Ad-Aware måske årsagen?

Download hijackthis herfra og gem det i en folder for sig selv på dit skrivebord
http://downloadportal.dk/showdownload.asp?rid=4212&sp=Hijackthis
eller
http://www.downloadportal.dk/showdownload.asp?rid=4234&sp=title

Start programmet og vælge, at udføre en scan samt gemme en log fil.
Når hijackthis er færdig med, at scanne vil den bede dig om en placering hvor du vil gemme "hijackthis" en tekst fil.
Gem den i samme folder som hijackthis. Når du har sagt okay hopper der et nyt vindue frem nemlig notepad med en masse tekst linjer. Marker alle linjerne og kopir dem herind så jeg kan kigge på dem. Du må ikke selv begynde, at fikse noget i hijackthis.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\hotkeysvc.exe
C:\WINDOWS\glnoq.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cthelper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\WinAce\WinAce.exe
C:\Program Files\WinAce\WinAce.exe
C:\Documents and Settings\Jacob.REDOUT01\Local Settings\Temp\HijackThis.exe

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CPQHotkeys] hotkeysvc.exe
O4 - HKLM\..\Run: [CTHelper] cthelper.exe
O4 - HKLM\..\Run: [<°ÜZîÝYMylY«õ°aÆ+À¼C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\glnoq.exe
O4 - HKLM\..\RunServices: [CPQHotkeys] hotkeysvc.exe
O4 - HKLM\..\RunServices: [CTHelper] cthelper.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CPQHotkeys] hotkeysvc.exe
O4 - HKCU\..\Run: [CTHelper] cthelper.exe
O4 - HKCU\..\RunServices: [CPQHotkeys] hotkeysvc.exe
O4 - HKCU\..\RunServices: [CTHelper] cthelper.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.bgbank.dk
O16 - DPF: {4C32D673-807E-4A54-84FC-83CDBADBAAA1} (AonWC_Comm Element) - http://www.groupcare.dk/video/All.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095870035328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {C56CE781-A6FC-4706-8B32-6EB4622155DF} (MediaConnect Control) - http://plugin.euro-infomedia.com/mpv0.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {F9408298-9658-482C-8B02-93F09A80225F} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0104.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~2\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Logfile of HijackThis v1.99.1
Scan saved at 16:47:30, on 07-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


og det lå lige over, sry

ser på den nu:)

Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.
Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer - klik "Fix checked":

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  O4 - HKLM\..\Run: [CPQHotkeys] hotkeysvc.exe
O4 - HKLM\..\Run: [<°ÜZîÝYMylY«õ°aÆ+À¼C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\glnoq.exe
O4 - HKLM\..\RunServices: [CPQHotkeys] hotkeysvc.exe
O4 - HKCU\..\Run: [CPQHotkeys] hotkeysvc.exe
O4 - HKCU\..\RunServices: [CPQHotkeys] hotkeysvc.exe

hvis du ikke kender denne
O16 - DPF: {C56CE781-A6FC-4706-8B32-6EB4622155DF} (MediaConnect Control) - http://plugin.euro-infomedia.com/mpv0.cab

Find og slet

Filer

C:\WINDOWS\system32\hotkeysvc.exe
C:\WINDOWS\glnoq.exe

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Slet alt den finder..

Genstart normalt og kopir en ny log herind så jeg kan se om vi fik det hele med eller om noget er blevet overset:)

Nå det tog sin tid, men her er d så:

Logfile of HijackThis v1.99.1
Scan saved at 23:54:36, on 07-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\cthelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jacob.REDOUT01\Desktop\down\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTHelper] cthelper.exe
O4 - HKLM\..\RunServices: [CTHelper] cthelper.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTHelper] cthelper.exe
O4 - HKCU\..\RunServices: [CTHelper] cthelper.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.bgbank.dk
O16 - DPF: {4C32D673-807E-4A54-84FC-83CDBADBAAA1} (AonWC_Comm Element) - http://www.groupcare.dk/video/All.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095870035328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {F9408298-9658-482C-8B02-93F09A80225F} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0104.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~2\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Hvis du vil have listen over aktioner virusprogrammet udførte, så er de her:

