts: 66.98.178.19 hit2.hotlog.ru
O1 - Hosts: 66.98.178.19 hit37.chark.dk
O1 - Hosts: 66.98.178.19 hitbox.com
O1 - Hosts: 66.98.178.19 hits.webstat.com
O1 - Hosts: 66.98.178.19 images.dailydiscounts.com
O1 - Hosts: 66.98.178.19 imp.clickability.com
O1 - Hosts: 66.98.178.19 impacts.alliancehub.com
O1 - Hosts: 66.98.178.19 insightfirst.com
O1 - Hosts: 66.98.178.19 int.sitestat.com
O1 - Hosts: 66.98.178.19 jkearns.freestats.com
O1 - Hosts: 66.98.178.19 linktrack.bravenet.com
O1 - Hosts: 66.98.178.19 logs.comics.com
O1 - Hosts: 66.98.178.19 m1.nedstatbasic.net
O1 - Hosts: 66.98.178.19 media101.sitebrand.com
O1 - Hosts: 66.98.178.19 mediatrack.revenue.net
O1 - Hosts: 66.98.178.19 mt122.mtree.com
O1 - Hosts: 66.98.178.19 nedstat.s0.nl
O1 - Hosts: 66.98.178.19 nl.sitestat.com
O1 - Hosts: 66.98.178.19 partner.alerts.aol.com
O1 - Hosts: 66.98.178.19 paxito.sitetracker.com
O1 - Hosts: 66.98.178.19 perso.estat.com
O1 - Hosts: 66.98.178.19 pmg.ad-logics.com
O1 - Hosts: 66.98.178.19 postclick.adcentriconline.com
O1 - Hosts: 66.98.178.19 prof.estat.com
O1 - Hosts: 66.98.178.19 s10.sitemeter.com
O1 - Hosts: 66.98.178.19 s11.sitemeter.com
O1 - Hosts: 66.98.178.19 s12.sitemeter.com
O1 - Hosts: 66.98.178.19 s13.sitemeter.com
O1 - Hosts: 66.98.178.19 s14.sitemeter.com
O1 - Hosts: 66.98.178.19 s15.sitemeter.com
O1 - Hosts: 66.98.178.19 s16.sitemeter.com
O1 - Hosts: 66.98.178.19 s2.statcounter.com
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINDOWS\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3FB64CF5-D912-4AC0-A332-6488CE8E2F6E} - C:\WINDOWS\ih16.dll
O2 - BHO: (no name) - {433E3FCB-FCC3-4549-B8B3-DC0FEC487AF7} - C:\WINDOWS\uhnqyh.dll
O2 - BHO: (no name) - {44743975-5ADF-48F6-B6BF-1CAC9A8A9C3B} - C:\WINDOWS\mzvkOdptS.dll
O2 - BHO: (no name) - {5FA59C89-C67D-413A-9986-7EC702634A7B} - C:\WINDOWS\ubvcceutq.dll
O2 - BHO: (no name) - {63884347-374A-4576-8961-AE3DF2F2CA91} - C:\WINDOWS\opCfx.dll
O2 - BHO: (no name) - {8DF19963-138A-491A-8151-C1F2B1F27987} - C:\WINDOWS\ihrpqpee.dll
O2 - BHO: (no name) - {A8496533-3543-4731-BE7A-6D9D7F30DA17} - C:\WINDOWS\snS3SL.dll
O2 - BHO: (no name) - {AF5C1A63-0714-4D15-AF4A-40FBC6957D9A} - C:\WINDOWS\q762a7OOC.dll
O2 - BHO: (no name) - {E5E57C7D-4812-46A9-85CF-02C72177378E} - C:\WINDOWS\yC6d.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: FreeRAM XP Pro 1.40.lnk = C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe
O4 - Startup: Genvej til CoolBits.lnk = H:\Files\Random crap\lort\CoolBits.reg
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-p3.htm
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38007.2214814815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Hvis du har DAP installeret - så fjern det via Tilføj/fjern programmer.

Du skal nu i gang med at fixe, men først skal du lige have lidt indstruktion - gør følgende:

Flyt først filen HijackThis over i en mappe, oprettet KUN til den.

Åbn en mappe, klik i menuen på Funktioner => Mappeindstillinger => Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Deaktiver systemgendannelse. Hvis du ikke ved hvordan du gør det så kig her: http://www.spywarefri.dk/virus.htm#alle - derefter skal du åbne hijackthis.

Du får herunder nogle filer som du skal fixe og det du skal gøre er at sætte vinge ud for alle disse filer. IKKE FIXE ENDNU. Når du har gjort det så lukker du alle andre vinduer ned. Det er meget vigtigt, at det eneste vindue som er åbent er HijackThis vinduet. Husk også at lukke dette vindue (din Internet browser) når du har markeret filerne. Nu må du fixe. Klik på Fix chekede.

Her er de filer, du skal fixe :
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINDOWS\mslagent\4b_1,0,1,0_mslagent.dll (file missing)

ALLE 01 - Host: ..........

ALLE 02 - BHO: .........

