autoexec.nt

Prøv at kopiere C:\WINNT\REPAIR\autoexec.nt over i folderen C:\WINNT\SYSTEM32

Så burde det løse problemet, men da det er et symptom på at du har eller har haft spyware på din computer, vil det nok være en god ide at lægge en HiJackThis log herind:

Gå ind her og hent Hijackthis.
http://danborg.org/spy/HJT/hijackthis.exe
Kør Hijackthis, scan, save log og kopier logfilen herind, så kigger jeg på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Logfile of HijackThis v1.99.1
Scan saved at 21:00:12, on 04-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.exe
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\Programmer\Qualcomm\Eudora\Eudora.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\SKRIVEBORD\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadsUnlimited/ie/bridge-c337.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/PPInstaller.exe
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)
O20 - Winlogon Notify: URL - C:\WINNT\system32\k8pm0i71e8.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe


Måske var det bedre at lægge hende ned og fjerne formaterer drev C:

Jeg gjorde forresten som du skrev og nu virker det. Men det er fristende at trykke på Fix i Hijackthis :-)

Det skulle ikke være nødvendigt at formatere. Følg nedenstående vejledning:

1. Gå i Start -> Kør og skriv Services.msc

Se om du kan finde System Startup Service service på listen. Hvis du finder den - Højreklik på den og vælg Egenskaber - klik på "Stop" og vælg Starttype "Deaktiveret" - klik Anvend og OK. Luk service vinduet.

2. Kør HijackThis, scan og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadsUnlimited/ie/bridge-c337.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/PPInstaller.exe
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)
O20 - Winlogon Notify: URL - C:\WINNT\system32\k8pm0i71e8.dll
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe

Hvis du ikke selv har lagt disse i trusted zone, skal disse også fixes:
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com

3. Kør HijackThis, klik på Config, klik på Misc Tools, klik på "Delete an NT service" og skriv:

SvcProc i tekstfeltet og klik på OK.

4. Gå i Start -> Kør og skriv cmd. I dos-prompten skal du nu skrive:

del C:\WINDOWS\svcproc.exe (tast Enter)

cd C:\WINDOWS (tast Enter)

nail.exe /FullRemove (tast Enter)

Åbn herefter en stifinder og slet disse filer:
C:\WINNT\system32\k8pm0i71e8.dll
C:\WINNT\svcproc.exe
C:\WINNT\Nail.exe

5. Genstart computeren og læg en frisk HijackThis log herind.

Jeg har gjort som beskrevet, men jeg kan ikke få lov at slette C:\WINNT\system32\k8pm0i71e8.dll
Den lader til at være i brug.

Logfile of HijackThis v1.99.1
Scan saved at 00:09:53, on 05-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.exe
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O20 - Winlogon Notify: Explorer - C:\WINNT\system32\g804lidq180e.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Hmm.. det gik jo ikke særligt godt.

Prøv lige at downloade dette program.
http://home9.inet.tele.dk/le01/nail_remover.zip
Udpak det og dobbeltklik programmet. Det ser ud til at det blot skal installeres og at det derved udfører sin opgave.

Genstart normalt

Hent og pak dette program ud på dit Skrivebord.
http://www.fbeej.dk/Programmer/FindItNT2KXP.zip
Kør "find.bat" - programmet laver en log, som du også skal lægge herind, sammen med en log fra HiJackThis.

Warning!XP This utility will find legitimate files in addition to malware. 
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System32 Directory -------

Disken i drev C har ikke noget navn.
Diskens serienummer er 4CC7-BD93

Indhold af C:\WINNT\System32

05-05-2005  01:24              234.412 jIvaee.dll
05-05-2005  01:20              234.234 n64s0gh7e64.dll
05-05-2005  00:04              234.412 fp2403fqe.dll
01-05-2005  20:59      <DIR>          dllcache
25-04-2005  06:31              234.490 h22o0cf3ef2.dll
              4 fil(er)          937.548 byte
              1 mappe(r)  1.504.563.200 byte ledig

------- Hidden Files in System32 Directory -------

Disken i drev C har ikke noget navn.
Diskens serienummer er 4CC7-BD93

Indhold af C:\WINNT\System32

01-05-2005  20:59      <DIR>          dllcache
27-11-2004  19:23                  482 ws687525.ocx
30-06-2004  20:21              22.528 cleaner12.exe
08-05-2004  23:28      <DIR>          GroupPolicy
08-05-2004  23:15              21.765 folder.htt
08-05-2004  23:15                  271 desktop.ini
              4 fil(er)          45.046 byte
              2 mappe(r)  1.504.559.104 byte ledig

---------- Files Named "Guard" -------------

Disken i drev C har ikke noget navn.
Diskens serienummer er 4CC7-BD93

Indhold af C:\WINNT\System32


--------- Temp Files in System32 Directory --------

Disken i drev C har ikke noget navn.
Diskens serienummer er 4CC7-BD93

Indhold af C:\WINNT\System32

16-02-2000  02:00                2.660 CONFIG.TMP
              1 fil(er)            2.660 byte
              0 mappe(r)  1.504.559.104 byte ledig

