Vira i stakkevis - Hjælp til kontrol af hijackthis-log

tjekker den nu

Hent en prøveversion af SpySweeper her:
http://www.webroot.com/download/trial/ssfsetup972.exe

Installer og opdater programmet.
Installer og opdater (check for definition update)
Derefter, tryk på Options.
sæt prik i- sweep all folders on selected drive
fjern flueben ved-don´t sweep systemrestore folder.
sæt flueben ved- sweep for Rootkits

Kør så en Sweep. Når scanningen er færdig, tryk på- next-select all-next-finish.

Luk programmet.

Installationsvejledning finder her: http://www.spywarefri.dk/spysweepermanual.htm

-------------------

Hent denne scanner:
Ewido kan du downloade her: http://www.ewido.net/en/download/
Klik på Download now. Installer og kør Ewido. Opdater straks efter installationen programmet, (men lad være med at scanne endnu).
Genstart i fejlsikret tilstand. Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange. Kør nu en fuld scanning med Ewido. Når den er færdig trykker du save report og kopier den report herind sammen med en hijackthis log taget efter du har kørt Ewido

Okay. Her er rapport og log:

---------------------------------------------------------
ewido security suite - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            00:48:03, 13-11-2005
+ Rapport-Checksum:        9C8B8A9

+ Scanningsresultat:
    HKLM\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501} -> Spyware.SimpleBar : Renset uden backup
    HKLM\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}\TypeLib\\ -> Spyware.SimpleBar : Renset uden backup
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Renset uden backup
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\CLSID -> Spyware.PurityScan : Renset uden backup
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Renset uden backup
    HKU\S-1-5-21-1078081533-1659004503-839522115-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Renset uden backup
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Fejl under renselse
    [236] C:\WINDOWS\q53031.dll -> TrojanDownloader.Delf.zu : Renset uden backup
    [736] C:\WINDOWS\q53031.dll -> TrojanDownloader.Delf.zu : Fejl under renselse
    C:\birdihuy32.dll -> TrojanProxy.Small.ct : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@adtech[1].txt -> Spyware.Cookie.Adtech : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@atdmt[1].txt -> Spyware.Cookie.Atdmt : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@com[2].txt -> Spyware.Cookie.Com : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@cs.sexcounter[2].txt -> Spyware.Cookie.Sexcounter : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@ehg-nvidia.hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Renset uden backup
    C:\Documents and Settings\DBT\Cookies\dbt@trafic[1].txt -> Spyware.Cookie.Trafic : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\5.qtdfmp -> TrojanDownloader.Small.axn : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\6.qtdfmp -> TrojanDownloader.Small.atl : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\7.qtdfmp -> TrojanDownloader.Tibs.m : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\maxdd.game -> Dialer.Generic : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\vx1.game -> TrojanDropper.Agent.ri : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\vx4.game -> Dialer.Generic : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\vx6.game -> TrojanDropper.Small.aih : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\vxt2.game -> TrojanDownloader.Small.buw : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temp\vxt4.game -> TrojanDownloader.Small.bpz : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temporary Internet Files\Content.IE5\YL672ZID\Se7en[1].exe/alshala7y2.6.exe -> Worm.Rays : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temporary Internet Files\Content.IE5\YL672ZID\Se7en[1].exe/crypt32.ocx -> Backdoor.Flood.ay : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temporary Internet Files\Content.IE5\YL672ZID\Se7en[1].exe/cryptui.ocx -> Backdoor.Small.a : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temporary Internet Files\Content.IE5\YL672ZID\Se7en[1].exe/lans.bat -> Trojan.Passer : Renset med backup
    C:\Documents and Settings\DBT\Lokale indstillinger\Temporary Internet Files\Content.IE5\YL672ZID\x[1].exe -> Backdoor.Agent.px : Renset med backup
    C:\lo-269805439.exe -> TrojanDownloader.Tibs.z : Renset med backup
    C:\lo-729565051.exe -> TrojanDownloader.Tibs.z : Renset med backup
    C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Renset med backup
    C:\RECYCLER\svwhost.exe -> Backdoor.Agent.px : Renset med backup
    C:\sxe10.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe12.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe13.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe16.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe31.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe5.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe6.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe7.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe8.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxe9.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxeB.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxeC.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxeD.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\sxeF.tmp -> TrojanProxy.Ranky.cq : Renset med backup
    C:\teakmanger.exe/alshala7y2.6.exe -> Worm.Rays : Renset med backup
    C:\teakmanger.exe/crypt32.ocx -> Backdoor.Flood.ay : Renset med backup
    C:\teakmanger.exe/cryptui.ocx -> Backdoor.Small.a : Renset med backup
    C:\teakmanger.exe/lans.bat -> Trojan.Passer : Renset med backup
    C:\WINDOWS\cytob.exe.mwt -> Backdoor.SdBot.aad : Renset med backup
    C:\WINDOWS\q129781.dll -> TrojanDownloader.Delf.zu : Renset med backup
    C:\WINDOWS\q132218.dll -> TrojanDownloader.Delf.zu : Renset med backup
    C:\WINDOWS\q38484.dll -> TrojanDownloader.Delf.zu : Renset med backup
    C:\WINDOWS\q53031.dll -> TrojanDownloader.Delf.zu : Renset med backup
    C:\WINDOWS\q64312.dll -> TrojanDownloader.Delf.zu : Renset med backup
    C:\WINDOWS\system\svwhost.exe -> Backdoor.Agent.px : Renset med backup
    C:\WINDOWS\system32\41.dl_ -> Trojan.Spabot.t : Renset med backup
    C:\WINDOWS\system32\birdihuy32.dll -> TrojanProxy.Small.ct : Renset med backup
    C:\WINDOWS\system32\chp.dll -> Trojan.Spabot.t : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\FSD3U9QO\Se7en[1].exe/alshala7y2.6.exe -> Worm.Rays : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\FSD3U9QO\Se7en[1].exe/crypt32.ocx -> Backdoor.Flood.ay : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\FSD3U9QO\Se7en[1].exe/cryptui.ocx -> Backdoor.Small.a : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\FSD3U9QO\Se7en[1].exe/lans.bat -> Trojan.Passer : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\YQT91LUB\Se7en[1].exe/alshala7y2.6.exe -> Worm.Rays : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\YQT91LUB\Se7en[1].exe/crypt32.ocx -> Backdoor.Flood.ay : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\YQT91LUB\Se7en[1].exe/cryptui.ocx -> Backdoor.Small.a : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\YQT91LUB\Se7en[1].exe/lans.bat -> Trojan.Passer : Renset med backup
