Internet LANGTSOM

Start lige med at fortælle os hvilken forbindelse du har!

Har du en opdateret antivirusscanner ??

Hvordan kan du se din ping mens din computer er slukket?

Tjek evt. spyware www.spywarefri.dk

Jeg har 2000/256 og det plejer at køre fint.
Jeg har den nyeste version af min virus skanner Antivir og ad-aware

ducks : vi har flere computere som jeg sagde kan tjekke pingen på en anden

okis, jeg skyder på at du alligevel har noget snavs på din pc.. Prøv at smide en hijackthis log herind

Så er det nok din computer, der kommunikerer kraftigt med andre maskiner på Internettet.

Personligt ville jeg sætte en pakke sniffer op, og se hvilken traffik, der er mellem din PC og "resten af verdenen".

Brug ex. ethereal - den er gratis og god.

Ups - det skulle altså bare have været en kommentar :-)

Jeg bruger Spy Sweeper istedet for ad-aware da den finder langt mere. Men prøv at gøre som bennyn siger.

Ok her kommer den.

Logfile of HijackThis v1.97.7
Scan saved at 16:47:01, on 21-09-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\STOPzilla!\szntsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\securitychk.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
C:\Programmer\STOPzilla!\Stopzilla.exe
C:\Programmer\Creative\PC-CAM Center\CAMTRAY.EXE
C:\Programmer\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\System32\systemll.exe
C:\WINDOWS\System32\taskman.exe
C:\WINDOWS\System32\Systmesy.exe
C:\Programmer\Netropa\Multimedia Keyboard\TrayMon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE
C:\Programmer\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Spil\Steam\Steam.exe
C:\WINDOWS\System32\svpmsgr.exe
C:\WINDOWS\system32\cmd.exe
C:\Programmer\Internet Explorer\iexplore.exe
E:\Mark\Virus\Merijn\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [STOPzilla] "C:\Programmer\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [bdhek] C:\WINDOWS\System32\bdhek.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\PC-CAM Center\CAMTRAY.EXE
O4 - HKLM\..\Run: [ommc] C:\WINDOWS\System32\ommc.exe
O4 - HKLM\..\Run: [bdpok] C:\WINDOWS\System32\bdpok.exe
O4 - HKLM\..\Run: [irectXD] C:\WINDOWS\System32\irectXD.exe
O4 - HKLM\..\Run: [SFLEX3V] C:\WINDOWS\System32\SFLEX3V.exe
O4 - HKLM\..\Run: [ashlpri] C:\WINDOWS\System32\ashlpri.exe
O4 - HKLM\..\Run: [astapir] C:\WINDOWS\System32\astapir.exe
O4 - HKLM\..\Run: [cpmont] C:\WINDOWS\System32\cpmont.exe
O4 - HKLM\..\Run: [DBHOH] C:\WINDOWS\System32\DBHOH.exe
O4 - HKLM\..\Run: [hsvcss] C:\WINDOWS\System32\hsvcss.exe
O4 - HKLM\..\Run: [ICHTX32R] C:\WINDOWS\System32\ICHTX32R.exe
O4 - HKLM\..\Run: [ll_qicm] C:\WINDOWS\System32\ll_qicm.exe
O4 - HKLM\..\Run: [prmsgm] C:\WINDOWS\System32\prmsgm.exe
O4 - HKLM\..\Run: [serinitu] C:\WINDOWS\System32\serinitu.exe
O4 - HKLM\..\Run: [updmgrw] C:\WINDOWS\System32\updmgrw.exe
O4 - HKLM\..\Run: [vwrsengn] C:\WINDOWS\System32\vwrsengn.exe
O4 - HKLM\..\Run: [embioso] C:\WINDOWS\System32\embioso.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmer\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [PCTVRemote] C:\Programmer\Pinnacle\PCTV Stereo\Remote\Remoterm.exe
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\ppe.exe
O4 - HKLM\..\Run: [3d8thkd] C:\WINDOWS\System32\3d8thkd.exe
O4 - HKLM\..\Run: [_950c] C:\WINDOWS\System32\_950c.exe
O4 - HKLM\..\Run: [ABCTL32T] C:\WINDOWS\System32\ABCTL32T.exe
O4 - HKLM\..\Run: [asradi] C:\WINDOWS\System32\asradi.exe
O4 - HKLM\..\Run: [dbccp32o] C:\WINDOWS\System32\dbccp32o.exe
O4 - HKLM\..\Run: [etunameg] C:\WINDOWS\System32\etunameg.exe
O4 - HKLM\..\Run: [gav] C:\WINDOWS\System32\gav.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [le32o] C:\WINDOWS\System32\le32o.exe
O4 - HKLM\..\Run: [lsfuncn] C:\WINDOWS\System32\lsfuncn.exe
O4 - HKLM\..\Run: [mgrq] C:\WINDOWS\System32\mgrq.exe
O4 - HKLM\..\Run: [mvcorew] C:\WINDOWS\System32\mvcorew.exe
