Hvad skal der slettes i denne logfil fra Hijackthis?

kigger

Hent følgende programmer:

- CWShredder, http://cwshredder.net/bin/CWShredder.exe (programmet skal ikke køres endnu)
- AboutBuster6, http://www.majorgeeks.com/download4289.html (pak programmet ud til Skrivebordet)
- Ewido, http://www.spywarefri.dk/downloads1/ewido-setup.exe
- CCleaner, http://www.filehippo.com/download_ccleaner.html

Installer og kør Ewido - opdater programmet (men lad være med at scanne).

2. Genstart i Fejlsikret tilstand (ved at taste F8 under opstart).

3. Kør CWShredder og klik på Fix.

4. Kør AboutBuster og klik på Begin removal. Tillad programmet at lukke Explorer, hvis du bliver spurgt. Programmet laver en log i samme mappe som du har AboutBuster installeret til (AB log.txt) - den skal du kopiere herind når fixet er færdigt.

5. Kør en rensning med CCleaner (ikke strengt nødvendigt, men så kører Ewido scanningen lidt hurtigere).

6. Kør en fuld scanning med Ewido.

7. Kør HijackThis, scan og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uelpb.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uelpb.dll/sp.html#93256%resultposition.net

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [3.tmp] C:\DOCUME~1\jh\LOCALS~1\Temp\3.tmp.exe
O4 - HKLM\..\Run: [4.tmp] C:\DOCUME~1\jh\LOCALS~1\Temp\4.tmp.exe
O4 - HKLM\..\Run: [3.tmp.exe] C:\DOCUME~1\jh\LOCALS~1\Temp\3.tmp.exe
O4 - HKLM\..\Run: [4.tmp.exe] C:\DOCUME~1\jh\LOCALS~1\Temp\4.tmp.exe
O4 - HKLM\..\Run: [javasw.exe] C:\WINDOWS\javasw.exe
O4 - HKLM\..\Run: [ieaf32.exe] C:\WINDOWS\system32\ieaf32.exe

8. Genstart din computer i Normal tilstand og læg en frisk HijackThis log herind, sammen med log'en fra AboutBuster.

jeg prøver....

Her er logfiler så:

AboutBuster 6.0
Scan started on [30-01-2006] at [13:44:23]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Removed Stream! C:\WINDOWS\Coffee Bean.bmp:ozobdu
Removed Stream! C:\WINDOWS\COM+.log:wmdib
Removed Stream! C:\WINDOWS\control.ini:haghxf
Removed Stream! C:\WINDOWS\KB885836.log:smhnar
Removed Stream! C:\WINDOWS\KB887472.log:knascb
Removed Stream! C:\WINDOWS\KB898458.log:cuxcag
Removed Stream! C:\WINDOWS\KB899588.log:mvphvr
Removed Stream! C:\WINDOWS\msdfmap.ini:xxsare
Removed Stream! C:\WINDOWS\netfxocm.log:pplfto
Removed Stream! C:\WINDOWS\ntdtcsetup.log:ourvh
Removed Stream! C:\WINDOWS\ocmsn.log:iqwknq
Removed Stream! C:\WINDOWS\OEWABLog.txt:aroqhb
Removed Stream! C:\WINDOWS\orun32.ini:zvuov
Removed Stream! C:\WINDOWS\Soap Bubbles.bmp:srmncy
Removed Stream! C:\WINDOWS\tabletoc.log:ksfswi
Removed Stream! C:\WINDOWS\wiaservc.log:rluqf
Removed Stream! C:\WINDOWS\wmsetup.log:bnxjcf
Removed Stream! C:\WINDOWS\Zapotec.bmp:uoqowh
-------------------------------------------------------------
Removed File! : C:\WINDOWS\appud.exe
Removed File! : C:\WINDOWS\d3ll32.exe
Removed File! : C:\WINDOWS\gkjgj.log
Removed File! : C:\WINDOWS\ieeq32.exe
Removed File! : C:\WINDOWS\iprl32.exe
Removed File! : C:\WINDOWS\javagq.exe
Removed File! : C:\WINDOWS\msad.exe
Removed File! : C:\WINDOWS\msll.exe
Removed File! : C:\WINDOWS\ntob.exe
Removed File! : C:\WINDOWS\sdknd32.exe
Removed File! : C:\WINDOWS\sdkyl.exe
Removed File! : C:\WINDOWS\system32\appff.exe
Removed File! : C:\WINDOWS\system32\atlkb32.exe
Removed File! : C:\WINDOWS\system32\d3jc32.exe
Removed File! : C:\WINDOWS\system32\iecm.exe
Removed File! : C:\WINDOWS\system32\mfczi32.exe
Removed File! : C:\WINDOWS\system32\msqb.exe
Removed File! : C:\WINDOWS\system32\netsk32.exe
Removed File! : C:\WINDOWS\system32\ntff32.exe
Removed File! : C:\WINDOWS\system32\onhfa.txt
Removed File! : C:\WINDOWS\system32\winwd.exe
Removed File! : C:\WINDOWS\system32\zokxw.txt
-------------------------------------------------------------
Removed Temp Files
Internet Explorer Settings Reset!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 13:46:51


Logfile of HijackThis v1.99.1
Scan saved at 14:29:56, on 30-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\NovaVision\NaviWatch\nvnwUtil.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\TEXTware\HotKey\TWALINK.EXE
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\Program Files\Vodafone\VodafoneMobileConnectCard\VodafoneMobileConnectCard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\jh\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uelpb.dll/sp.html#93256%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NaviWatch] C:\Program Files\NovaVision\NaviWatch\NaviWatch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Vodafone Mobile Connect Card.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotKey.lnk = C:\Program Files\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Run VNC Server.lnk = C:\Program Files\RealVNC\WinVNC\winvnc.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C8C1066B-FE9E-4B1B-9951-1BBC5EE03E38} (WDX.WDX_Main) - https://www2.web-direct.dk/WDX.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = meldgaard.local
O17 - HKLM\Software\..\Telephony: DomainName = meldgaard.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = meldgaard.local
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) -  - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

En rest..

fix i hijackthis:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uelpb.dll/sp.html#93256%resultposition.net

find og slet:
C:\WINDOWS\system32\uelpb.dll

genstart og ny hijackthis log