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{04368899-E0A3-FD16-DEDE-89A0F30DAA5A}"=""


------------ Keys Under Notify ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\fp2403fqe.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


---------------- Xfind Results -----------------

C:\WINNT\System32\FP2403~1.DLL +++ File read error

-------------- Locate.com Results ---------------

C:\WINNT\SYSTEM32\
  fp2403~1.dll  Thu  5 May 2005  0.04.30  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  jivaee.dll    Thu  5 May 2005  1.24.40  ..S.R        234.412  228,92 K
  n64s0g~1.dll  Thu  5 May 2005  1.20.34  ..S.R        234.234  228,74 K

4 items found:  4 files, 0 directories.
  Total of file sizes:  937.548 bytes    915,57 K



Logfile of HijackThis v1.99.1
Scan saved at 01:42:49, on 05-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\fp2403fqe.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Ok, det nakkede da nail infektionen.

Den sidste infektion er en af dem der laver sig selv om med et nyt filnavn hele tiden.
Du må ikke slukke eller genstarte pc'en nu !!
Hvis du allerede har haft gjort det siden du lagde loggen fra find.bat, så læg en ny log ind med det samme. Jeg er på ½ time endnu.

Jeg går lige igang med et fix til dig ..

Åben Notepad/notesblokken, Kopier teksten i fed skrift (startende med REGEDIT4) ind i en tekstfil - gem filen på Skrivebordet som "Rens.reg" (i filtype skal du vælge Alle filer inden du trykker Gem). Find filen Rens.reg på skrivebordet og dobbeltklik på den - svar ja til at flette den ind i registreringsdatabasen. Genstart og kom med en ny HiJackThis log bagefter.

---------------
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{04368899-E0A3-FD16-DEDE-89A0F30DAA5A}"=-

Logfile of HijackThis v1.99.1
Scan saved at 02:37:24, on 05-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O20 - Winlogon Notify: RunOnceEx - C:\WINNT\system32\n64s0gh7e64.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Den er lidt træls. Vi prøver et andet program.

Hent FINDnFIX her:
http://www.xs4all.nl/~monkey1/filez/FINDnFIX.exe
Dobbeltklik på filen - den vil installere sig på din computer i C:\FINDnFIX
I mappen ligger der !LOG!.bat, som du skal dobbeltklikke på - der går nu lidt tid, mens den indhenter informationer - når den er færdig, lægges der en Log.txt i mappen. Kopier indholdet herind.

Da jeg er på vej i seng, kan du blot gå videre med næste trin uden at afvente mit svar ...

I keys1 mappen ligger der nu en fil der hedder FIX.bat - dobbeltklik på den. Computeren vil genstarte. Giv den tilladelse til at genstarte.

Åben FINDnFIX mappen igen - dobbeltklik på Restore.bat. Når den har kørt ligger der en logfil igen, der hedder Log2.txt - kopier indholdet herind i dit næste indlæg.

»»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»»
--The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder
and is the destination for the file to be moved..
-*Previous directions will no longer work...
»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»

Microsoft Windows 2000 [version 5.00.2195]
»»»IE build and last SP(s)
6.0.2600.0000
Filsystemtypen er NTFS.
C: er ikke ‘ndret.

to 05-05-2005
  6:38pm  up 0 days,  0:07

»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
You must know how to ID the file based on the filters provided in
the scan, as not all the files flagged are bad.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided should help narrow down the list, and hopefully
pinpoint the culprit.
Along with that,registry scan logged at the end should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
*For *Helpers/Mods and/or users that are not familiar with any of the
items on the scan results- I recommend using an alternative, once
you know what to look for!
»»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/12)»»»»»»»»»»»»»»»»

»»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»*

Scanning for file(s)...
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Locked or 'Suspect' file(s) found...

C:\WINNT\System32\FPL603~1.DLL +++ File read error
\\?\C:\WINNT\System32\FPL603~1.DLL +++ File read error

»»»»» (*2*) »»»»»........
**File C:\FINDnFIX\LIST.TXT

»»»»» (*3*) »»»»»........

C:\WINNT\SYSTEM32\
  fpl603~1.dll  Thu  5 May 2005  14.58.26  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  ijlogmsg.dll  Thu  5 May 2005  18.33.04  ..S.R        234.234  228,74 K
  r8r60i~1.dll  Thu  5 May 2005  2.50.24  ..S.R        234.234  228,74 K

4 items found:  4 files (4 H/S), 0 directories.
  Total of file sizes:  937.370 bytes    915,40 K

unknown/hidden files...

