Spyware IGEN

Hent http://www.spychecker.com/program/hijackthis.html (HijackThis), og gem dem i mappen c:\xyz, som du opretter til dette formål.
Kør HijackThis, klik på scan, kopier loggens tekst og smidt den herind på www.eksperten.dk.

Så ser jeg loggen igennem.

OK jeg har lavet en Hijackthis log. Men hvorfor mappen "xyz" ? er det vigtigt ?

Logfile of HijackThis v1.99.1
Scan saved at 21:44:19, on 18-05-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\WINDOWS\Explorer.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\WINDOWS\System32\CTSvcCDA.exe
E:\flexlm\lmgrd.exe
E:\WINDOWS\System32\gearsec.exe
E:\flexlm\sldwks_d.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\ScsiAccess.EXE
E:\WINDOWS\System32\snmp.exe
E:\WINDOWS\System32\svchost.exe
E:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
E:\Programmer\TerraTec\Cinergy 600 TV\TTTVRC.exe
E:\WINDOWS\System32\TTTimer.exe
E:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
E:\Programmer\QuickTime\qttask.exe
E:\WINDOWS\System32\taskswitch.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\Programmer\Logitech\MouseWare\system\em_exec.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Programmer\Eraser\eraser.exe
E:\Programmer\HotChime\HotChime.exe
E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\bsw.exe
E:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
E:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programmer\InterVideo\WinDVR\WinScheduler.exe
E:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
E:\Programmer\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
E:\Programmer\Logitech\SetPoint\KEM.exe
E:\Programmer\Easy Notification 2.0\EasyNoti.exe
E:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
E:\Programmer\Internet Explorer\IEXPLORE.EXE
E:\PROGRA~1\MOZILL~1\firefox.exe
E:\Documents and Settings\Riisgaard\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///E:/Forside%20original.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [TerraTec Remote Control] E:\Programmer\TerraTec\Cinergy 600 TV\TTTVRC.exe
O4 - HKLM\..\Run: [TerraTec Scheduler] E:\WINDOWS\System32\TTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "E:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKLM\..\Run: [IS CfgWiz] E:\Programmer\Fælles filer\Symantec Shared\cfgwiz.exe /GUID NIS /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Programmer\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [MSN Messenger] E:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] E:\Programmer\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [HotChime] E:\Programmer\HotChime\HotChime.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe
O4 - Startup: Easy Notification.lnk = E:\Programmer\Easy Notification 2.0\EasyNoti.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Image Transfer.lnk = E:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = E:\Programmer\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = E:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = E:\Programmer\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (HKCU)

O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geograf.com/viewer/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/defaults/activex/ImageUploader3.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O20 - AppInit_DLLs: ,
O23 - Service: Adobe LM Service - Unknown owner - E:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: FLEXlm Service 1 - GLOBEtrotter Software Inc. - E:\flexlm\lmgrd.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - E:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NetTime (NetTimeSvc) - Subjective Software - E:\Programmer\NetTime\NeTmSvNT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - E:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Nej, c:\xyz er ikke vigtig, det er blot sådan at du let kan fjerne programmet efterfølgende.

Jeg vender tilbage om lidt med analysen af loggen.

Har du installeret programmer, som hedder Eraser og HotChime?
Hvis ja, så først blot nedenstående punkter. Hvis nej, så laver jeg en ny vejledning til dig.

(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe, som vi skal bruge senere.

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///E:/Forside%20original.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKLM\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKLM\..\Run: [MSN Messenger] E:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe
O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (HKCU)
O20 - AppInit_DLLs: ,

Åbn en tilfældig mappe, i menuen klik på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende filer:
E:\WINDOWS\System32\winshost.exe
E:\WINDOWS\System32\msmsgs.exe
E:\WINDOWS\System32\winshost.exe
c:\bsw.exe
E:\WINDOWS\System32\wldr.dll
... og følgende mappe:
E:\PROGRA~1\VIRTUA~1\ (måske hedder den e:\programmer\virtual maid) e.lign.)

