Hijack This log

Jeg snupper den, hvis du lige kopierer hele loggen herind *S*

Men jeg kan se, at du lige skal:

Hent og kør først CWShredder - slet ALT hvad programmet finder. HUSK at lukke alle andre ruder inden du kører programmet.
http://www.softpedia.com/public/cat/10/17/10-17-150.shtml

Derefter genstarter du og smider en ny logfil herind *S*

Logfile of HijackThis v1.98.2
Scan saved at 17:44:04, on 25-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\AppServ\Apache\Apache.exe
d:\AppServ\mysql\bin\mysqld-nt.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Appz\DU Meter\DUMeter.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
D:\appz\QuickTime\qttask.exe
C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
D:\appz\D-Tools\daemon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
C:\WINDOWS\System32\wuauclt.exe
C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
d:\appz\RealPlayer\RealPlay.exe
C:\Programmer\BullsEye Network\bin\bargains.exe
C:\WINDOWS\System32\knsjmxaj.exe
C:\docume~1\ejer\lokale~1\temp\msbb.exe
C:\Programmer\Common files\updater\wupdater.exe
d:\AppServ\Apache\Apache.exe
C:\documents and settings\ejer\lokale indstillinger\temp\l.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\System32\dp-him.exe
C:\WINDOWS\uptodate.exe
C:\WINDOWS\System32\wmnmsd.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\usbsw.exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
C:\Programmer\AdDestroyer\AdDestroyer.exe
C:\WINDOWS\System32\Qyr0w1A.exe
C:\WINDOWS\System32\Wzpd25sB.exe
C:\WINDOWS\System32\alrsvc45.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Programmer\Web_Rebates\WebRebates0.exe
C:\Programmer\CxtPls\CxtPls.exe
C:\Programmer\Web_Rebates\WebRebates1.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://best-search.cc/search.php?v=6&aff=5865638
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://best-search.cc/index.php?v=6&aff=5865638
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iwantsearch.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\Downloaded Program Files\rundlg32.dll
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\ATPART~1.DLL
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\Downloaded Program Files\rundlg32.dll
O2 - BHO: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll
O2 - BHO: Search404 Class - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - C:\Programmer\404Search\404Search.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINDOWS\System32\apuc.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - d:\appz\Advanced System Optimizer\IEHelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\Downloaded Program Files\rundlg32.dll
O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DU Meter] D:\Appz\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\appz\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\appz\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ubih] C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Programmer\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [dnixbst] C:\WINDOWS\System32\knsjmxaj.exe
O4 - HKLM\..\Run: [msbb] c:\docume~1\ejer\lokale~1\temp\msbb.exe
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [ivyhqbex] C:\WINDOWS\ivyhqbex.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [l] C:\documents and settings\ejer\lokale indstillinger\temp\l.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-him.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\DbhA2.exe
O4 - HKLM\..\Run: [7s9S3qP] wmnmsd.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [5c755e550231] C:\WINDOWS\System32\alrsvc45.exe
O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update13.js
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MBq2RkjpT] usbsw.exe
O4 - Startup: AdDestroyer.lnk = C:\Programmer\AdDestroyer\AdDestroyer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095201330500
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINDOWS\System32\xplugin.dll

den nye:


Logfile of HijackThis v1.98.2
Scan saved at 18:03:00, on 25-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
d:\AppServ\Apache\Apache.exe
d:\AppServ\mysql\bin\mysqld-nt.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Appz\DU Meter\DUMeter.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
D:\appz\QuickTime\qttask.exe
C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
D:\appz\D-Tools\daemon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
C:\Programmer\BullsEye Network\bin\bargains.exe
C:\WINDOWS\System32\knsjmxaj.exe
d:\AppServ\Apache\Apache.exe
C:\docume~1\ejer\lokale~1\temp\msbb.exe
C:\Programmer\Common files\updater\wupdater.exe
C:\WINDOWS\ivyhqbex.exe
C:\Programmer\Web_Rebates\WebRebates0.exe
C:\documents and settings\ejer\lokale indstillinger\temp\l.exe
C:\Programmer\CxtPls\CxtPls.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\uptodate.exe
C:\WINDOWS\System32\wmnmsd.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\System32\alrsvc45.exe
C:\WINDOWS\system32\pcs\pcsvc.exe
C:\Programmer\Common Files\Dpi\dpi.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\usbsw.exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
C:\Programmer\AdDestroyer\AdDestroyer.exe
C:\WINDOWS\System32\QzjK219.exe
C:\WINDOWS\System32\Jfm38U2.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Web_Rebates\WebRebates1.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\ATPART~1.DLL
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O2 - BHO: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll
O2 - BHO: Search404 Class - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - C:\Programmer\404Search\404Search.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINDOWS\System32\apuc.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - d:\appz\Advanced System Optimizer\IEHelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DU Meter] D:\Appz\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\appz\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\appz\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ubih] C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Programmer\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [dnixbst] C:\WINDOWS\System32\knsjmxaj.exe
O4 - HKLM\..\Run: [msbb] c:\docume~1\ejer\lokale~1\temp\msbb.exe
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [ivyhqbex] C:\WINDOWS\ivyhqbex.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [l] C:\documents and settings\ejer\lokale indstillinger\temp\l.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\DbhA2.exe
O4 - HKLM\..\Run: [7s9S3qP] wmnmsd.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [5c755e550231] C:\WINDOWS\System32\alrsvc45.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\Programmer\Common Files\Dpi\dpi.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MBq2RkjpT] usbsw.exe
O4 - Startup: AdDestroyer.lnk = C:\Programmer\AdDestroyer\AdDestroyer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: SirSearch - file://C:\Programmer\PWRSMND1\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095201330500
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab

Hold da ferie. Der er lidt af hvert *s*

victor-1 > go for it :)

Hejsa - kunne efter min sidste kommentar her i går, ikke længere oprette forbindelse til Internettet, men er nu på igen og så hurtigt det er muligt, vende tilbage her.
Så må vi se, om vi kan få rydet lidt op i den log.
Kigger på den med det samme *S*

Yep "tonnybrandt" -> får måske brug for lidt hjælp *S*

victor-1 > Helt iorden, men jeg er nok desværre først på igen iaften *s*

Det er godt nok en ordentlig omgang - hvor i alverdens riger og lande har du dog raget alt det skidt til dig ?
Print om muligt nedenstående ud.

Hent denne Kaspersky scanner og gem den - du skal bruge den senere. Det er ligegyldigt, hvilket af de syv links du vælger.
http://www.mwti.net/antivirus/free_utilities.asp - Virusscanner.

Følg derefter nedenstående:

Afbryd din forbindelse til Internettet -> FYSISK (stikket ud)

Du skal nu i gang med at fixe, men først skal du lige have lidt instruktion - gør følgende:
Åbn en mappe, klik i menuen på Funktioner => Mappeindstillinger => Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Deaktiver systemgendannelse. Hvis du ikke ved hvordan du gør det så kig her: http://www.spywarefri.dk/virus.htm#alle - derefter skal du åbne HijackThis.
Du får herunder nogle filer som du skal fixe og det du skal gøre er, at sætte vinge ud for alle disse filer - DOBBELTCHECK SÅ ALT KOMMER MED. Når du har gjort det så lukker du alle andre vinduer ned. Det er meget vigtigt, at det eneste vindue som er åbent er HijackThis vinduet. Husk også at lukke dette vindue (din Internet browser) når du har markeret filerne. Nu må du fixe. Klik på <Fix cheked>.