C:\WINNT\SYSTEM32\
  fpl603~1.dll  Thu  5 May 2005  14.58.26  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  ijlogmsg.dll  Thu  5 May 2005  18.33.04  ..S.R        234.234  228,74 K
  r8r60i~1.dll  Thu  5 May 2005  2.50.24  ..S.R        234.234  228,74 K

4 items found:  4 files, 0 directories.
  Total of file sizes:  937.370 bytes    915,40 K

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\FPL603~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\H22O0C~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\IJLOGMSG.DLL
Sniffed -> C:\WINNT\SYSTEM32\R8R60I~1.DLL

»»»»»(*5*)»»»»»
**File C:\WINNT\SYSTEM32\DLLXXX.TXT
¯ Access denied ® ..................... FPL603~1.DLL  ....234412  05.05.2005 
¯ Access denied ® ..................... IJLOGMSG.DLL  ....234234  05.05.2005 
¯ Access denied ® ..................... R8R60I~1.DLL  ....234234  05.05.2005 

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...


No matches found.

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.


»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 398

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout    SZ    15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota    DWORD    00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler    SZ    yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk    SZ   
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout    SZ    90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota    DWORD    00002710

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710

  »»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI)    ALLOW  Read            BUILTIN\Brugere
(IO)    ALLOW  Read            BUILTIN\Brugere
(NI)    ALLOW  Read            BUILTIN\Superbrugere
(IO)    ALLOW  Read            BUILTIN\Superbrugere
(NI)    ALLOW  Full access     BUILTIN\Administratorer
(IO)    ALLOW  Full access     BUILTIN\Administratorer
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(NI)    ALLOW  Full access     BUILTIN\Administratorer
(IO)    ALLOW  Full access     CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read              BUILTIN\Brugere
Read              BUILTIN\Superbrugere
Full access      BUILTIN\Administratorer
Full access      NT AUTHORITY\SYSTEM


»»Member of...: (Admin logon required!)
User is a member of group JULIE\Ingen.
User is a member of group \Alle.
User is a member of group BUILTIN\Administratorer.
User is a member of group BUILTIN\Brugere.
User is a member of group NT AUTHORITY\INTERAKTIV.
User is a member of group NT AUTHORITY\Godkendte brugere.
User is a member of group \LOKAL.


»»»»»»Backups created...»»»»»»
  6:40pm  up 0 days,  0:08
to 05-05-2005

A          C:\FINDnFIX\keyback.hiv
--a--    -  -  -              -  -      8,192 05-05-2005 keyback.hiv
A          C:\FINDnFIX\keys1\winkey.reg
--a--    -  -  -              -  -        268 05-05-2005 winkey.reg

C:\FINDNFIX\
  JUNKXXX        Thu  5 May 2005  18.38.52  .D...        <Dir>

1 item found:  0 files, 1 directory.

»»Performing string scan....
00001150:                        ?                                     
00001190:                                            H  x             
000011D0:    vk                  DeviceNotSelectedTimeout    1 5       
00001210:8  p      vk      '          GDIProcessHandleQuota      vk 
00001250:    h          Spooler    y e s          vk                 
00001290:swapdisk    vk                  TransmissionRetryTimeout    9 0
000012D0:            vk      '          USERProcessHandleQuota         
00001310:C                                                             
00001350:                                                               
00001390:                `      `                                     
000013D0:                                                               
00001410:                                                               
00001450:                                                               
00001490:                                                               
000014D0:                                                               
00001510:                                                               
00001550:                                                               
00001590:                                                               
000015D0:                                                               

---------- WIN.TXT
--------------
--------------
No strings found.

--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710




Kan du eventuelt også fortælle mig hvad det er der gør, at hvergang jeg søger mød google, så popper der også en side op, der hedder spotresults.com.


»»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»»
--The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder
and is the destination for the file to be moved..
-*Previous directions will no longer work...
»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»

Microsoft Windows 2000 [version 5.00.2195]
»»»IE build and last SP(s)
6.0.2600.0000
Filsystemtypen er NTFS.
C: er ikke ‘ndret.

to 05-05-2005
  6:46pm  up 0 days,  0:04

»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
You must know how to ID the file based on the filters provided in
the scan, as not all the files flagged are bad.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided should help narrow down the list, and hopefully
pinpoint the culprit.
Along with that,registry scan logged at the end should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
*For *Helpers/Mods and/or users that are not familiar with any of the
items on the scan results- I recommend using an alternative, once
you know what to look for!
»»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/12)»»»»»»»»»»»»»»»»

»»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»*

Scanning for file(s)...
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Locked or 'Suspect' file(s) found...

C:\WINNT\System32\FPL603~1.DLL +++ File read error
\\?\C:\WINNT\System32\FPL603~1.DLL +++ File read error

»»»»» (*2*) »»»»»........
**File C:\FINDnFIX\LIST.TXT

»»»»» (*3*) »»»»»........