    C:\WINDOWS\system32\eraseme_14327.exe.mwt -> Backdoor.SdBot.aad : Renset med backup
    C:\WINDOWS\system32\kernels32.exe -> TrojanDownloader.Tibs.z : Renset med backup
    C:\WINDOWS\system32\maxd1.exe -> Dialer.Generic : Renset med backup
    C:\WINDOWS\system32\msn7.exe.mwt -> Backdoor.SpyBoter : Renset med backup
    C:\WINDOWS\system32\msnngers.exe.mwt -> Backdoor.SdBot.yx : Renset med backup
    C:\WINDOWS\system32\svchostt.exe.mwt -> Backdoor.Wootbot : Renset med backup
    C:\WINDOWS\system32\Systam driver\crypt32.ocx -> Backdoor.Flood.ay : Renset med backup
    C:\WINDOWS\system32\Systam driver\cryptui.ocx -> Backdoor.Small.a : Renset med backup
    C:\WINDOWS\system32\Systam driver\lans.bat -> Trojan.Passer : Renset med backup
    C:\WINDOWS\system32\vx.tll -> Adware.SpySheriff : Renset med backup
    C:\WINDOWS\system32\vxgame1.exe -> TrojanDropper.Agent.ri : Renset med backup
    C:\WINDOWS\system32\vxgame6.exe -> TrojanDropper.Small.aih : Renset med backup
    C:\WINDOWS\system32\vxgamet2.exe -> TrojanDownloader.Small.buw : Renset med backup
    C:\WINDOWS\system32\vxgamet4.exe -> TrojanDownloader.Small.bpz : Renset med backup
    C:\WINDOWS\system32\vxh8jkdq5.exe -> TrojanDownloader.Small.axn : Renset med backup
    C:\WINDOWS\system32\vxh8jkdq6.exe -> TrojanDownloader.Small.atl : Renset med backup
    C:\WINDOWS\system32\vxh8jkdq7.exe -> TrojanDownloader.Tibs.m : Renset med backup
    C:\WINDOWS\system32\win32ole.exe.mwt -> Backdoor.Wootbot : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@2o7[2].txt -> Spyware.Cookie.2o7 : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ads.addynamix[1].txt -> Spyware.Cookie.Addynamix : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@adtech[2].txt -> Spyware.Cookie.Adtech : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@as1.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@atdmt[2].txt -> Spyware.Cookie.Atdmt : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@burstnet[1].txt -> Spyware.Cookie.Burstnet : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@centrport[1].txt -> Spyware.Cookie.Centrport : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@com[1].txt -> Spyware.Cookie.Com : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@counter15.sextracker[1].txt -> Spyware.Cookie.Sextracker : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@counter8.sextracker[1].txt -> Spyware.Cookie.Sextracker : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@cs.sexcounter[1].txt -> Spyware.Cookie.Sexcounter : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ehg-kingstontechnology.hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ehg-nokiafin.hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ehg-warnerbrothers.hitbox[2].txt -> Spyware.Cookie.Hitbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@fastclick[1].txt -> Spyware.Cookie.Fastclick : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@fl01.ct2.comclick[1].txt -> Spyware.Cookie.Comclick : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@paycounter[2].txt -> Spyware.Cookie.Paycounter : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@perf.overture[1].txt -> Spyware.Cookie.Overture : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@phg.hitbox[1].txt -> Spyware.Cookie.Hitbox : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@qksrv[2].txt -> Spyware.Cookie.Qksrv : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@server.iad.liveperson[2].txt -> Spyware.Cookie.Liveperson : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@sexlist[1].txt -> Spyware.Cookie.Sexlist : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@sextracker[2].txt -> Spyware.Cookie.Sextracker : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@stat.onestat[2].txt -> Spyware.Cookie.Onestat : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@statcounter[1].txt -> Spyware.Cookie.Statcounter : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@statse.webtrendslive[2].txt -> Spyware.Cookie.Webtrendslive : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@targetnet[1].txt -> Spyware.Cookie.Targetnet : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@tradedoubler[2].txt -> Spyware.Cookie.Tradedoubler : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@trafic[1].txt -> Spyware.Cookie.Trafic : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@tribalfusion[2].txt -> Spyware.Cookie.Tribalfusion : Renset med backup
    D:\TEMP\C050605\Documents and Settings\DBT\Cookies\dbt@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@2o7[2].txt -> Spyware.Cookie.2o7 : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@adopt.euroclick[1].txt -> Spyware.Cookie.Euroclick : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@adtech[1].txt -> Spyware.Cookie.Adtech : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@atdmt[2].txt -> Spyware.Cookie.Atdmt : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@burstnet[2].txt -> Spyware.Cookie.Burstnet : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@cs.sexcounter[2].txt -> Spyware.Cookie.Sexcounter : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@fastclick[1].txt -> Spyware.Cookie.Fastclick : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@hotlog[1].txt -> Spyware.Cookie.Hotlog : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@paycounter[1].txt -> Spyware.Cookie.Paycounter : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@sexlist[1].txt -> Spyware.Cookie.Sexlist : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@spylog[1].txt -> Spyware.Cookie.Spylog : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@statcounter[1].txt -> Spyware.Cookie.Statcounter : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@tradedoubler[2].txt -> Spyware.Cookie.Tradedoubler : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@valueclick[1].txt -> Spyware.Cookie.Valueclick : Renset med backup
    D:\TEMP\C051105\Documents and Settings\DBT\Cookies\dbt@yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@as-eu.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@as-us.falkag[2].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@as1.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@atdmt[2].txt -> Spyware.Cookie.Atdmt : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@fastclick[1].txt -> Spyware.Cookie.Fastclick : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@mediaplex[2].txt -> Spyware.Cookie.Mediaplex : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@mysearch[2].txt -> Spyware.Cookie.Mysearch : Renset med backup
    D:\TEMP\C051105\Documents and Settings\Freja\Cookies\freja@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Renset med backup
    D:\TEMP\C051105\WINDOWS\Temp\Altnet\mysearch.cab/mySetp.exe -> Spyware.MyWebSearch : Renset med backup
    D:\TEMP\DBT\Dokumenter\Modtagne filer\Messenger Plus! - Setup.exe/70000011.exe -> TrojanDownloader.Swizzor.af : Renset med backup