O4 - HKLM\..\Run: [ompobjc] C:\WINDOWS\System32\ompobjc.exe
O4 - HKLM\..\Run: [omuidc] C:\WINDOWS\System32\omuidc.exe
O4 - HKLM\..\Run: [PWIZDLLW] C:\WINDOWS\System32\PWIZDLLW.exe
O4 - HKLM\..\Run: [scdllc] C:\WINDOWS\System32\scdllc.exe
O4 - HKLM\..\Run: [schdprfp] C:\WINDOWS\System32\schdprfp.exe
O4 - HKLM\..\Run: [shr] C:\WINDOWS\System32\shr.exe
O4 - HKLM\..\Run: [srfaxau] C:\WINDOWS\System32\srfaxau.exe
O4 - HKLM\..\Run: [tdlln] C:\WINDOWS\System32\tdlln.exe
O4 - HKLM\..\Run: [tr13nL] C:\WINDOWS\System32\tr13nL.exe
O4 - HKLM\..\Run: [trio13nL] C:\WINDOWS\System32\trio13nL.exe
O4 - HKLM\..\Run: [vrsskn] C:\WINDOWS\System32\vrsskn.exe
O4 - HKLM\..\Run: [cxpntn] C:\WINDOWS\System32\cxpntn.exe
O4 - HKLM\..\Run: [FC70CHSM] C:\WINDOWS\System32\FC70CHSM.exe
O4 - HKLM\..\Run: [yncapps] C:\WINDOWS\System32\yncapps.exe
O4 - HKLM\..\Run: [hmedias] C:\WINDOWS\System32\hmedias.exe
O4 - HKLM\..\Run: [mpshellw] C:\WINDOWS\System32\mpshellw.exe
O4 - HKLM\..\Run: [sbeziers] C:\WINDOWS\System32\sbeziers.exe
O4 - HKLM\..\Run: [Windows OEM Tools] winres32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] systemll.exe
O4 - HKLM\..\Run: [Windows servict] tskdll.exe
O4 - HKLM\..\Run: [Task Manager] taskman.exe
O4 - HKLM\..\Run: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKLM\..\Run: [Systmesy] Systmesy.exe
O4 - HKLM\..\Run: [Services] c:\blagh.exe
O4 - HKLM\..\Run: [svpmsgr] C:\WINDOWS\System32\svpmsgr.exe
O4 - HKLM\..\RunServices: [Windows OEM Tools] winres32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] systemll.exe
O4 - HKLM\..\RunServices: [Windows servict] tskdll.exe
O4 - HKLM\..\RunServices: [Task Manager] taskman.exe
O4 - HKLM\..\RunServices: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKLM\..\RunServices: [Systmesy] Systmesy.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpywareGuard] C:\WINDOWS\system32\winproc32.exe
O4 - HKCU\..\Run: [WhatPulse] C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE
O4 - HKCU\..\Run: [Gadwin PrintScreen 2.6] C:\Programmer\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [Steam] C:\Spil\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [AIM] C:\Programmer\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Windows OEM Tools] winres32.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] systemll.exe
O4 - HKCU\..\Run: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKCU\..\Run: [Systmesy] Systmesy.exe
O4 - HKLM\..\RunOnce: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKCU\..\RunOnce: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Pinnacle Scheduler.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .mdz: C:\Programmer\Internet Explorer\Plugins\npmod32.dll
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/adobe/MTSInstallers/MetaStream3.cab?url=http://www.eriksahl.dk/foto/fotogalleri/konfirm/nanna/ThumbnailFrame.html
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab28578.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095712982202
O16 - DPF: {68459DB3-59C9-449D-815B-65F729385C16} (VoiceSecure Control) - http://www.voice4web.com/vs.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/sv/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38122.1515046296
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab28578.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab

Du har ikke opdateret dit Windows XP til SP1/SP2.
Det er ikke så godt, for så er du ikke sikret mod mange af de vira, der suser rundt på nettet og kigger efter uopdaterede maskiner.
Du kan hente SP1/SP2 her:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/

Så skal du hente en opdateringspakke med sikkerhedsopdateringer.
Det gør du her:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D531BF00-D7BE-48E3-ABCC-961602BD72C2&displaylang=da

Til sidst skal du gå i start ->programmer ->Windowsupdate og lade din maskine scanne for opdateringer. Installer dem du får anbefalet.