C:\WINNT\SYSTEM32\
  fpl603~1.dll  Thu  5 May 2005  14.58.26  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  lvj809~1.dll  Thu  5 May 2005  18.43.32  ..S.R        235.231  229,71 K
  wicsvc.dll    Thu  5 May 2005  18.43.32  ..S.R        234.412  228,92 K

4 items found:  4 files (4 H/S), 0 directories.
  Total of file sizes:  938.545 bytes    916,55 K

unknown/hidden files...

C:\WINNT\SYSTEM32\
  fpl603~1.dll  Thu  5 May 2005  14.58.26  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  lvj809~1.dll  Thu  5 May 2005  18.43.32  ..S.R        235.231  229,71 K
  wicsvc.dll    Thu  5 May 2005  18.43.32  ..S.R        234.412  228,92 K

4 items found:  4 files, 0 directories.
  Total of file sizes:  938.545 bytes    916,55 K

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\FPL603~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\H22O0C~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\LVJ809~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\WICSVC.DLL

»»»»»(*5*)»»»»»
**File C:\WINNT\SYSTEM32\DLLXXX.TXT
¯ Access denied ® ..................... FPL603~1.DLL  ....234412  05.05.2005 
¯ Access denied ® ..................... LVJ809~1.DLL  ....235231  05.05.2005 
¯ Access denied ® ..................... WICSVC.DLL    ....234412  05.05.2005 

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...


No matches found.

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.


»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout    SZ    15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota    DWORD    00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler    SZ    yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk    SZ   
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout    SZ    90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota    DWORD    00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs    SZ   

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710
    AppInit_DLLs =

  »»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW  Read            Alle
(ID-IO) ALLOW  Read            Alle
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  QWCEN-DS--      BUILTIN\Superbrugere
(ID-IO) ALLOW  QWCEN-DS--      BUILTIN\Superbrugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read              Alle
Read              BUILTIN\Brugere
QWCEN-DS--        BUILTIN\Superbrugere
Full access      BUILTIN\Administratorer
Full access      NT AUTHORITY\SYSTEM


»»Member of...: (Admin logon required!)
User is a member of group JULIE\Ingen.
User is a member of group \Alle.
User is a member of group BUILTIN\Administratorer.
User is a member of group BUILTIN\Brugere.
User is a member of group NT AUTHORITY\INTERAKTIV.
User is a member of group NT AUTHORITY\Godkendte brugere.
User is a member of group \LOKAL.


»»»»»»Backups created...»»»»»»
  6:47pm  up 0 days,  0:05
to 05-05-2005

A          C:\FINDnFIX\keyback.hiv
--a--    -  -  -              -  -      8,192 05-05-2005 keyback.hiv
A          C:\FINDnFIX\keys1\winkey.reg
--a--    -  -  -              -  -        268 05-05-2005 winkey.reg

C:\FINDNFIX\
  JUNKXXX        Thu  5 May 2005  18.38.52  .D...        <Dir>

1 item found:  0 files, 1 directory.

»»Performing string scan....
00001150:                        ?                                     
00001190:                                            H  x             
000011D0:    vk                  DeviceNotSelectedTimeout    1 5       
00001210:8  p      vk      '          GDIProcessHandleQuota      vk 
00001250:    h          Spooler    y e s          vk                 
00001290:swapdisk    vk                  TransmissionRetryTimeout    9 0
000012D0:            vk      '          USERProcessHandleQuota         
00001310:C                                                             
00001350:                                                               
00001390:                `      `                                     
000013D0:                                                               
00001410:                                                               
00001450:                                                               
00001490:                                                               
000014D0:                                                               
00001510:                                                               
00001550:                                                               
00001590:                                                               
000015D0:                                                               

---------- WIN.TXT
--------------
--------------
No strings found.

--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710



Har du kørt den sidste del af proceduren ?

"I keys1 mappen ligger der nu en fil der hedder FIX.bat - dobbeltklik på den. Computeren vil genstarte. Giv den tilladelse til at genstarte.

Åben FINDnFIX mappen igen - dobbeltklik på Restore.bat. Når den har kørt ligger der en logfil igen, der hedder Log2.txt - kopier indholdet herind i dit næste indlæg."

Den sidste log ligner log.txt og ikke log2.txt, som burde se lidt anderledes ud.

»»»»»»»»»»»»»»»»»»*** freeatlast100.100free.com ***»»»»»»»»»»»»»»»»

fr 06-05-2005
  2:13am  up 0 days,  0:02

Microsoft Windows 2000 [version 5.00.2195]
»»»IE build and last SP(s)
6.0.2600.0000
Filsystemtypen er NTFS.
C: er ikke ‘ndret.

»»»»»»»»»»»»»»»»»»***LOG1!***»»»»»»»»»»»»»»»»

This log will confirm if the file was successfully moved, and/or the right file was selected.

Scanning for file(s) in System32...