::Rapport slut

---------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 00:48:42, on 13-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\DBT\Skrivebord\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [DU Meter] C:\Programmer\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows services laucher] scvhost.exe
O4 - HKLM\..\Run: [M1cr0s0ftf DDEs C0ntr01] Xsyn.pif
O4 - HKLM\..\RunServices: [COM+ OLE Application] win32ole.exe
O4 - HKLM\..\RunServices: [Windows services laucher] scvhost.exe
O4 - HKLM\..\RunServices: [M1cr0s0ftf DDEs C0ntr01] Xsyn.pif
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [StatBar] C:\Programmer\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Microsoft Windows] c:\windows\system32\systam driver\ntprint.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download with &DAP - C:\Programmer\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Programmer\DAP\dapextie2.htm
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: st3 - C:\WINDOWS\q53031.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: SysTray.Exsl - {6368D5FC-6F5C-4f5b-B164-E67214F67859} - C:\WINDOWS\System32\pplelgmi.dll
O21 - SSODL: mtklefa - {C84C6E80-D276-4599-67AF-AE4234412A27} - C:\WINDOWS\System32\nodpz32.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programmer\Webroot\Spy Sweeper\WRSSSDK.exe

Håber den er clean nu

Der er stadig en del virus på den.

Dr.Web skal du downloade her:ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

-----------------------


Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.