Du har MEGET snavs i din log.

Hent Spybot og nyeste HijackThis:
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer og genstart.

Hent denne scanner:
http://www.mwti.net/antivirus/free_utilities.asp
Det er ligegyldigt hvilken af de 7 mirrors du bruger. Programmet er det samme.
Inde i opsætningen sætter du den til at scanne alt.
Kør scanneren UDEN INTERNET TILSLUTTET.

Kom med en ny log, når du har gjort ovenstående.

Derefter vil jeg lade en HiJackThis 'freak/specialist' se på loggen...

PS: Hvis du/I har flere computerer som du skriver skal samme procedure nok gennemføres der også !!!

Logfile of HijackThis v1.97.7
Scan saved at 18:21:33, on 21-09-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\securitychk.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Creative\PC-CAM Center\CAMTRAY.EXE
C:\Programmer\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmer\Pinnacle\PCTV Stereo\Remote\Remoterm.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE
C:\Programmer\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Programmer\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Spil\Steam\Steam.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\winres32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe
E:\Mark\Virus\Merijn\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [STOPzilla] "C:\Programmer\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [bdhek] C:\WINDOWS\System32\bdhek.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\PC-CAM Center\CAMTRAY.EXE
O4 - HKLM\..\Run: [ommc] C:\WINDOWS\System32\ommc.exe
O4 - HKLM\..\Run: [bdpok] C:\WINDOWS\System32\bdpok.exe
O4 - HKLM\..\Run: [irectXD] C:\WINDOWS\System32\irectXD.exe
O4 - HKLM\..\Run: [SFLEX3V] C:\WINDOWS\System32\SFLEX3V.exe
O4 - HKLM\..\Run: [ashlpri] C:\WINDOWS\System32\ashlpri.exe
O4 - HKLM\..\Run: [astapir] C:\WINDOWS\System32\astapir.exe
O4 - HKLM\..\Run: [cpmont] C:\WINDOWS\System32\cpmont.exe
O4 - HKLM\..\Run: [DBHOH] C:\WINDOWS\System32\DBHOH.exe
O4 - HKLM\..\Run: [hsvcss] C:\WINDOWS\System32\hsvcss.exe
O4 - HKLM\..\Run: [ICHTX32R] C:\WINDOWS\System32\ICHTX32R.exe
O4 - HKLM\..\Run: [ll_qicm] C:\WINDOWS\System32\ll_qicm.exe
O4 - HKLM\..\Run: [prmsgm] C:\WINDOWS\System32\prmsgm.exe
O4 - HKLM\..\Run: [serinitu] C:\WINDOWS\System32\serinitu.exe
O4 - HKLM\..\Run: [updmgrw] C:\WINDOWS\System32\updmgrw.exe
O4 - HKLM\..\Run: [vwrsengn] C:\WINDOWS\System32\vwrsengn.exe
O4 - HKLM\..\Run: [embioso] C:\WINDOWS\System32\embioso.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmer\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [PCTVRemote] C:\Programmer\Pinnacle\PCTV Stereo\Remote\Remoterm.exe
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\ppe.exe
O4 - HKLM\..\Run: [3d8thkd] C:\WINDOWS\System32\3d8thkd.exe
O4 - HKLM\..\Run: [_950c] C:\WINDOWS\System32\_950c.exe
O4 - HKLM\..\Run: [ABCTL32T] C:\WINDOWS\System32\ABCTL32T.exe
O4 - HKLM\..\Run: [asradi] C:\WINDOWS\System32\asradi.exe
O4 - HKLM\..\Run: [dbccp32o] C:\WINDOWS\System32\dbccp32o.exe
O4 - HKLM\..\Run: [etunameg] C:\WINDOWS\System32\etunameg.exe
O4 - HKLM\..\Run: [gav] C:\WINDOWS\System32\gav.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [le32o] C:\WINDOWS\System32\le32o.exe
O4 - HKLM\..\Run: [lsfuncn] C:\WINDOWS\System32\lsfuncn.exe
O4 - HKLM\..\Run: [mgrq] C:\WINDOWS\System32\mgrq.exe
O4 - HKLM\..\Run: [mvcorew] C:\WINDOWS\System32\mvcorew.exe
O4 - HKLM\..\Run: [ompobjc] C:\WINDOWS\System32\ompobjc.exe
O4 - HKLM\..\Run: [omuidc] C:\WINDOWS\System32\omuidc.exe
O4 - HKLM\..\Run: [PWIZDLLW] C:\WINDOWS\System32\PWIZDLLW.exe
O4 - HKLM\..\Run: [scdllc] C:\WINDOWS\System32\scdllc.exe
O4 - HKLM\..\Run: [schdprfp] C:\WINDOWS\System32\schdprfp.exe
O4 - HKLM\..\Run: [shr] C:\WINDOWS\System32\shr.exe
O4 - HKLM\..\Run: [srfaxau] C:\WINDOWS\System32\srfaxau.exe
O4 - HKLM\..\Run: [tdlln] C:\WINDOWS\System32\tdlln.exe
O4 - HKLM\..\Run: [tr13nL] C:\WINDOWS\System32\tr13nL.exe
O4 - HKLM\..\Run: [trio13nL] C:\WINDOWS\System32\trio13nL.exe