»»»»»»» (1) »»»»»»»
\\?\C:\WINNT\System32\DVCTL.DLL +++ File read error
C:\WINNT\System32\DVCTL.DLL +++ File read error

»»»»»»» (2) »»»»»»»
**File C:\FINDnFIX\LIST.TXT

»»»»»»» (3) »»»»»»»

C:\WINNT\SYSTEM32\
  dvctl.dll      Fri  6 May 2005  2.12.22  ..S.R        235.231  229,71 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  k8440i~1.dll  Fri  6 May 2005  2.10.36  ..S.R        234.412  228,92 K
  lvj809~1.dll  Thu  5 May 2005  18.43.32  ..S.R        235.231  229,71 K

4 items found:  4 files (4 H/S), 0 directories.
  Total of file sizes:  939.364 bytes    917,35 K
Unknown/hidden files...

C:\WINNT\SYSTEM32\
  dvctl.dll      Fri  6 May 2005  2.12.22  ..S.R        235.231  229,71 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  k8440i~1.dll  Fri  6 May 2005  2.10.36  ..S.R        234.412  228,92 K
  lvj809~1.dll  Thu  5 May 2005  18.43.32  ..S.R        235.231  229,71 K

4 items found:  4 files, 0 directories.
  Total of file sizes:  939.364 bytes    917,35 K

»»»»»»» (4) »»»»»»»
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\DVCTL.DLL
Sniffed -> C:\WINNT\SYSTEM32\H22O0C~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\K8440I~1.DLL
Sniffed -> C:\WINNT\SYSTEM32\LVJ809~1.DLL

»»»»»(5)»»»»»
**File C:\WINNT\SYSTEM32\DLLXXX.TXT
¯ Access denied ® ..................... DVCTL.DLL    ....235231  06.05.2005 
¯ Access denied ® ..................... K8440I~1.DLL  ....234412  06.05.2005 
¯ Access denied ® ..................... LVJ809~1.DLL  ....235231  05.05.2005 

»»»»»»» Search by size...


No matches found.

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.


»»»*»»» Scanning for moved file... »»»*»»»



No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.


fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.*


Filen C:\FINDnFIX\junkxxx\*.* kunne ikke findes

CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
MD5 Message Digest Algorithm by RSA Data Security, Inc.

  File name    Size    Date    Time        MD5 Hash
________________________________________________________________________
»»Permissions:
ERROR: Der er ikke flere filer.

Directory "C:\FINDnFIX\junkxxx\."
    Permissions:
        Type    Flags    Inh. Mask    Gen. Std. File Group or User
        ======= ======== ==== ======== ==== ==== ==== ================
        Allow  00000003 tco- 001F01FF ---- DSPO rw+x \Alle

    Owner: BUILTIN\Administratorer

    Primary Group: JULIE\Ingen

Directory "C:\FINDnFIX\junkxxx\.."
    Permissions:
        Type    Flags    Inh. Mask    Gen. Std. File Group or User
        ======= ======== ==== ======== ==== ==== ==== ================
        Allow  00000003 tco- 001F01FF ---- DSPO rw+x \Alle

    Owner: BUILTIN\Administratorer

    Primary Group: JULIE\Ingen



»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

»»Dumping Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout    SZ    15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota    DWORD    00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler    SZ    yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk    SZ   
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout    SZ    90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota    DWORD    00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs    SZ   

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710
    AppInit_DLLs =

  »»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW  Read            Alle
(ID-IO) ALLOW  Read            Alle
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  QWCEN-DS--      BUILTIN\Superbrugere
(ID-IO) ALLOW  QWCEN-DS--      BUILTIN\Superbrugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read              Alle
Read              BUILTIN\Brugere
QWCEN-DS--        BUILTIN\Superbrugere
Full access      BUILTIN\Administratorer
Full access      NT AUTHORITY\SYSTEM



00001150:                        ?                                     
00001190:                                            k b 2b *  2    9 9
000011D0:        0  `              8      vk                S DeviceNo
00001210:tSelectedTimeout    1 5      h    vk      '        s GDIProce
00001250:ssHandleQuotaout    vk                s Spooler_DLLs2 \    y e
00001290:s          vk                ~ swapdiskl l        vk         
000012D0:        TransmissionRetryTimeoutmponent    9 0    x      vk 
00001310:    '        s USERProcessHandleQuotam    vk                 
00001350:AppInit_DLLsout              B,g B B B B B B B B B B B B B B
00001390: B B B B B B B B B B B B B B B  y ?3y y        3g 3g3g3g3g V3g
000013D0: V3g V3g V V V Vy ?3y y          B,g B B B B B B B B B B B B B B
00001410: B B B B B B B B B B B B B B B     1yN Z?g s s    ?3?  
00001450:Xw     1  sf?g ZyN 9     B 3 3 3  3 3   3
00001490: 3  33 3 333 3 B  y ?3?3y y    3g 3g 3g3g3g3g V
000014D0:3g V3g V3g V V V Vy ?3y y        B 3 3 3  3 3   3
00001510: 3  33 3 333 3 B     1RJ c9g{o { {   ?3 OXw
00001550:                                                             

---------- NEWWIN.TXT
AppInit_DLLsout
--------------
--------------
--------------
gBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
gBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Den ser stadig forkert ud. Prøv lige at komme med en HiJackThis log så vi kan se om den fik gjort noget ved problemet.