O4 - HKLM\..\Run: [Windows services laucher] scvhost.exe
O4 - HKLM\..\Run: [M1cr0s0ftf DDEs C0ntr01] Xsyn.pif
O4 - HKLM\..\RunServices: [COM+ OLE Application] win32ole.exe
O4 - HKLM\..\RunServices: [Windows services laucher] scvhost.exe
O4 - HKLM\..\RunServices: [M1cr0s0ftf DDEs C0ntr01] Xsyn.pif

O8 - Extra context menu item: &Download with &DAP - C:\Programmer\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Programmer\DAP\dapextie2.htm

O20 - Winlogon Notify: st3 - C:\WINDOWS\q53031.dll (file missing)

--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

------------------------------

Hent denne bats fil og kør den :
http://www.spywareinfo.dk/download/cleantempxp2k.bat
den sletter alt i din temp mappe.

------------------------------

Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)
Find og slet disse manuelt :

C:\Programmer\DAP
C:\WINDOWS\q53031.dll

-----------------------------

Stadig i fejlsikret:
Kør en fuld scanning med Dr.Web den starter med en hurtig hukommelsesscan, herefter når den er færdig, skal du markere dine drev, og så trykke på den lille grønne mand nede til højre.

Klik så på Start->Søg, find filen drweb32w.log kopier det nederste af teksten herind, startende med: Total session statistics

Så genstarter du computeren normalt og laver en ny hijackthis log, som du lægger herind sammen med reporten fra drweb32w

Okay. Her er så to nye logs:

=============================================================================
Dr.Web® Scanner for Windows v4.33 (4.33.0.09262)
Copyright © Igor Daniloff, 1992-2005
Log generated on: 2005-11-13, 12:52:13 [WARRIOR][DBT]
Command-line options: /tb /ts /pr /cu /icd /cnd /spr /upn /lng
=============================================================================

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 156671
Infected objects found: 70
Objects with modifications found: 0
Suspicious objects found: 10
Adware programs found: 2
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 70
Objects renamed: 10
Objects moved: 0
Objects ignored: 9
Scan speed: 84 Kb/s
Scan time: 00:39:30
-----------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 13:43:00, on 13-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\D-Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Programmer\DU Meter\DUMeter.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Globe Software\StatBar\StatBar.exe
C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\DBT\Skrivebord\hijackthis\HijackThis.exe
C:\WINDOWS\system32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [DU Meter] C:\Programmer\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [StatBar] C:\Programmer\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: SysTray.Exsl - {6368D5FC-6F5C-4f5b-B164-E67214F67859} - C:\WINDOWS\System32\pplelgmi.dll (file missing)
O21 - SSODL: mtklefa - {C84C6E80-D276-4599-67AF-AE4234412A27} - C:\WINDOWS\System32\nodpz32.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programmer\Webroot\Spy Sweeper\WRSSSDK.exe

Nu håber jeg den er ved at være clean :S

Har forresten også et andet spørgsmål... Jeg var inde på din side (www.arlet.dk) og læse lidt om virusproblemer og alt det. Jeg fandt din "sikkerhedspakke" og prøvede at installere de fire programmer du anbefalede, samt Sygate firewall (Har AVG installeret i forvejen). Men dette resulterede i at jeg overhovedet ikke kunne få adgang til internettet. Hvad skyldes dette? Jeg kunne forestille mig at det var Sygate der blokkerede det hele af en eller anden mærkelig årsag, men jeg ved det ik.

Så er din log ren.

Efter sådan en tur er det altid en god ide og rydde op i dine systemgendannelses filerne.
Deaktiver systemgendannelse ( http://www.arlet.dk/systemgendannelsen.htm ) - genstart din computer - aktiver systemgendannelse.
Og så skal du også lige skjule dine filer og mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil.
Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Generel oprydning: http://www.arlet.dk/oprydning.htm

Ang sygate, så er der en brugsvejledning her:http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=9706

Du har sikket blokeret for noget, som du ikke skulle..

Hov, disse 2 skal lige fixes i hijackthis:
O21 - SSODL: SysTray.Exsl - {6368D5FC-6F5C-4f5b-B164-E67214F67859} - C:\WINDOWS\System32\pplelgmi.dll (file missing)
O21 - SSODL: mtklefa - {C84C6E80-D276-4599-67AF-AE4234412A27} - C:\WINDOWS\System32\nodpz32.dll (file missing)


derefter er du hel ren*S*

Den her kan jeg ikke lide i Dr.Web loggen:
Objects ignored: 9
Kør Dr.Web igen, når den første scanning er overstået klikker du på Options->Change settings
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Rename.
Kør så en fuld scanning, så den fjerner hvad den måtte finde.
Genstart , kom med DR.Webloggen(stadig kun det nederste).