Internet går ned efter en time

Vi kan starte med at tjekke om du har noget "snavs" på din computer i form af spyware mv.

Hent http://www.spychecker.com/program/hijackthis.html (HijackThis).
Kør HijackThis, klik på scan, kopier loggens tekst og smidt den herind.

Logfile of HijackThis v1.99.1
Scan saved at 10:25:01, on 09-07-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\Program Files\Promise\Promise Disk Controller Manager\MsgAgt.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
D:\Program Files\Softwin\BitDefender8\vsserv.exe
D:\WINNT\Explorer.EXE
D:\Program Files\Softwin\BitDefender8\bdmcon.exe
D:\Program Files\Softwin\BitDefender8\bdoesrv.exe
D:\Program Files\Softwin\BitDefender8\bdnagent.exe
D:\WINNT\htpatch.exe
D:\WINNT\system32\RunDll32.exe
D:\WINNT\system32\internat.exe
D:\Program Files\eMule\emule.exe
D:\Program Files\ICQ\ICQ.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Local Spool support DLL - {00C9D850-244D-10E1-B3C9-10805E499D95} - D:\WINNT\system32\lclsplnt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [BDMCon] D:\Program Files\Softwin\BitDefender8\\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] D:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] D:\Program Files\Softwin\BitDefender8\\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] D:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [HTpatch] D:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Compaq Service Drivers] winmsn.exe
O4 - HKLM\..\Run: [Windows_Protect] winsystem.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\Program Files\ICQ\NDetect.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] winmsn.exe
O4 - HKLM\..\RunServices: [Windows_Protect] winsystem.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Windows_Protect] winsystem.exe
O4 - HKCU\..\Run: [Compaq Service Drivers] winmsn.exe
O4 - HKCU\..\RunServices: [Compaq Service Drivers] winmsn.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Program Files\ICQ\ICQ.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Omniquad MyPrivacy - Unknown owner - D:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe (file missing)
O23 - Service: UtMsgAgt (UtMsgSvc) - Promise Technology Inc. - D:\Program Files\Promise\Promise Disk Controller Manager\MsgAgt.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - D:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Læs alle punkterne inden du gør noget.

(1)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe.

(2)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
R3 - Default URLSearchHook is missing
O2 - BHO: Local Spool support DLL - {00C9D850-244D-10E1-B3C9-10805E499D95} - D:\WINNT\system32\lclsplnt.dll
O4 - HKLM\..\Run: [Compaq Service Drivers] winmsn.exe
O4 - HKLM\..\Run: [Windows_Protect] winsystem.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] winmsn.exe
O4 - HKLM\..\RunServices: [Windows_Protect] winsystem.exe
O4 - HKCU\..\Run: [Windows_Protect] winsystem.exe
O4 - HKCU\..\Run: [Compaq Service Drivers] winmsn.exe
O4 - HKCU\..\RunServices: [Compaq Service Drivers] winmsn.exe


(3)
Åbn en tilfældig mappe, i menuen klik på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende filer:
D:\WINNT\system32\lclsplnt.dll
winmsn.exe
winsystem.exe

(4)
Start -> kør -> skriv "cleanmgr" -> Slet Temporary internet files, papirkurv og midlertidige filer. Gentag for alle dine drev.

(5)
Kør scanneren mwav.exe, og sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files. Tryk på Scan Clean.
Scanningen kan godt tage et par timer.

(6)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind.

*******************
Jeg er lidt i tvivl om denne linje:
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
men gør ikke noget ved den før jeg siger til.

Logfile of HijackThis v1.99.1
Scan saved at 11:32:40, on 09-07-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\Program Files\Promise\Promise Disk Controller Manager\MsgAgt.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
D:\Program Files\Softwin\BitDefender8\vsserv.exe
D:\WINNT\Explorer.EXE
D:\Program Files\Softwin\BitDefender8\bdmcon.exe
D:\Program Files\Softwin\BitDefender8\bdoesrv.exe
D:\Program Files\Softwin\BitDefender8\bdnagent.exe
D:\WINNT\htpatch.exe
D:\WINNT\system32\RunDll32.exe
D:\WINNT\system32\internat.exe
D:\Program Files\ICQ\ICQ.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ulutil2.dll,SetWriteBack
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [BDMCon] D:\Program Files\Softwin\BitDefender8\\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] D:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] D:\Program Files\Softwin\BitDefender8\\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] D:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [HTpatch] D:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\Program Files\ICQ\NDetect.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Program Files\ICQ\ICQ.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Omniquad MyPrivacy - Unknown owner - D:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe (file missing)
O23 - Service: UtMsgAgt (UtMsgSvc) - Promise Technology Inc. - D:\Program Files\Promise\Promise Disk Controller Manager\MsgAgt.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - D:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Jeg har stadig samme problem...

Og har fundet ud af det ikke er mit internet der er galt med, jeg har samme OS på en anden HDD og der virker det meget fint, så det må være et eller andet...

Denne her linje "O4 - HKCU\..\Run: [internat.exe] internat.exe" stammer enten fra et Language selection icon in system tray eller også er det spyware, som skal fjernes.
Har du et ikon til valg af sprog for neden på dit skrivebord?

Noget nyt?