Enormt cpu-brug

Det sker tit at noget spyware stjæler din CPU kapacitet - har du tjekket din computer for dette?

--
pacroon

Lad os se, hvad en HijackThis-log viser.

Hent Spybot og HijackThis:
http://www.spywarefri.dk/vaerktoj.htm

Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer og genstart.

Derefter kører du Hijackthis > Scan > Save log. Kopier logfilen herind, så kigger vi på den.
Lad være med at slette noget selv med Hijackthis, vi skal nok hjælpe med at tyde loggen.

Her er logfilen:

Logfile of HijackThis v1.98.2
Scan saved at 21:26:22, on 22-08-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\WINDOWS\SM1BG.EXE
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\wpar.exe
C:\WINDOWS\iivolo.exe
C:\WINDOWS\hjspg.exe
C:\WINDOWS\xeklytxih.exe
C:\WINDOWS\mzoe.exe
C:\WINDOWS\ubeybj.exe
C:\WINDOWS\lydbr.exe
C:\WINDOWS\skxfoyc.exe
C:\WINDOWS\ucypeb.exe
C:\WINDOWS\padkqcrt.exe
C:\WINDOWS\zmymxrwjn.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\uxcnmy.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: jimmyhelp.CBrowserHelper - {56CD34C8-D465-485B-A918-5FFDD68EB760} - C:\WINDOWS\iwbnz.dll
O2 - BHO: VCS3IESupport Class - {B9D6B3C2-09AD-464A-8162-8C55114C808A} - C:\Programmer\Voice changer\Vcs3RT.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AntiPopupBar - {7B509F0F-BBCC-4347-A6D1-C6AD0DCC7EB9} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [vcs3demo] C:\PROGRA~1\VOICEC~1\Vcs3Cmd.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [yjxustsr] C:\WINDOWS\wpar.exe
O4 - HKLM\..\Run: [sndqtpk] C:\WINDOWS\iivolo.exe
O4 - HKLM\..\Run: [souvwaq] C:\WINDOWS\hjspg.exe
O4 - HKLM\..\Run: [jociicn] C:\WINDOWS\xeklytxih.exe
O4 - HKLM\..\Run: [hkpi] C:\WINDOWS\mzoe.exe
O4 - HKLM\..\Run: [nwwfrpfsw] C:\WINDOWS\ubeybj.exe
O4 - HKLM\..\Run: [ofeshnagr] C:\WINDOWS\lydbr.exe
O4 - HKLM\..\Run: [wyuofky] C:\WINDOWS\skxfoyc.exe
O4 - HKLM\..\Run: [ucegoydwj] C:\WINDOWS\ucypeb.exe
O4 - HKLM\..\Run: [ugyriewfe] C:\WINDOWS\padkqcrt.exe
O4 - HKLM\..\Run: [dabehiar] C:\WINDOWS\zmymxrwjn.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [fuwtljrv] C:\WINDOWS\uxcnmy.exe
O4 - HKCU\..\Run: [Steam] C:\Programmer\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\StyleXP\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra button: Toggle AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O9 - Extra 'Tools' menuitem: &AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=e11f81d403f922ab6eeb4f5c8ccb3aa3c8595d8b6c90ed7883f261ebdcc609589f1f4e6430ce48a8511d8f55cd103fccbd63035f5c10b22b76e72ee2c1ad21:ec2c14f0540d4a37a01b1231e42bb95f
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://216.65.38.226/crack.CAB

hov, jeg havde glemt at genstarte, ved ik om det har nogen betydning men her er den!