O4 - HKLM\..\Run: [vrsskn] C:\WINDOWS\System32\vrsskn.exe
O4 - HKLM\..\Run: [cxpntn] C:\WINDOWS\System32\cxpntn.exe
O4 - HKLM\..\Run: [FC70CHSM] C:\WINDOWS\System32\FC70CHSM.exe
O4 - HKLM\..\Run: [yncapps] C:\WINDOWS\System32\yncapps.exe
O4 - HKLM\..\Run: [hmedias] C:\WINDOWS\System32\hmedias.exe
O4 - HKLM\..\Run: [mpshellw] C:\WINDOWS\System32\mpshellw.exe
O4 - HKLM\..\Run: [sbeziers] C:\WINDOWS\System32\sbeziers.exe
O4 - HKLM\..\Run: [Windows OEM Tools] winres32.exe
O4 - HKLM\..\Run: [Windows servict] tskdll.exe
O4 - HKLM\..\Run: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKLM\..\Run: [Systmesy] Systmesy.exe
O4 - HKLM\..\Run: [Services] c:\blagh.exe
O4 - HKLM\..\Run: [Microsoft Registry] csrse.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] systemll.exe
O4 - HKLM\..\Run: [sdmod] C:\WINDOWS\System32\sdmod.exe
O4 - HKLM\..\RunServices: [Windows OEM Tools] winres32.exe
O4 - HKLM\..\RunServices: [Windows servict] tskdll.exe
O4 - HKLM\..\RunServices: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKLM\..\RunServices: [Systmesy] Systmesy.exe
O4 - HKLM\..\RunServices: [Microsoft Registry] csrse.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] systemll.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WhatPulse] C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE
O4 - HKCU\..\Run: [Gadwin PrintScreen 2.6] C:\Programmer\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [Steam] C:\Spil\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [Windows OEM Tools] winres32.exe
O4 - HKCU\..\Run: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKCU\..\Run: [Systmesy] Systmesy.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Microsoft Registry] csrse.exe
O4 - HKCU\..\Run: [AIM] C:\Programmer\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Microsoft Update Machine] systemll.exe
O4 - HKLM\..\RunOnce: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - HKCU\..\RunOnce: [Microsoft Secure Messenger.NET Service] securitychk.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Pinnacle Scheduler.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .mdz: C:\Programmer\Internet Explorer\Plugins\npmod32.dll
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/adobe/MTSInstallers/MetaStream3.cab?url=http://www.eriksahl.dk/foto/fotogalleri/konfirm/nanna/ThumbnailFrame.html
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab28578.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095712982202
O16 - DPF: {68459DB3-59C9-449D-815B-65F729385C16} (VoiceSecure Control) - http://www.voice4web.com/vs.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/sv/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38122.1515046296
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab28578.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab

Har du rullet pakkerne som beskrevet?
Se også: 21/09-2004 18:00:05 !!!

Du må IKKE installere SP2 før du har fået fjernet alt dit spyware, ellers risikerer du at det går helt galt og du skal formatere. Med alt det du har på din computer, vil jeg anbefale enten at vente til en der kan analysere loggen kommer forbi. Eller smide den ind på www.spywarefri.dk/forum

Først vil jeg lige sige tak til dem som har prøvet at hjælpe mig, men jeg har formaterede computeren fordi der var så meget rod i den, så lav lige nogle svar beskeder så i kan få nogle points

Det kunne være smart hvis du havde sakset SP2 på et passende medie FØR formatering. Og så lægge den ind FØR det 'farlige' internet kommer på - altså selve netværksstikket UD!!!

[IT-Avisen: Ubeskyttede pc’er holder i 20 minutter]:
http://www.itavisen.dk/index.php/news/show/id=7596

Goor Luck... Velkommen en anden gang...

PS: Du skriver flere computerer - mon ikke de andre har (lidt af) samme problem(mer) ???

Prøv spywareblaster. Det hjælper.

Tak for POINT - næsten for meget med 200.

PS: Du skriver flere computerer - mon ikke de andre har (lidt af) samme problem(mer) ???