Her er de filer, du skal fixe :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm

R3 - Default URLSearchHook is missing

O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\ATPART~1.DLL
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O2 - BHO: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll
O2 - BHO: Search404 Class - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - C:\Programmer\404Search\404Search.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINDOWS\System32\apuc.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - d:\appz\Advanced System Optimizer\IEHelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll

O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A3FA-F161A787AD2D} - C:\Programmer\PowerSearch\Toolbar\pwrsmnd1\pwrsmnd1.dll

O4 - HKLM\..\Run: [QuickTime Task] "D:\appz\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ubih] C:\documents and settings\ejer\lokale indstillinger\temp\ubih.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Programmer\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [dnixbst] C:\WINDOWS\System32\knsjmxaj.exe
O4 - HKLM\..\Run: [msbb] c:\docume~1\ejer\lokale~1\temp\msbb.exe
O4 - HKLM\..\Run: [updater] C:\Programmer\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [ivyhqbex] C:\WINDOWS\ivyhqbex.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [l] C:\documents and settings\ejer\lokale indstillinger\temp\l.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\DbhA2.exe
O4 - HKLM\..\Run: [7s9S3qP] wmnmsd.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [5c755e550231] C:\WINDOWS\System32\alrsvc45.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\Programmer\Common Files\Dpi\dpi.exe
O4 - HKCU\..\Run: [MBq2RkjpT] usbsw.exe
O4 - Startup: AdDestroyer.lnk = C:\Programmer\AdDestroyer\AdDestroyer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O8 - Extra context menu item: SirSearch - file://C:\Programmer\PWRSMND1\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab

Derefter Genstarter du i fejlsikret tilstand (fejlsikret tilstand kommer du i, ved at trykke på <F8> når maskinen starter op, lige inden den begynder at indlæse Windows)

Find følgende filer/mapper i Stifinder og slet dem.

C:\WINDOWS\ivyhqbex.exe -> FILEN
C:\WINDOWS\twaintec.dll -> FILEN
C:\WINDOWS\2_0_1browserhelper2.dll -> FILEN
C:\WINDOWS\alchem.exe -> FILEN
C:\WINDOWS\uptodate.exe -> FILEN

C:\WINDOWS\system32\pcs -> MAPPEN

C:\WINDOWS\System32\bridge.dll -> FILEN
C:\WINDOWS\System32\nvms.dll -> FILEN
C:\WINDOWS\System32\mscb.dll -> FILEN
C:\WINDOWS\System32\apuc.dll -> FILEN
C:\WINDOWS\System32\msbe.dll -> FILEN
C:\WINDOWS\System32\ATPART~1.DLL -> FILEN
C:\WINDOWS\System32\bridge.dll -> FILEN
C:\WINDOWS\System32\knsjmxaj.exe -> FILEN
C:\WINDOWS\System32\IEHost.exe -> FILEN
C:\WINDOWS\System32\DbhA2.exe -> FILEN
C:\WINDOWS\System32\wmnmsd.exe -> FILEN
C:\WINDOWS\System32\alrsvc45.exe -> FILEN
C:\WINDOWS\System32\QzjK219.exe -> FILEN
C:\WINDOWS\System32\Jfm38U2.exe -> FILEN
C:\WINDOWS\System32\usbsw.exe -> FILEN

C:\Programmer\CxtPls -> MAPPEN
C:\Programmer\PowerSearch -> MAPPEN
C:\Programmer\404Search -> MAPPEN
C:\Programmer\PowerSearch -> MAPPEN
C:\Programmer\Common files\updater -> MAPPEN
C:\Programmer\BullsEye Network -> MAPPEN
C:\Programmer\Web_Rebates -> MAPPEN
C:\Program Files\AutoUpdate -> MAPPEN
C:\Programmer\Common Files\Dpi -> MAPPEN
C:\Programmer\AdDestroyer -> MAPPEN

Tøm så din "Temp" mappe som du finder her -> C:\documents and settings\ejer\lokale indstillinger\TEMP

Genstart igen i fejlsikker og kør den virusscanner du hentede før. Sæt flueben/prik så den scanner så meget som muligt og lad den køre helt færdigt. Det kan sagtens ta' et par timer.

