Hvordan slipper man af med en trojaner

går lige af nettet og laver et scan med HijackThis

Logfile of HijackThis v1.98.2
Scan saved at 15:28:41, on 15-01-2004
Platform: Windows ME (Win9x 4.90.3000A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\COMMON\FSMA32.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\COMMON\FSMB32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\COMMON\FCH32.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\BACKWEB\7791805\PROGRAM\FSBWSYS.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\BACKWEB\7791805\PROGRAM\BACKWEB-7791805.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\COMMON\FAMEH32.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\ANTI-VIRUS\FSGK32.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\DFW\PROGRAM\FSDFWD.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\ANTI-VIRUS\FSSM32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAMMER\LEXMARK\PHOTO CARD READER\LXBLKSK.EXE
C:\PROGRAMMER\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
C:\WINDOWS\STARTUPMONITOR.EXE
C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\COMMON\FSM32.EXE
C:\PROGRAMMER\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAMMER\OPENOFFICE.ORG1.1.4\PROGRAM\SOFFICE.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAMMER\EMPTY TEMP FOLDERS 2.8.3\EMPRUN.EXE
C:\DOKUMENTER\HIJAK\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vuc-hilleroed.dk/intern
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cybercity.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = safeproxy.cybercity.dk:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAMMER\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [MemoryCardManager] C:\Programmer\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\LEXMARK\PHOTOC~1\LXBLKsk.exe
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [fsaa] C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\Common\fsaa.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\PROGRAMMER\WEBSPEED SIKKERHEDSPAKKE\Common\FSMA32.EXE
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAMMER\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Programmer\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: WebSpeed Sikkerhedspakke.lnk = C:\Programmer\WebSpeed Sikkerhedspakke\backweb\7791805\Program\backweb-7791805.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

Her er loggen så.

Den hedder Citifraud.A

prøv trojanhunter har selv programmet installeret,  og det har reddet mig flere gange, du kan få en 30 dages gratis trial version her, istallerer det og dobbeltklik på iconet nede ved uret og sæt flueben i automatically remove trojans, og tag derefter en full scan,

http://www.trojanhunter.com/products/TrojanHunter.exe

Husk lige at deaktivere systemgendannelse inden du scanner, og slå det til igen når du er færdig.

Har fundet ud af det. Den er fjernet