Logfile of HijackThis v1.98.2
Scan saved at 21:35:23, on 22-08-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\WINDOWS\SM1BG.EXE
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
C:\Programmer\ICQLite\ICQLite.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\wpar.exe
C:\WINDOWS\iivolo.exe
C:\WINDOWS\hjspg.exe
C:\WINDOWS\xeklytxih.exe
C:\WINDOWS\mzoe.exe
C:\WINDOWS\ubeybj.exe
C:\WINDOWS\lydbr.exe
C:\WINDOWS\skxfoyc.exe
C:\WINDOWS\ucypeb.exe
C:\WINDOWS\padkqcrt.exe
C:\WINDOWS\zmymxrwjn.exe
C:\WINDOWS\uxcnmy.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Installere til småprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: jimmyhelp.CBrowserHelper - {56CD34C8-D465-485B-A918-5FFDD68EB760} - C:\WINDOWS\iwbnz.dll
O2 - BHO: VCS3IESupport Class - {B9D6B3C2-09AD-464A-8162-8C55114C808A} - C:\Programmer\Voice changer\Vcs3RT.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AntiPopupBar - {7B509F0F-BBCC-4347-A6D1-C6AD0DCC7EB9} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [vcs3demo] C:\PROGRA~1\VOICEC~1\Vcs3Cmd.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [yjxustsr] C:\WINDOWS\wpar.exe
O4 - HKLM\..\Run: [sndqtpk] C:\WINDOWS\iivolo.exe
O4 - HKLM\..\Run: [souvwaq] C:\WINDOWS\hjspg.exe
O4 - HKLM\..\Run: [jociicn] C:\WINDOWS\xeklytxih.exe
O4 - HKLM\..\Run: [hkpi] C:\WINDOWS\mzoe.exe
O4 - HKLM\..\Run: [nwwfrpfsw] C:\WINDOWS\ubeybj.exe
O4 - HKLM\..\Run: [ofeshnagr] C:\WINDOWS\lydbr.exe
O4 - HKLM\..\Run: [wyuofky] C:\WINDOWS\skxfoyc.exe
O4 - HKLM\..\Run: [ucegoydwj] C:\WINDOWS\ucypeb.exe
O4 - HKLM\..\Run: [ugyriewfe] C:\WINDOWS\padkqcrt.exe
O4 - HKLM\..\Run: [dabehiar] C:\WINDOWS\zmymxrwjn.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [fuwtljrv] C:\WINDOWS\uxcnmy.exe
O4 - HKCU\..\Run: [Steam] C:\Programmer\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\StyleXP\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra button: Toggle AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O9 - Extra 'Tools' menuitem: &AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=e11f81d403f922ab6eeb4f5c8ccb3aa3c8595d8b6c90ed7883f261ebdcc609589f1f4e6430ce48a8511d8f55cd103fccbd63035f5c10b22b76e72ee2c1ad21:ec2c14f0540d4a37a01b1231e42bb95f
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://216.65.38.226/crack.CAB

Hent værktøjet About:Buster lavet af Rubber Ducky.
http://tools.zerosrealm.com/AboutBuster.zip
Opret en mappe på dit skrivebord, og pak About:Buster ud i denne mappe.

Hent og installer denne engangsskanner fra Kaspersky: http://www.mwti.net/download/tools/mwav.exe

Hent: http://www.spywarefri.dk/vaerktoj.htm#emptytemp
Og læs manualen til opsætning af programmet her:
http://www.spywarefri.dk/emptytempfolders.manual.htm

Slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør det, så kig her: http://www.spywarefri.dk/virusscannere.htm#alle

Tag computeren af Nettet – stikket fysisk ud.
Deaktiver dine sikkerhedsprogrammer (virusprogram, Spybot m.m.)

Brug "Taskmanager/procesliste" (Ctrl+Alt+Del) til at afslutte følgende processer, hvis
du kan finde dem:

C:\WINDOWS\iwbnz.dll

C:\WINDOWS\wpar.exe
C:\WINDOWS\iivolo.exe
C:\WINDOWS\hjspg.exe
C:\WINDOWS\xeklytxih.exe
C:\WINDOWS\mzoe.exe
C:\WINDOWS\ubeybj.exe
C:\WINDOWS\lydbr.exe
C:\WINDOWS\skxfoyc.exe
C:\WINDOWS\ucypeb.exe
C:\WINDOWS\padkqcrt.exe
C:\WINDOWS\zmymxrwjn.exe
C:\WINDOWS\uxcnmy.exe

Herunder er der nogle filer, som du skal fixe. Sæt en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned.

Fix disse med HijackThis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank

R3 - Default URLSearchHook is missing

O2 - BHO: jimmyhelp.CBrowserHelper - {56CD34C8-D465-485B-A918-5FFDD68EB760} - C:\WINDOWS\iwbnz.dll

O3 - Toolbar: AntiPopupBar - {7B509F0F-BBCC-4347-A6D1-C6AD0DCC7EB9} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll

O4 - HKLM\..\Run: [yjxustsr] C:\WINDOWS\wpar.exe
O4 - HKLM\..\Run: [sndqtpk] C:\WINDOWS\iivolo.exe
O4 - HKLM\..\Run: [souvwaq] C:\WINDOWS\hjspg.exe
O4 - HKLM\..\Run: [jociicn] C:\WINDOWS\xeklytxih.exe
O4 - HKLM\..\Run: [hkpi] C:\WINDOWS\mzoe.exe
O4 - HKLM\..\Run: [nwwfrpfsw] C:\WINDOWS\ubeybj.exe
O4 - HKLM\..\Run: [ofeshnagr] C:\WINDOWS\lydbr.exe
O4 - HKLM\..\Run: [wyuofky] C:\WINDOWS\skxfoyc.exe
O4 - HKLM\..\Run: [ucegoydwj] C:\WINDOWS\ucypeb.exe
O4 - HKLM\..\Run: [ugyriewfe] C:\WINDOWS\padkqcrt.exe
O4 - HKLM\..\Run: [dabehiar] C:\WINDOWS\zmymxrwjn.exe

O4 - HKLM\..\Run: [fuwtljrv] C:\WINDOWS\uxcnmy.exe

O9 - Extra button: Toggle AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll
O9 - Extra 'Tools' menuitem: &AntiPopupBar toolbar - {C0BDAEA1-B461-487D-88A9-B1C1D4AD930B} - C:\Programmer\AntiPopupBar Toolbar\AntiPopupBar.dll

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=e11f81d403f922ab6eeb4f5c8ccb3aa3c8595d8b6c90ed7883f261ebdcc609589f1f4e6430ce48a8511d8f55cd103fccbd63035f5c10b22b76e72ee2c1ad21:ec2c14f0540d4a37a01b1231e42bb95f
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://216.65.38.226/crack.CAB

----
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
----

Genstart i fejlsikret tilstand (F8 i opstart).  Find og slet filerne:

C:\WINDOWS\iwbnz.dll

C:\WINDOWS\wpar.exe
C:\WINDOWS\iivolo.exe
C:\WINDOWS\hjspg.exe
C:\WINDOWS\xeklytxih.exe
C:\WINDOWS\mzoe.exe
C:\WINDOWS\ubeybj.exe
C:\WINDOWS\lydbr.exe
C:\WINDOWS\skxfoyc.exe
C:\WINDOWS\ucypeb.exe
C:\WINDOWS\padkqcrt.exe
C:\WINDOWS\zmymxrwjn.exe
C:\WINDOWS\uxcnmy.exe

og
C:\Programmer\AntiPopupBar Toolbar\ >>>> mappen AntiPopupBar Toolbar

Nu lukker du ALLE vinduer. Find den mappe hvori du lagde About:Buster og Kør programmet.

Brug derefter EmptyTempFolders til at rydde op i computerens Temp filer.

Tag også en tur med engangsscanneren mwav.exe – aktiver så den scanner mest muligt.

Genstart normalt, Nettet på igen og kom med en ny log fra HijackThis – tak. Husk at genaktivere dine sikkerhedsprogrammer.

Vigtigt: Du mangler at få opdateret Windows og IE med Service Pack 1 m.m. Besøg Windows Update!

Tak for hjælpen, her er den nye log:

Logfile of HijackThis v1.98.2
Scan saved at 22:22:47, on 23-08-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\WINDOWS\SM1BG.EXE
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
C:\Programmer\ICQLite\ICQLite.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\Steam\Steam.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Installere til småprogrammer\hijackthis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: VCS3IESupport Class - {B9D6B3C2-09AD-464A-8162-8C55114C808A} - C:\Programmer\Voice changer\Vcs3RT.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [vcs3demo] C:\PROGRA~1\VOICEC~1\Vcs3Cmd.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [Steam] C:\Programmer\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\StyleXP\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

Det har du gjort godt ;-) Loggen er faktisk ren for direkte snavs.

Bare lidt oprydning tilbage.
Du kan fixe disse med HijackThis:

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

Herefter må du slå systemgendannelse til igen og sætte mappeindstillinger tilbage til oprindelige indstillinger.

Hvis du ikke allerede har Ad-Aware, så hent og installer programmet. Opdater det straks efter installationen - inden du kører en scanning. Fjern alt hvad programmet finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware

Her er et link til sikker surfing: http://www.spywarefri.dk/pakken.htm

Jeg vil kraftigt anbefale, at du får opdateret Windows og IE med Service Pack 1 m.m. Besøg Windows Update: http://v4.windowsupdate.microsoft.com/da/default.asp

Hjalp "kuren"?

Tusind tak for hjælpen, jeg troede sq efterhånden at formatering var den sidste udvej!!

Dermed er spørgsmålet lukket!

Velbekomme ;-)