Derefter genstarter du normalt, kører HijackThis, scanner, gemmer loggen og kopierer indholdet herind.

Så er google blevet victor-1´s ven*GH*

Til gengæld husker han, i modsætning til andre, at slette filerne også.

den nye log:


Logfile of HijackThis v1.98.2
Scan saved at 22:37:03, on 26-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\AppServ\Apache\Apache.exe
d:\AppServ\mysql\bin\mysqld-nt.exe
d:\AppServ\Apache\Apache.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Appz\DU Meter\DUMeter.exe
D:\appz\D-Tools\daemon.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\wmnmsd.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\Wzpd25sB.exe
C:\WINDOWS\System32\Jfm38U2.exe
C:\WINDOWS\System32\wpabaln.exe
D:\Appz\Teamspeak2_RC2\TeamSpeak.exe
D:\Appz\mIRC\mirc.exe
D:\Gamez\Steam\Steam.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notpad.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DU Meter] D:\Appz\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\appz\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\JceJ6ZX.exe
O4 - HKLM\..\Run: [wpljjd] C:\WINDOWS\System32\knsjmxaj.exe
O4 - HKLM\..\Run: [7s9S3qP] wmnmsd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095201330500

Det gjorde jo unægteligt loggen lidt mere overskuelig *S*

Fix nedenstående med HijackThis:

O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\JceJ6ZX.exe
O4 - HKLM\..\Run: [wpljjd] C:\WINDOWS\System32\knsjmxaj.exe
O4 - HKLM\..\Run: [7s9S3qP] wmnmsd.exe

Genstart i fejlsikker <F8> -> find og slet:

C:\WINDOWS\System32\JceJ6ZX.exe -> FILEN
C:\WINDOWS\System32\knsjmxaj.exe -> FILEN
C:\WINDOWS\System32\wmnmsd.exe -> FILEN
C:\WINDOWS\System32\Wzpd25sB.exe -> FILEN
C:\WINDOWS\System32\Jfm38U2.exe -> FILEN
C:\WINDOWS\System32\wpabaln.exe -> FILEN
C:\WINDOWS\system32\notpad.exe -> FILEN  (den rigtige hedder - notEpad.exe)

Genstart normalt - og kopier en ny, frisk log herind tak *S*
Jeg er også meget interesseret i at høre, hvad du oplever ved alt dette *S*

Min pc kørte på 1% af hvad den kunne ellers :)

Logfile of HijackThis v1.98.2
Scan saved at 23:58:27, on 26-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\AppServ\Apache\Apache.exe
d:\AppServ\mysql\bin\mysqld-nt.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Appz\DU Meter\DUMeter.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
D:\appz\D-Tools\daemon.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
d:\AppServ\Apache\Apache.exe
C:\WINDOWS\System32\aticonfg.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\pndorier.exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
D:\Appz\GetRight\getright.exe
C:\WINDOWS\System32\Qyr0w1A.exe
C:\WINDOWS\System32\Qyr0w1A.exe
C:\Programmer\CxtPls\CxtPls.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DU Meter] D:\Appz\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\appz\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [7s9S3qP] aticonfg.exe
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\Rydo84k.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MBq2RkjpT] pndorier.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = D:\Appz\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - D:\Appz\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - D:\Appz\GetRight\GRbrowse.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095201330500

Vi fortsætter.

Hent først disse to programmer:
CWShredder - http://www.softpedia.com/progDownload/CWShredder-Download-8114.html
Ad-Aware - http://www.freewarepro.com/download.php?categoryid=70&fileid=43

Opret en mappe på dit skrivebord til CWShredder og flyt filen dertil.
Installer Ad-Aware på normal vis og opdater programmet -> luk det derefter.

Genstart i fejlsikker, afbryd netforbindelsen fysisk (stikket ud), luk alle vinduer og kør først CWShredder - slet ALT hvad programmet finder.