Logfile of HijackThis v1.99.1
Scan saved at 13:05:19, on 06-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\WINNT\System32\svchost.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O20 - Winlogon Notify: Dynamic Directory - C:\WINNT\system32\k8440ihqe84e0.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Hmm.. sorry, jeg huskede forkert. Det var ikke den infektion som findnfix er beregnet på. Jeg har checket og her er den rigtige metode.

Hent dette lille fix:
http://www.ctrlaltdel.dk/forum/uploads/FBJSWF/2005-03-13_200534_O15reset.zip
Pak det ud og dobbeltklik på O15reset.reg - svar ja til at flette.

Hent L2mfix.exe fra et af disse steder:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Gem filen på dit Skrivebord og dobbeltklik på l2mfix.exe. Klik på Install knappen og følg instruktionerne. Åben herefter den nye mappe der er dannet på dit Skrivebord (l2mfix). Dobbeltklik på l2mfix.bat og vælg option 1 (Run Find log) ved at taste "1" og "Enter". Din computer bliver nu scannet - efter et par minutter åbnes en tekstfil i Notesblok. Kopier indholdet herind.

L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnce]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\o2ns0c57ef.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{04368899-E0A3-FD16-DEDE-89A0F30DAA5A}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Egenskabsark for multimediefiler"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerstyring"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Sikkerhedsside"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskabsside for OLE-dokumentfil"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-udvidelser for deling"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL-fil"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk&#8216;rmkort"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk&#8216;rm"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk&#8216;rmpanorering"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security-side"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell-fragmentdatahandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Udvidelsen Diskcopy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-udvidelser til Microsoft Windows-netv&#8216;rksobjekter"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-sk&#8216;rmstyring"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerstyring"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-udvidelser til filkomprimering"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer shell-udvidelse"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontekstmenu til kryptering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Rejsetaske"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-ikon"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Sikkerhedsside"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-udvidelser for deling"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-filtype"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto signeringsfiltype"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netv&#8216;rks- og opkaldsforbindelser"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte opgaver"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Mappen Foretrukne i shell"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="Denne computer"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Mappen Rejsetaske"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Mappegenvej"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Forbundet enhed"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="Udvidelse til filegenskabsside"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="Filtypeside"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="Hook til MIME-filtyper"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
"{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation-mappevisning"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Menuen Start"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="ben med genvejsmenubehandleren"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Vis HTML-udvidelser i Kontrolpanel"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Udvidelse til egenskabsside for mappeindstillinger"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Hj&#8216;lpeprogram til tr&#8216;k-og-slip i shell"
"{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Tilf&#8250;j krypteringselement til genvejsmenuerne i Stifinder."
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Miniaturer"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="Udpakning af HTML-miniaturer"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Udpakning af miniaturer til Office-grafikfiltre"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Dokumentinfo om miniaturehandler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="Uddelegering af miniaturer til lnk-filer"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Programstyring"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Opt&#8216;lling af installerede programmer"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Menuen Offlinefiler"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Indstillinger for Mappen Offlinefiler"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappen Offlinefiler"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{1474F601-9B4B-4EB0-81FA-20F753C0E1A4}"="FRISK extension"
"{E443A8D5-D905-4401-8789-16AE23A8A96D}"="FRISK extension"
"{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extention"
"{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1"
"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{131F3426-E806-4A1A-8158-3491646F775F}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{131F3426-E806-4A1A-8158-3491646F775F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{131F3426-E806-4A1A-8158-3491646F775F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{131F3426-E806-4A1A-8158-3491646F775F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{131F3426-E806-4A1A-8158-3491646F775F}\InprocServer32]
@="C:\\WINNT\\system32\\dkimg401.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINNT\SYSTEM32\
  dkimg401.dll  Fri  6 May 2005  16.30.58  ..S.R        235.231  229,71 K
  f8j20i~1.dll  Fri  6 May 2005  13.12.40  ..S.R        234.412  228,92 K
  h22o0c~1.dll  Mon 25 Apr 2005  6.31.22  ..S.R        234.490  228,99 K
  o2ns0c~1.dll  Fri  6 May 2005  2.20.24  ..S.R        235.231  229,71 K
  rtclmg32.dll  Wed 19 Sep 2063  7.50.50  A....          5.501    5,37 K

5 items found:  5 files (4 H/S), 0 directories.
  Total of file sizes:  944.865 bytes    922,72 K
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Disken i drev C har ikke noget navn.
Diskens serienummer er 4CC7-BD93

Indhold af C:\WINNT\System32

06-05-2005  16:30              235.231 dkimg401.dll
06-05-2005  13:12              234.412 f8j20i1oe8.dll
06-05-2005  02:20              235.231 o2ns0c57ef.dll
01-05-2005  20:59      <DIR>          dllcache
25-04-2005  06:31              234.490 h22o0cf3ef2.dll
              4 fil(er)          939.364 byte
              1 mappe(r)  1.538.469.888 byte ledig

Luk alle programmer - du vil om lidt blive bedt om at genstarte din computer.

