IRCFlood.V - Hjælp mig med at slippe af med den gnom

Følg vejledningen her:
Gå ind her og hent Hijackthis.
http://danborg.org/spy/HJT/hijackthis.exe
Kør Hijackthis, scan, save log og kopier logfilen herind, så kigger jeg på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Fra HJT...


SIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\The All-Seeing Eye\eye.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\hjt\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jp.dk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sf-anytime.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Er der noget forbudt? Har muligvis selv fjernet den ved hjælp af et online virus scan..Er ikke sikker:)

Det ser fornuftigt ud.

Men for at være sikker, så må du prøve at hente denne scanner:

http://shop.element5.com/product.html?productid=531168&affiliateid=200010704


Hent demoen. Den er gratis og i fuld version i 14 dage. Derefter drosles den ned, men bliver stadig opdateret og det hele.

Kopier loggen fra Ewido herind.

Tak for hjælpen...

Her er log:


---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            13:56:53, 19-05-2005
+ Report-Checksum:        EC0DD5BA

+ Date of database:        19-05-2005
+ Version of scan engine:    v3.0

+ Duration:                40 min
+ Scanned Files:            177106
+ Speed:                73.59 Files/Second
+ Infected files:            38
+ Removed files:            37
+ Files put in quarantine:        37
+ Files that could not be opened:    0
+ Files that could not be cleaned:    0

+ Binder:        Yes
+ Crypter:        Yes
+ Archives:        Yes

+ Scanned items:
    C:\
    E:\
    F:\

+ Scan result:
    C:\Documents and Settings\Jesper\Cookies\jesper@247realmedia[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@5073161[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@52606828[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@ads.thestar[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@al[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@as1.falkag[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@bluestreak[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@burstnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@cgi-bin[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@com[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@cookie.monster[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@coolwebsearch[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@counter.mycomputer[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@counter9.sextracker[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@data.coremetrics[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@fastclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@image.masterstats[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@landing.domainsponsor[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@link[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@LPneimanmarcus[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@mallcom[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@orbitz.rpts[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@programs.wegcash[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@sdc.shockwave[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@search.msn[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@servedby.advertising[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@server.iad.liveperson[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@sextracker[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@statse.webtrendslive[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@targetnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@tradedoubler[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@tribalfusion[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\Documents and Settings\Jesper\Cookies\jesper@z1.adserver[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\cssweb.dll -> Spyware.CSSWeb.a -> Ignored


::Report End


Noget mere effektivt program end Adaware...


den sidste jeg ignorerede hørte til endnu et af de utallige scans jeg har kørt nemlig Spybot fra www.spywarefri.dk

Håber du kan tyde det:)

Joda jeg kan godt tyde det.

I al beskedenhed er jeg en del af Spywarefri :O)

Vi skal have den fætter til cssweb væk.

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".


Start op i fejlsikret tilstand. Du trykker F8 nogle gange lige når Windows starter op.

Gå i start -> søg -> søg efter filer og mapper. Skriv cssweb.dll i søge feltet.
Slet dem du finder.

Eller gå i stifiner og find frem til:
C:\WINDOWS\Downloaded Program Files\cssweb.dll >>>> slet cssweb.dll.

Tøm din papirkurv og genstart.

Kom med en ny log til kontrol.

Er gjort!

NY log og nu kan jeg sørme også bruge mit Mirc igen:)


ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            19:56:09, 19-05-2005
+ Report-Checksum:        564E75A2

+ Date of database:        19-05-2005
+ Version of scan engine:    v3.0

+ Duration:                37 min
+ Scanned Files:            177776
+ Speed:                78.44 Files/Second
+ Infected files:            0
+ Removed files:            0
+ Files put in quarantine:        0
+ Files that could not be opened:    0
+ Files that could not be cleaned:    0

+ Binder:        Yes
+ Crypter:        Yes
+ Archives:        Yes

+ Scanned items:
    C:\
    E:\
    F:\

+ Scan result:
    No infected files found!


::Report End

Din log er nu helt ren.

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så skal du også lige skjule dine filer og mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Du kan også rense browser cachen

1. Klik på Funktioner - Internetindstillinger

2. Under midlertidige filer, klik på Slet cookies

3. Under midlertidige filer, klik på slet filer – sæt flueben i slet alt offline indhold

4. Under Oversigten, klik på ryd oversigten

5. Klik på ok.

Tøm din papirkurv.

Du kan rense temp med denne fil, det tager kun få sek.
www.spywareinfo.dk/download/cleantempxp2k.bat

Lidt råd med på vejen herfra skal du da også have.
For at sikre din pc fremover ville det være en god idé at bruge nogle af programmerne fra denne lille pakke som du kan se her:
http://www.spywarefri.dk/pakken.htm

Især vil jeg anbefale Spybot, SpywareBlaster, IE Privacy Keeper, IE-Spyad og SpywareGuard som minimum. De er alle gratis, fylder ikke meget, sløver ikke din pc og konflikter ikke med dine andre programmer

Jeg lægger ikke noget svar. Point kan du beholde selv eller give til Tonnybrandt
:O)

1000 tak for hjælpen...

Det var sgu lækkert. Bruger flere af programmerne fra pakken du omtaler. De funker!

Dejligt at jeg i denne omgang slap for en formattering.

Siger tak for hjælpen til jer begge..;)

Det var så lidt da. Det er en ren fornøjelse at kunne hjælpe lidt her og der.
Husk at acceptere dit eget svar ;O)

God weekend!

Ja god weekend!

Selv om det sikkert ikke overrasker, er jeg ny på siden, og fatter derfor ikke hvordan jeg tildeler point?

Og ja - fik selv svaret i stedet for at kommentarer - kan jeg se:)

Det er bare i orden.

Du skal markere dit navn ude i boxen til venstre. Derefter kan du acceptere svaret. Så er spørgsmålet lukket :O)