O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

Disse kan jeg ikke finde oplysninger om - hvis du ikke kender dem, så fix:

O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe

Hvis du fixer de to skal du også finde og slette disse (skal gøres i fejlsikker tilstand <F8> under opstart:

C:\Programmer\mIRC 614\mirc.exe -> mappen <mIRC 614>
C:\Programmer\Ventrilo\Ventrilo.exe -> mappen <Ventrilo>

Derefter - Genstart - Ny log *S*

Logfile of HijackThis v1.97.7
Scan saved at 16:09:36, on 19-05-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xplayn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: Genvej til CoolBits.lnk = H:\Files\Random crap\lort\CoolBits.reg
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-p3.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38007.2214814815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Fix disse - derefter NY log *S*

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-p3.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm

Logfile of HijackThis v1.97.7
Scan saved at 21:42:15, on 19-05-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\programmer\powerstrip\pstrip.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\D-Tools\daemon.exe
C:\programmer\steam\steam.exe
C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe
C:\Programmer\SpeedFan\speedfan.exe
C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Ventrilo\Ventrilo.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: Genvej til CoolBits.lnk = H:\Files\Random crap\lort\CoolBits.reg
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38007.2214814815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Du er sku en m8 er du ;)

Har du husket at slå systemgendannelse fra ?
Disse er dukket op igen og skal fjernes fra fejlsikker tilstand:
C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Ventrilo\Ventrilo.exe

Disse her kan jeg heller ikke finde noget på, men jeg går ud fra, at det er et par freeware program du selv har installeret - ellers skal de lide samme skæbne som de to herover. - C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe
C:\Programmer\SpeedFan\speedfan.exe

Disse fixes med Hijackthis - gerne fra fejlsikker:
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe

Og disse hvis du sletter programmerne:
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe

Og EN GANG TIL - genstart og ny log.
HUSK LIGE AT DOBB. TJEKKE DENNE GANG, SÅ ALT KOMMER MED *S*

Venter på den (antageligt) sidste log *S*
Har så også lige opdaget, at du er ny bruger, så -
Velkommen på Eksperten ;o)

Bliv en GOD bruger - læs dette: Vejledning til nye brugere af Eksperten -
http://expfaq.1go.dk/
og evt. dette: Generelle regler for brugen af Eksperten -
http://www.eksperten.dk/regler.phtml

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe

Er legale.

Tak "fromsej" - hvor fandt du ud af det ?
Jeg har intet kunne finde om dem *S*

Så ser det sådan ud -

Har du husket at slå systemgendannelse fra ? ellers gør det !
Disse er dukket op igen og skal fjernes fra fejlsikker tilstand:
C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Ventrilo\Ventrilo.exe

Disse fixes med Hijackthis - gerne fra fejlsikker:
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe

Og antageligt for sidste gang - genstart og ny log.
HUSK LIGE AT DOBB. TJEKKE DENNE GANG, SÅ ALT KOMMER MED *S*

Jeg kender programmerne.
Det ene frigør ram, det andet kan regulere hastighed på blæseren(fan).*S*

De programmer du vil fjerne er nogen jeg bruger til diverse ting.
Speedfan - OC af CPU samt temp control.
mIRC - chat program.
FreeRAM XP Pro - til at frigøre ram.
Ventrilo - Lige som Team Speak / et snakke program prrm. til gameing.

Men ellers mange tak - det virker nu! :D

Lad os lige se den sidste log ;o)

Grunden til at jeg tog disse med igen var, at du jo fjernede dem her -
Kommentar: l3thal
19/05-2004 16:12:51

C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Ventrilo\Ventrilo.exe

Men som jeg sagde - hvis du kender dem er de vel ok *S*

Jeg vil også på det kraftigste anbefale dig, at få opdateret din Windows. Men inden du besøger WinUpdate skal du lige lukke DCOM.
Her finder du både en guide og et lille værktøj -
http://www.spywarefri.dk/tipsogtricks.htm

Se også denne artikel - http://www.eksperten.dk/artikler/144

Skal vi ikke se den næste log ?

Logfile of HijackThis v1.97.7
Scan saved at 07:17:24, on 08-06-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\programmer\powerstrip\pstrip.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\D-Tools\daemon.exe
C:\programmer\steam\steam.exe
C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe
C:\Programmer\SpeedFan\speedfan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\HLSW\hlsw_1_0_0_11-beta.exe
C:\Programmer\Ventrilo 2.2.0\Ventrilo.exe
C:\Programmer\Windows Media Player\wmplayer.exe
C:\Programmer\mIRC 614\mirc.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Programmer\framxpro\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: Genvej til CoolBits.lnk = H:\Files\Random crap\lort\CoolBits.reg
O4 - Startup: Kopi af SpeedFan.lnk = C:\Programmer\SpeedFan\speedfan.exe
O4 - Startup: mirc.lnk = C:\Programmer\mIRC 614\mirc.exe
O4 - Startup: Ventrilo.lnk = C:\Programmer\Ventrilo\Ventrilo.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28177.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38007.2214814815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

Du er ren nu og kan genaktivere din systemgendannelse.
Husk de opdateringer - du er alt for sårbar uden.

Hej L3thal - hvad med at få delt pointsene ud til Victor-1 ?? Har han ikke fortjent dem ??

Thorun