Fra mappen l2mfix skal du køre l2mfix.bat igen - denne gang skal du vælge option 2 (Run Fix). Herefter skal du taste en tilfældig tast for at genstarte. Efter genstart vil dit Skrivebord og din ikoner vise sig og forsvinde igen - l2mfix vil fortsætte med at scanne din computer og når programmet er færdigt, vil en ny tekstfil blive åbnet i Notesblok. Kopier indholdet herind sammen med en frisk HijackThis log.

NB: Du må ikke køre andre af filerne i l2mfix mappen, før du er blevet bedt om det.

L2Mfix 1.03

Running From:
C:\Documents and Settings\Administrator\Skrivebord\l2mfix


Logfile of HijackThis v1.99.1
Scan saved at 18:34:05, on 06-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Programmer\Qualcomm\Eudora\Eudora.exe
C:\Programmer\Opera\Opera.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe




RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Read            BUILTIN\Superbrugere
(ID-IO) ALLOW  Read            BUILTIN\Superbrugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI)    DENY  --C-------      BUILTIN\Administratorer
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Read            BUILTIN\Superbrugere
(ID-IO) ALLOW  Read            BUILTIN\Superbrugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Administrator\Skrivebord\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Administrator\Skrivebord\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1024 'explorer.exe'
Killing PID 1024 'explorer.exe'
Error 0x5 : Adgang nægtet.


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 968 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINNT\system32\fmlemgmt.dll
        1 fil(er) kopieret.
Backing Up: C:\WINNT\system32\fppq0375e.dll
        1 fil(er) kopieret.
Backing Up: C:\WINNT\system32\h22o0cf3ef2.dll
        1 fil(er) kopieret.
Backing Up: C:\WINNT\system32\TuansportSerial.dll
        1 fil(er) kopieret.
Backing Up: C:\WINNT\system32\guard.tmp
        1 fil(er) kopieret.
deleting: C:\WINNT\system32\fmlemgmt.dll 
Successfully Deleted: C:\WINNT\system32\fmlemgmt.dll
deleting: C:\WINNT\system32\fppq0375e.dll 
Successfully Deleted: C:\WINNT\system32\fppq0375e.dll
deleting: C:\WINNT\system32\h22o0cf3ef2.dll 
Successfully Deleted: C:\WINNT\system32\h22o0cf3ef2.dll
deleting: C:\WINNT\system32\TuansportSerial.dll 
Successfully Deleted: C:\WINNT\system32\TuansportSerial.dll
deleting: C:\WINNT\system32\guard.tmp 
Successfully Deleted: C:\WINNT\system32\guard.tmp


Zipping up files for submission:
  adding: fmlemgmt.dll (152 bytes security) (deflated 5%)
  adding: fppq0375e.dll (152 bytes security) (deflated 5%)
  adding: h22o0cf3ef2.dll (152 bytes security) (deflated 5%)
  adding: TuansportSerial.dll (152 bytes security) (deflated 5%)
  adding: guard.tmp (152 bytes security) (deflated 5%)
  adding: clear.reg (152 bytes security) (deflated 22%)
  adding: echo.reg (152 bytes security) (deflated 11%)
  adding: direct.txt (152 bytes security) (stored 0%)
  adding: lo2.txt (152 bytes security) (deflated 77%)
  adding: readme.txt (152 bytes security) (deflated 49%)
  adding: report.txt (152 bytes security) (deflated 62%)
  adding: test.txt (152 bytes security) (deflated 56%)
  adding: test2.txt (152 bytes security) (stored 0%)
  adding: test3.txt (152 bytes security) (stored 0%)
  adding: test5.txt (152 bytes security) (stored 0%)
  adding: xfind.txt (152 bytes security) (deflated 49%)
  adding: backregs/131F3426-E806-4A1A-8158-3491646F775F.reg (152 bytes security) (deflated 70%)
  adding: backregs/shell.reg (152 bytes security) (deflated 74%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(NI)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(IO)    ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-NI) ALLOW  Read            BUILTIN\Brugere
(ID-IO) ALLOW  Read            BUILTIN\Brugere
(ID-NI) ALLOW  Read            BUILTIN\Superbrugere
(ID-IO) ALLOW  Read            BUILTIN\Superbrugere
(ID-NI) ALLOW  Full access     BUILTIN\Administratorer
(ID-IO) ALLOW  Full access     BUILTIN\Administratorer
(ID-NI) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     NT AUTHORITY\SYSTEM
(ID-IO) ALLOW  Full access     CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators  ... failed (GetAccountSid(Administrators)=1332

deleting local copy: fmlemgmt.dll 
deleting local copy: fppq0375e.dll 
deleting local copy: h22o0cf3ef2.dll 
deleting local copy: TuansportSerial.dll 
deleting local copy: guard.tmp 

