MIn PC genstarter!!

... et eller andet 'snavs'/virus har lagt [REBOOT.EXE] ind i din startup. Du har selv accepteret dette via "Microsoft Antispyware"'s meddelsesbox [Ønsker du programmer REBOOT.EXE skal lægges ind i din startup J/N ?] ... husker du så noget i den retning - tihi...

Lige når du logger ind så med det samme HOLD VENSTRE SHIFT TAST NEDE - så 'glemmes' elementer i din STARTUP.
Prøv om det er nok ?

Derefter
[Start][Kør][MSConfig] - Fanen START - fraklik 'mistænkelige' elementer - OK - Genstart...
eller
http://www.mlin.net/StartupCPL.shtml (Oprete [StartUP] icon i kontrolpanel. Her ka' du også/let fraklikke startup elementer..

Generelt:
I Mappen \WINDOWS\Prefetch  ligger en stabel *.pf fil(er) som hjælper Windows til hurtiger at køre brugte programmer. Alle *.pf filer ka' godt slettes manuelt; de bliver automatisk oprettet af XP efter behov..

OK cool... så er det nemmeste ikke bare at slette den?? Kan jeg evt. finde ud af, hvilket program eller lignende, der har oprettet den?? (så jeg evt. kan undlade at bruge det program)

... og især slette den i StartUp ...

Blev du klogere ???

Ja tak tak, jeg fik slettet "reboot"-filen og alt syntes ok... men idag gentog det hele sig, men denne gang var der ikke nogen "reboot"-fil til stede !?!?  Fik dog logget på og vil lige se hvordan det kører næste gang jeg starter op.. vender snart tilbage!!

... så er der nok (selvfølgelig/desværre/naturligvis/måske/...) efterladt mere 'snavs'/virus på din putter...

Følg proceduren her -> http://www.eksperten.dk/artikler/755

(Ikke nødvendigvis mig der følger op...)

Jeps, den driller stadig... følger lige dine anvisninger og vender tilbage ;-)

Så har jeg scannet med Dr.Web, Ewido og Hijackthis... her er rapporterne:

Dr.Web:
Scan statistics
Objects scanned: 88356
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 5
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 5
Objects moved: 0
Objects ignored: 0
Scan speed: 110 Kb/s
Scan time: 00:47:21

Ewido:

+ Oprettet den:            16:10:32, 14-02-2006
+ Rapport-Checksum:        FBBC65A7

+ Scanningsresultat:
    HKLM\SOFTWARE\180solutions -> Adware.180Solutions : Renset med backup
    HKLM\SYSTEM\CurrentControlSet\Services\WinIK -> Adware.CommonName : Renset med backup
    HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Security -> Adware.CommonName : Renset med backup
    C:\Documents and Settings\Laila\Cookies\laila@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Laila\Cookies\laila@atdmt[1].txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\Laila\Cookies\laila@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@ads1.revenue[1].txt -> TrackingCookie.Revenue : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@burstnet[1].txt -> TrackingCookie.Burstnet : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@c.enhance[1].txt -> TrackingCookie.Enhance : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@chicagosuntimes.122.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@cnetasiapacific.122.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@cnetaustralia.122.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@cneteurope.122.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@com[2].txt -> TrackingCookie.Com : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wfk4skczceq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wfkouodpcep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wfkyqjdpolq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wfmigmcpkep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wglokoczoeq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjkosidziko.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjkowocpkdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjkyandzgkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjl4gncjcbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjl4umdzakq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjlokkazsgq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjlospcpkeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjlowmdzshp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjlyghd5kgq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjlyooc5scq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjmywmdzsfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjnyepdjsep.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjnygjajsfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjnygndjokp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@e-2dj6wjnyooc5slq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@image.masterstats[1].txt -> TrackingCookie.Masterstats : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@ivwbox[2].txt -> TrackingCookie.Ivwbox : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@paypopup[1].txt -> TrackingCookie.Paypopup : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@tacoda[2].txt -> TrackingCookie.Tacoda : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Renset med backup
    C:\Documents and Settings\Uffe\Cookies\uffe@yadro[2].txt -> TrackingCookie.Yadro : Renset med backup
    C:\Documents and Settings\Uffe\Lokale indstillinger\Temp\inetkw.#xe -> Adware.CommonName : Renset med backup
    C:\WINDOWS\system32\usrswpia.dll.#cf -> Trojan.BHO.b : Renset med backup

Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 16:12:05, on 14-02-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Documents and Settings\Uffe\Skrivebord\REBOOT problem\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - C:\Programmer\iFinger\plugins\IE.ifp
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O2 - BHO: (no name) - {E7358476-7F91-4907-A3AE-7EA486A0ED31} - C:\WINDOWS\system32\usrswpia.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
O4 - HKLM\..\Run: [ZEFHR5ox] C:\PROGRA~1\pvpxuuvt\bUQAEgxN.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Programmer\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: iFinger 2.0.lnk = C:\Programmer\iFinger\iFinger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\system32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {3D6DDD23-870A-4FC8-B3AF-5F67C935A9B7} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-1204.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {ABCCB0F0-514E-4BA6-989D-C67E5DBC2946} - https://download.danskebank.dk/download/keydownload/DB/KeyDownload.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe

Håber du/I kan hjælpe ;-)

I ovenstående link http://www.eksperten.dk/artikler/755 anbefales det at poste under "virus"-kategorien, så det er hermed gjort --> http://www.eksperten.dk/spm/688140  ..dr1 og andre kan bare svare her og i den anden, så er der flere point ;-)

Jeg ser på loggen :-)

Jeg har lagt svaret ovre i den anden tråd. :-)

Ping...

Læg selv et [svar] og la' os alle dele...

Jeg får bare mine point ovre i den anden tråd. I øvrigt så er jeg ikke sikker på, at rensningen af computeren vil løse problemet med genstarter. Så vidt jeg husker er det ikke typisk for Winik, at den får computeren til at genstarte. Men nu må vi jo se...

-- men det kunne derfor måske være en ide at holde denne tråd åben, til rensningen er ført til ende :-)

dr1: Kan du ikke lige lægge et svar på din tidligere brugers vegne i denne tråd:
http://www.eksperten.dk/spm/636880

Så er problemet (forhåbentlig løst)...
Point til dr1 for hjæpen med "reboot" (selv om jeg meget bedre kan lide DR2)

Smid et svar amigo ;-)