Kør nu HijackThis, scan og fix det af nedenstående du kan se:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [7s9S3qP] aticonfg.exe
O4 - HKLM\..\Run: [4JATK3@4#AJHRM] C:\WINDOWS\System32\Rydo84k.exe
O4 - HKCU\..\Run: [MBq2RkjpT] pndorier.exe

Find og slet følgende - stadig fra fejlsikker:
C:\Programmer\CxtPls -> MAPPEN
C:\Program Files\AutoUpdate -> MAPPEN
C:\WINDOWS\System32\aticonfg.exe -> FILEN
C:\WINDOWS\System32\Rydo84k.exe -> FILEN
C:\WINDOWS\System32\pndorier.exe -> FILEN
C:\WINDOWS\System32\Qyr0w1A.exe -> FILEN

Kør Ad-Aware til sidst og stadig fra fejlsikker - fjern alt hvad programmet finder.

Genstart normalt, kør HijackThis, scan og ny log herind *S*

Logfile of HijackThis v1.98.2
Scan saved at 02:31:49, on 26-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\AppServ\Apache\Apache.exe
d:\AppServ\mysql\bin\mysqld-nt.exe
D:\appz\Trend Micro\Internet Security\Tmntsrv.exe
D:\appz\Trend Micro\Internet Security\tmproxy.exe
d:\AppServ\Apache\Apache.exe
D:\appz\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Appz\DU Meter\DUMeter.exe
D:\appz\D-Tools\daemon.exe
D:\appz\QuickTime\qttask.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
D:\appz\Trend Micro\Internet Security\pccguide.exe
D:\appz\Trend Micro\Internet Security\PCClient.exe
D:\appz\Trend Micro\Internet Security\TMOAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
D:\Appz\GetRight\getright.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt\hijackthis.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Programmer\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DU Meter] D:\Appz\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\appz\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "D:\appz\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [pccguide.exe] "D:\appz\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "D:\appz\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "D:\appz\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programmer\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = D:\Appz\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - D:\Appz\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - D:\Appz\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095201330500

Så vidt jeg kan bedømme, er din log nu ren *S*

Disse to kan du med fordel slå fra via MSCONFIG, så de ikke starter op sammen med Windows, da de blot sluger unødvendige kræfter. De kan altid nås fra Start > Programmer.

O4 - HKLM\..\Run: [QuickTime Task] "D:\appz\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot

Start > Kør > skriv MSCONFIG og tryk Enter.
Vælg fanebladet Start find de to herover, fjern flueben ud for dem, vælg Ok og genstart.

Du skal da også lige ha' et par gode råd med på vejen, så du fremover kan færdes sikkert og trygt på Internettet, da det ofte er her man får snavs og skidt på pc'en, uden at ane det.

Jeg anbefaler:
Antivirus - http://free.grisoft.com/freeweb.php
Firewall - http://tdconline.tucows.com/adnload/213160_90233.html

Antispyware:
http://www.spywarefri.dk/vaerktoj.htm#spybot
http://www.spywarefri.dk/vaerktoj.htm#spywareguard
http://www.spywarefri.dk/vaerktoj.htm#spywareblaster
http://www.spywarefri.dk/vaerktoj.htm#iespyad

Med de programmer er du så godt som usårlig, hvis de holdes opdaterede og bruges rigtigt *S*

Et par virkelig gode artikler om emnet:
http://www.eksperten.dk/artikler/254
http://www.eksperten.dk/artikler/144

Held og lykke fremover *S*

Du skal også huske genaktivere din systemgendannelse, samt sætte dine mappeindstillinger tilbage til standard.

syntes du har gjort meget så vil godt give dig 100point ekstra :) http://www.eksperten.dk/spm/544236

Takker mange gange for point ;o)

Har lagt en kommentar her - http://www.eksperten.dk/spm/544236