(4)
Start -> programmer -> tilbehør -> systemværktøjer -> diskoprydning -> Slet Temporary internet files, papirkurv og midlertidige filer.

(5)
Kør scanneren mwav.exe, og sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files.
Tryk på Scan Clean
Scanningen kan godt tage et par timer.

(6)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind.

(7)
Når vi er helt færdige, så husk at aktiver systemgendannelse igen.

bare en bemærkning
dine problemer vil komme igen og igen, hvis ikke du opdatere til service pack 2

Hej igen :o)
Kan se at der er flere filer der stadig findes, jeg har fulgt din beskrivelse til punkt og prikke. Der var dog nogle filer der ikke blev fundet af Hijackthis i FEJLSIKRET tilstand:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O4 - HKCU\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe

O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm

Ved søgning på filer i fejlsikret tilstand kunne jeg ikke finde:

E:\WINDOWS\System32\winshost.exe


Logfile of HijackThis v1.99.1
Scan saved at 22:50:39, on 19-05-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
E:\Programmer\TerraTec\Cinergy 600 TV\TTTVRC.exe
E:\WINDOWS\System32\TTTimer.exe
E:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
E:\Programmer\QuickTime\qttask.exe
E:\WINDOWS\System32\taskswitch.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Programmer\Logitech\MouseWare\system\em_exec.exe
E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Programmer\Eraser\eraser.exe
E:\Programmer\HotChime\HotChime.exe
E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
E:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
E:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programmer\InterVideo\WinDVR\WinScheduler.exe
E:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
E:\Programmer\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
E:\Programmer\Logitech\SetPoint\KEM.exe
E:\Programmer\Easy Notification 2.0\EasyNoti.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\WINDOWS\System32\CTSvcCDA.exe
E:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
E:\flexlm\lmgrd.exe
E:\WINDOWS\System32\gearsec.exe
E:\flexlm\sldwks_d.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\ScsiAccess.EXE
E:\WINDOWS\System32\snmp.exe
E:\WINDOWS\System32\svchost.exe
E:\Documents and Settings\Riisgaard\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///E:/Forside%20original.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [TerraTec Remote Control] E:\Programmer\TerraTec\Cinergy 600 TV\TTTVRC.exe
O4 - HKLM\..\Run: [TerraTec Scheduler] E:\WINDOWS\System32\TTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "E:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Programmer\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] E:\Programmer\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [HotChime] E:\Programmer\HotChime\HotChime.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [winshost.exe] E:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe
O4 - Startup: Easy Notification.lnk = E:\Programmer\Easy Notification 2.0\EasyNoti.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Image Transfer.lnk = E:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = E:\Programmer\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = E:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = E:\Programmer\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (file missing) (HKCU)

O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geograf.com/viewer/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/defaults/activex/ImageUploader3.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O23 - Service: Adobe LM Service - Unknown owner - E:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: FLEXlm Service 1 - GLOBEtrotter Software Inc. - E:\flexlm\lmgrd.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - E:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NetTime (NetTimeSvc) - Subjective Software - E:\Programmer\NetTime\NeTmSvNT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - E:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Hej Levich - sad lige og opdaterede mig selv i hijack og ser med på sidelinien - skal disse ikke fixes osse , udover dem som allerede er nævnt?

O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [LDM] E:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

->Kjaersgaard - en god idé er at installere Ie privacy keeper til at tømme temp mapper og temporary internet files automatisk - desuden rydde op i cookies ,  men udeluk de sider hvor du er medlem , ok ? så slipper du for mange problemer i fremtiden

dannyboyd -> de linjer du nævner skal ikke fixes med hijackthis, og har ikke noget at gøre med problemer med spyware/virus. Det ødelægger ikke noget, hvis de bliver fixed, men det er mere korrekt blot at indstille programmerne korrekt.
Som eksempel: Den første linje du nævner er "System Tray access to Quick Time viewer".

kjaersgaard -> Har du installeret programmer, som hedder Eraser og HotChime?