File C:\WINDOWS\glnoq.exe infected by "Trojan-Downloader.Win32.IstBar.hh" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\temp.exe tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\Documents and Settings\Jacob\Local Settings\Temporary Internet Files\Content.IE5\6ZYFM9Y7\schedule[1].htm tagged as not-a-virus:FalseAlarm.TrendMicro.Crasher. No Action Taken.
File C:\Documents and Settings\Jacob\Local Settings\Temporary Internet Files\Content.IE5\8DIFW5IF\oldsetlists[2].htm tagged as not-a-virus:FalseAlarm.TrendMicro.Crasher. No Action Taken.
File C:\Documents and Settings\Jacob.REDOUT01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-142a8c70.zip infected by "Trojan-Downloader.Java.OpenStream.t" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jacob.REDOUT01\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv68.jar-25bc6ef6-6d5e11bb.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jacob.REDOUT01\Local Settings\Temp\delwbi.tmp tagged as not-a-virus:RiskWare.Dialer.gen. No Action Taken.
File C:\Documents and Settings\Jacob.REDOUT01\Local Settings\Temp\fahKpYM.exe infected by "Trojan-Downloader.Win32.IstBar.hv" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jacob.REDOUT01\Local Settings\Temp\webrebates.exe tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
File C:\Documents and Settings\Martin\Local Settings\Temporary Internet Files\Content.IE5\7KQ4AYD2\pup[1].htm infected by "Trojan.JS.NoClose.c" Virus. Action Taken: File Deleted.
File C:\inns.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\innstal.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\Program Files\Mozilla Firefox\plugins\npWTHost.dll tagged as not-a-virus:AdWare.WildTangent.b. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1AE32965.zip infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1D747A13.zip infected by "Email-Worm.Win32.NetSky.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2B330511 tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\2B395909 tagged as not-a-virus:AdWare.BiSpy.m. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\2B3D0306 tagged as not-a-virus:AdWare.Gator.4010. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3D5F00D3 tagged as not-a-virus:PornWare.Dialer.WebDialer. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5E7A437F.wav infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\5EF74F0A.class infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\6D6002DB.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\719B0DBB.class infected by "Trojan.Java.ClassLoader.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7D74423B infected by "Trojan-Downloader.Win32.Dyfuca.bb" Virus. Action Taken: File Deleted.
File C:\Program Files\Preview AdService\PrevAdComm.dll tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\RECYCLER\NPROTECT\00013079. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00013786. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016505. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016506. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016507. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016508. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016509. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016510. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016511. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016512. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016513. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016514. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016515. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016516. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016517. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016518. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016519. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016520. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016712. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016713. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00016721. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121134. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121135. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121136. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121137. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121145. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121151. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121156. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00121157. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00965369. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\00965466. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01104033. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01104034. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01104035. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01104036. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01273353. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\RECYCLER\NPROTECT\01273405. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP148\A0043370.exe tagged as not-a-virus:AdWare.Trymedia.a. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP149\A0044442.EXE tagged as not-a-virus:AdWare.WildTangent.b. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP180\A0079676.EXE tagged as not-a-virus:AdWare.NavExcel. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP180\A0079677.EXE tagged as not-a-virus:AdWare.NavExcel.b. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP180\A0079680.EXE tagged as not-a-virus:AdWare.NavExcel.b. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP180\A0079681.EXE tagged as not-a-virus:AdWare.NavExcel. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP180\A0079683.dll tagged as not-a-virus:AdWare.NavExcel.f. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0102877.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0102991.dll infected by "Trojan-Downloader.Win32.IstBar.hf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0102992.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0102997.exe tagged as not-a-virus:AdWare.WebRebates.c. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0103031.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0103038.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP246\A0103043.pif infected by "IM-Worm.Win32.Kelvir.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103403.EXE tagged as not-a-virus:AdWare.Gator.2102. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103533.EXE tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103561.DLL tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103562.EXE infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103641.EXE tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103642.DLL tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103667.EXE tagged as not-a-virus:AdWare.WebRebates.d. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103669.EXE tagged as not-a-virus:AdWare.WebRebates.d. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103671.EXE tagged as not-a-virus:AdWare.WebRebates.c. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103706.EXE tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103707.EXE tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103742.exe infected by "Trojan-Downloader.Win32.Dyfuca.du" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103743.EXE tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103744.DLL tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103745.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103746.exe infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103747.dll infected by "Trojan-Downloader.Win32.IstBar.hf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103748.DLL infected by "Trojan-Downloader.Win32.IstBar.hf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103867.exe tagged as not-a-virus:AdWare.NavExcel.h. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103868.dll tagged as not-a-virus:AdWare.NavExcel.h. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103869.EXE tagged as not-a-virus:AdWare.NavExcel.h. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103870.EXE tagged as not-a-virus:AdWare.NavExcel.h. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP250\A0103872.dll infected by "Trojan-Downloader.Win32.Small.zq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP256\A0104169.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP257\A0104289.exe infected by "Trojan-Downloader.Win32.IstBar.hh" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP257\A0104290.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{7BD88DE0-67AB-4E2B-BDE8-4C6A58F624FA}\RP257\A0104291.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\temp.exe tagged as not-a-virus:AdWare.WinAD.ab. No Action Taken.
File C:\WINDOWS\wt\wtvh.dll tagged as not-a-virus:AdWare.WildTangent.b. No Action Taken.

og for god ordens skyld må jeg nok desværre informere at, jeg stadig ikke kan bruge MSN, Hotmail eller web messenger (som dog stadig kan nås ved hjælp af en proxy), mange tak for hjælpen alligevel dog, computeren kører hurtigere, og der er ikke tusind ubehagelige ting på den længere:)

Har du prøvet at slå firewall fra for at se om det gør en forskel?

Gå i fejlsikret tilstand.

Fix disse i hijackthis

O4 - HKLM\..\Run: [CTHelper] cthelper.exe
O4 - HKLM\..\RunServices: [CTHelper] cthelper.exe
O4 - HKCU\..\Run: [CTHelper] cthelper.exe
O4 - HKCU\..\RunServices: [CTHelper] cthelper.exe

Slet filen
C:\WINDOWS\system32\cthelper.exe

Genstart og se om ikke dette hjalp.

ok, det virkede, fandt godt nok ikke filen C:\WINDOWS\system32\cthelper.exe.

Men nu kan jeg komme på, ved ikke om hvem det var der gjorde udfaldet, og ved ikke om jeg kan give jer begge point.

hvis ikke håber jeg ikke du har noget imod at jeg giver dem til kalp, tonnybrandt

hmm har du fået pointene? er en ekspert noob, lol

Det har jeg:) mange tak for det:)