net falder ud

Glemte du denne ?

Download hijackthis herfra og gem det i en folder for sig selv på dit skrivebord
http://www.downloadportal.dk/viewinfo.asp?rid=1658
Eller
http://www.arlet.dk/hjt.exe
evt. instruktion: http://www.spywarefri.dk/hjtanv.htm

Start programmet og vælge, at udføre en scan samt gemme en log fil.
Når hijackthis er færdig med, at scanne vil den bede dig om en placering hvor du vil gemme "hijackthis" en tekst fil.
Gem den i samme folder som hijackthis. Når du har sagt okay hopper der et nyt vindue frem nemlig notepad med en masse tekst linjer. Marker alle linjerne og kopir dem herind så 'nogen' kan kigge på dem. Du må ikke selv begynde, at fikse noget i hijackthis.

Ikke nødvendigvis mig der følger op...

(sikker på det ikke er en firewall som blokere når det går kold.. altså at den blokere for at den får en ip-adresse)

ups her er den

Logfile of HijackThis v1.99.0
Scan saved at 22:55:31, on 25-08-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmer\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Programmer\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Programmer\Trend Micro\PC-cillin 2002\PCCCLIENT.EXE
C:\Programmer\Trend Micro\PC-cillin 2002\PCCGUIDE.EXE
C:\Programmer\Trend Micro\PC-cillin 2002\POP3TRAP.EXE
C:\Programmer\Kazaa\Kazaa.exe
C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\Tmntsrv.exe

tror selv det er noget hun har fået fra kazaa

jeg kan ikke løse logs så vi afventer lige en som kan det..

kenp > tror ikke det er firewall, da hun kan gå på nettet og chatte og køre webcam og det hele.. nogen gange 10 minutter andre gange flere timer

ser på det

Du skal hente hijackthis fra et af majsmarken's links.. du har en gammel version.

Jeg ville afinstallere kazaa.

oki.. hun er på arbejde lige nu så jeg ved ikke hvornår jeg lige kan fange hende på mess, men skal nok få hende til at køre den nyeste version af Hijack

Logfile of HijackThis v1.99.1
Scan saved at 13:03:22, on 26-08-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\P2P Networking\P2P Networking.exe
C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\stinger.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Malenah\Lokale indstillinger\Temporary Internet Files\Content.IE5\O1UZ416J\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\RunOnce: [Need2FindBar Uninstall] rundll32 C:\PROGRA~1\Uninstall Need2Find Bar.dll,O -2
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\Tmntsrv.exe

nu har hun fjernet et par skumle searchbars, og ad-aware fandt 125 objekter og det er bare siden igår

Download Ewido (Trial version) (Vi skal bruge den senere)
http://shop.element5.com/product.html?productid=531168

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.

Slet denne mappe

C:\WINDOWS\system32\P2P Networking\

Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelt tjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\RunOnce: [Need2FindBar Uninstall] rundll32 C:\PROGRA~1\Uninstall Need2Find Bar.dll,O -2 

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Scan med Ewido

Genstart normalt og kopir en ny hijackthis log herind så jeg kan se om vi fik fjernet det hele eller om noget skulle være blevet overset:)

nu er hun lige strøget af mess, så ved ikke hvornår hun kommer på igen, men vi prøver

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            15:06:03, 26-08-2005
+ Report-Checksum:        191F2896

+ Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{3646C2BD-3554-49CA-8125-44DEEFB881DE} -> Spyware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{3f4d4f88-0198-4921-b630-957f3eb814e0} -> Spyware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{16097036-894C-4C00-A61F-93CA0D49A70E} -> Spyware.TOPicks : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{258A3625-183B-4477-AEE2-EA54DF6D878D} -> Spyware.TOPicks : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{2ED5AF98-9258-45BA-B79B-06625C92F662} -> Spyware.TOPicks : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD} -> Spyware.TOPicks : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{FD42F6D3-7AB1-470C-979B-7996EDC99099} -> Spyware.TOPicks : Cleaned with backup
    HKLM\SOFTWARE\Need2Find -> Spyware.Need2Find : Cleaned with backup
    HKLM\SOFTWARE\Need2Find\bar -> Spyware.Need2Find : Cleaned with backup
    HKLM\SOFTWARE\Need2Find\bar\Partner -> Spyware.Need2Find : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25D8BACF-3DE2-4B48-AE22-D659B8D835B0} -> Spyware.RXToolbar : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D1C4E81-A32A-416B-BCDB-33B3EF3617D3} -> Spyware.Need2Find : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4E7BD74F-2B8D-469E-90F0-F66AB581A933} -> Spyware.MyWebSearch : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\Need2Find -> Spyware.Need2Find : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\Need2Find\bar -> Spyware.Need2Find : Cleaned with backup
    HKU\S-1-5-21-2052111302-688789844-1343024091-1003\Software\RX Toolbar -> Spyware.RXToolbar : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
    :mozilla.28:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    :mozilla.32:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.33:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.34:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.35:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.36:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.37:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.38:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.39:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.40:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.41:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.48:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.49:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.50:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.51:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.52:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.57:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
    :mozilla.58:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.59:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.66:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.74:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.103:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
    :mozilla.104:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    :mozilla.113:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup
    :mozilla.115:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.124:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
    :mozilla.139:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.140:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.143:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
    :mozilla.152:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.153:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.168:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.169:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.170:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
    :mozilla.174:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
    :mozilla.175:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
    :mozilla.176:C:\Documents and Settings\Malenah\Application Data\Mozilla\Firefox\Profiles\vxbsamth.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
    C:\Documents and Settings\Malenah\Cookies\malenah@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Malenah\Cookies\malenah@ad.yieldmanager[3].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Malenah\Cookies\malenah@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    C:\Documents and Settings\Malenah\Lokale indstillinger\Temp\p2psetup.exe -> Spyware.P2PNetworking : Cleaned with backup
    C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\backups\backup-20050813-130046-734.dll -> TrojanDownloader.WebP2PInstaller : Cleaned with backup
    C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\backups\backup-20050823-165635-311.dll -> Spyware.MySearch : Cleaned with backup
    C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\backups\backup-20050826-112319-348.dll -> Spyware.MySearch : Cleaned with backup
    C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\backups\backup-20050826-112320-332.dll -> Spyware.404Search : Cleaned with backup
    C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\backups\backup-20050826-142826-332.dll -> TrojanDownloader.WebP2PInstaller : Cleaned with backup
    C:\Program Files\Altnet\Download Manager\adm25.dll -> Spyware.Altnet : Cleaned with backup
    C:\Program Files\Altnet\Download Manager\adm4.dll -> Spyware.Altnet : Cleaned with backup
    C:\Program Files\Altnet\Download Manager\admdloader.dll -> Spyware.Altnet : Cleaned with backup
    C:\Program Files\Altnet\Download Manager\admfdi.dll -> Spyware.Altnet : Cleaned with backup
    C:\Program Files\Altnet\Download Manager\admprog.dll -> Spyware.Altnet : Cleaned with backup
    C:\Programmer\Mozilla Firefox\plugins\NPNd2fn.dll -> Spyware.MyWebSearch : Cleaned with backup
    C:\Programmer\Need2Find -> Spyware.Need2Find : Cleaned with backup
    C:\Programmer\Need2Find\bar -> Spyware.Need2Find : Cleaned with backup
    C:\Programmer\Need2Find\bar\History -> Spyware.Need2Find : Cleaned with backup
    C:\Programmer\Need2Find\bar\History\search -> Spyware.Need2Find : Cleaned with backup
    C:\Programmer\Need2Find\bar\Settings -> Spyware.Need2Find : Cleaned with backup
    C:\Programmer\RXToolBar -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\Cache -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\CacheCatolog.rx -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\additional.gif -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\additional_active.gif -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\background.jpg -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\blue_hr_horz.GIF -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\gray_hr_horz.GIF -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\thumbtack.gif -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\thumbtack_active.gif -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\graphics\thumbtack_click.gif -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\HTML -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\HTML\content.htm -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\HTML\main.htm -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\RXToolBar\RXToolBar.dll -> Spyware.RXToolbar : Cleaned with backup
    C:\Programmer\Uninstall Need2Find Bar.dll -> Spyware.MySearch : Cleaned with backup


::Report End

hijack følger

venter jeg så på.. og ser fint ud hvad Ewido har fundet og renset.

Logfile of HijackThis v1.99.0
Scan saved at 16:02:34, on 26-08-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Programmer\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Programmer\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Programmer\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Malenah\Skrivebord\adwarescanners\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scor.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programmer\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Programmer\Trend Micro\PC-cillin 2002\Tmntsrv.exe

så er der hijack

Den er ren nu, men hvorfor er den taget med det gamle hijackthis igen?

tror ikke hun har helt vildt styr på det. og jeg sidder og snakker med hende over messenger såååååååå.. tak for hjælpen point og karma til dig

selv tak:) du kan evt. smide en log en fra det nye hijackthis også så kan jeg se på den lidt senere.. den er sikkert også ren:)