Jeg havde overset et linje, der skal fjernes. Du er nød til at gentage punkt (1), (3), (4) og (6) fra ovenstående vejledning. I punkt (4) skal du fixe følgende linjer:
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe
O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D3E2517D-5D48-4030-A789-75FA5E818297} - E:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab

... og slette disse filer:
c:\bsw.exe
E:\WINDOWS\System32\wldr.dll
og denne mappe:
E:\PROGRA~1\VIRTUA~1\

Jeg/vi skal nok få has på de onde spyware programmer. Bare rolig.

Hej igen :o)

Den log jeg viser nedenunder er den log jeg får fra Hijackthis i FEJLSIKRET TILSTAND.
Her er kommer de linjer du beder mig fixe ikke frem. Hvis jeg derimod scanner i ALMINDELIG TILSTAND bliver de vist.
Den linje jeg har sat XXX udfor er jeg lidt i tvivl om er noget som skal være der.

Men hvorfor er loggen ikke ens i fejlsikret og almindelig tilstand ??

Logfile of HijackThis v1.99.1
Scan saved at 16:49:57, on 20-05-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Documents and Settings\Riisgaard\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [TerraTec Remote Control] E:\Programmer\TerraTec\Cinergy 600 TV\TTTVRC.exe
O4 - HKLM\..\Run: [TerraTec Scheduler] E:\WINDOWS\System32\TTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "E:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Programmer\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Image Transfer.lnk = E:\Programmer\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = E:\Programmer\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = E:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = E:\Programmer\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.geograf.com/viewer/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/defaults/activex/ImageUploader3.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O23 - Service: Adobe LM Service - Unknown owner - E:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - E:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: FLEXlm Service 1 - GLOBEtrotter Software Inc. - E:\flexlm\lmgrd.exe

XX - O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - E:\WINDOWS\System32\gearsec.exe

023 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NetTime (NetTimeSvc) - Subjective Software - E:\Programmer\NetTime\NeTmSvNT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - E:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Den linje med xx skyldes "Apple Quicktime iPod/iTunes CDRW support", og skal ikke fjernes.

Kører din computer godt?

Installer SP2 til windows, så du øger din computers sikkerhed.

Den her:
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
er stadig i ovenstående log i fejlsikret tilstand.

Den skal fjernes.

Min PC kører OK - er dog sommetider langsom til at starte programmer.
Det med SP2 må vente du ved nok hvorfor. Men det må vente til jeg skal have ny PC hvilket bliver i løbet af et år, og selvfølgelig vælger jeg en hvor styresystemet er med i prisen eller sætter penge af til det.
Jeg fjerner lige ovenstående og vender tilbage.

Hej igen :o)
Nu har jeg fjernet ovennævnte og kørte "search and destroy" i fejlsikret tilstand, her fjernede jeg 2 linjer. Min IE browser ser nu normal ud igen, der er kun det blå skrivebord tilbage med fejlmeddelelsen. Den lader sig ikke umiddelbart fjerne jeg kan ikke få mit normale baggrundsbillede på. Det er da blevet en hel del bedre siden vi startede men hvordan sikrer jeg mig at jeg ikke har mere spyware på min PC. På skrivebordet findes de genveje som antispywaren har oprettet stadig.

Installer Spybot Search and Destroy og Ad-aware, updater dem og kør en scan. Hvis de ikke finder noget. Og hijakcthis loggen er ren, skulle du være fri for spyware.

OK tak til levich. Undskyld jeg lod den stå åben så længe, havde ikke fået mail om dit svar...Sorry. Takker mange gange for hjælpen. Fortsat go' weekend. ;o)

Tak og i lige måde. Jeg har 29 grader uden for = en god weekend.