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINNT\system32\fmlemgmt.dll
C:\WINNT\system32\fppq0375e.dll
C:\WINNT\system32\h22o0cf3ef2.dll
C:\WINNT\system32\TuansportSerial.dll
C:\WINNT\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok. 
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{131F3426-E806-4A1A-8158-3491646F775F}"=-
[-HKEY_CLASSES_ROOT\CLSID\{131F3426-E806-4A1A-8158-3491646F775F}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************


Hent Deldomains herfra:
http://www.greyknight17.com/spy/DelO15Domains.inf

Kør HijackThis og fix disse:
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O15 - Trusted Zone: *.awmguild.com
O15 - Trusted Zone: *.mt-download.com

Højreklik så på DelO15domains.inf og vælg installer.

Genstart normalt og kom med en ny log fra HiJackThis.

(Så kom der hul på bylden. Det er lang tid siden jeg har set den infektion sidst, så jeg huskede desværre forkert mht hvilket værktøj der skulle bruges)

Logfile of HijackThis v1.99.1
Scan saved at 20:30:23, on 06-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\Programmer\FSI\F-Prot\F-StopW.EXE
E:\Programmer\FarStone\VirtualDrive\VDTask.exe
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [VirtualDrive] "E:\Programmer\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Free Notes] "C:\Programmer\Power Soft\Free Notes\FreeNotes.exe"
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Kør HiJackThis og fix disse 2:
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll

Åbn herefter en stifinder og slet:
C:\WINNT\system32\msbe.dll

Genstart normalt og kør HiJackThis. Kig efter om de 2 linier stadig er der. Er de der, så udfør dette:

Så må vi lige have dig en tur i regedit og slette det sidste manuelt.

Genstart i fejlsikret tilstand.

Klik start | kør, skriv regedt32 og tryk enter.

Find denne nøgle:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Udvid også den så du kan se de underliggende nøgler.
Find disse 2 nøgler, højreklik hver af dem og vælg slet:
A3FDD654-A057-4971-9844-4ED8E67DBBB8
F4E04583-354E-4076-BE7D-ED6A80FD66DA

Hvis du får adgang nægtet, må du en tur op i menuen og sætte sikkerheden på nøglen så du får lov at slette den.
Da det er en windows 2000 kan jeg ikke huske præcist hvor sikkerheden ligger oppe i menuen, men det ER muligt i regedt32 at sætte sikkerheden på enkelte nøgler.

Genstart normalt og kom med en ny log.

Logfile of HijackThis v1.99.1
Scan saved at 23:47:06, on 06-05-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\Programmer\FSI\F-Prot\F-StopW.EXE
C:\Programmer\PestPatrol\PPControl.exe
C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
C:\Programmer\PestPatrol\PPMemCheck.exe
C:\Programmer\PestPatrol\CookiePatrol.exe
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Babylon\Babylon.exe
C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [F-StopW] C:\Programmer\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Armor2net] C:\Programmer\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programmer\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - Startup: NotesHolder.lnk = C:\Programmer\A!K Research Labs\NotesHolder\NotesHolder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\programmer\armor2net\armor2net personal firewall\netdog.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

Så er loggen ren.

Check lige igen at autoexec.nt stadig er i c:\winnt\system32 mappen.
Det er jo efterhånden temmelig længe siden du kopierede den derind, og det er jo først nu at loggen er renset.

Ja, autoexec.net ligger der stadig og den irriterende popup fra browesren er væk. Det var lidt af en omgang. Tak fordi du gad bruge tid på det.
Jeg har dog lige et spørgsmål til den der autoexec.nt. Den indeholder jo ikke meget. Hvad er dosx og mscdexnt? Windows har vel sin egen "dos" indbygget?

Velbekomme og takker for point :)

Nej, windows nt/2000/XP har faktisk ikke en dos indbygget. Den emulerer dos og det er derfor autoexec.nt og config.nt skal være i system32 mappen. Når man starter "dos" (cmd) i disse styresystemer, starter man faktisk et program og ikke det underliggende styresystem som i windows 3.11/95 og 98. (ME er lidt for sig selv mht dos)

Jeg kan ikke helt huske hvad dosx er, blot at det er en dos extender. Mscdexnt giver adgang til cdrom drev i "dos".