HJÆLP!! Jeg har fået ubudne gæster

Følg guiden herfra -> http://www.eksperten.dk/artikler/755 - som så mange andre...

(Ikke nødvendigvis mig der følger op...)

Du har vist prøvet noget i den retning før - tihi...

Har så scannet efter guiden - her er min gemte rapporter og log fil.
Scanning med ewido fik sparket noget ud af computeren, så jeg har ikke nogen pop up mere :-)

Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 99829
Infected objects found: 8
Objects with modifications found: 0
Suspicious objects found: 3
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 2
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 6
Objects renamed: 5
Objects moved: 0
Objects ignored: 0
Scan speed: 1338 Kb/s
Scan time: 00:36:42

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            17:57:16, 20-02-2006
+ Rapport-Checksum:        20FE5F6B

+ Scanningsresultat:
    HKLM\SOFTWARE\AKSoft -> Adware.AkSoft : Renset med backup
    HKLM\SOFTWARE\AKSoft\X-Tractor -> Adware.AkSoft : Renset med backup
    HKLM\SOFTWARE\Classes\CLSID\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22} -> Adware.Generic : Renset med backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -> Adware.Generic : Renset med backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -> Adware.Generic : Renset med backup
    HKU\S-1-5-21-583907252-842925246-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22} -> Adware.Generic : Renset med backup
    HKU\S-1-5-21-583907252-842925246-839522115-1004\Software\Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D} -> Adware.SpyFalcon : Renset med backup
    HKU\S-1-5-21-583907252-842925246-839522115-1004_Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D} -> Adware.SpyFalcon : Renset med backup
    C:\Documents and Settings\Bjarke\Cookies\bjarke@serving-sys[2].txt -> TrackingCookie.Serving-sys : Renset med backup
    C:\Documents and Settings\Morten\Cookies\morten@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Renset med backup
    C:\Documents and Settings\Morten\Cookies\morten@ilead.itrack[1].txt -> TrackingCookie.Itrack : Renset med backup
    C:\Documents and Settings\Morten\Lokale indstillinger\Temp\Cookies\morten@2o7[2].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Morten\Lokale indstillinger\Temp\Cookies\morten@ilead.itrack[1].txt -> TrackingCookie.Itrack : Renset med backup
    C:\Programmer\SpyFalcon -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\blacklist.txt -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\ignored.lst -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\Lang -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\Lang\English.ini -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\Logs -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\msvcp71.dll -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\msvcr71.dll -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\Quarantine -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\sf.ini -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\SpyFalcon.url -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\syg.db -> Adware.SpyFalcon : Renset med backup
    C:\Programmer\SpyFalcon\uninst.exe -> Adware.SpyFalcon : Renset med backup


::Rapport slut

Logfile of HijackThis v1.99.1
Scan saved at 17:59:45, on 20-02-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Norman\bin\ZLH.EXE
C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\Norman\Npf\BIN\NPFSVICE.EXE
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Npf\BIN\npfmsg2.exe
C:\WINDOWS\System32\alg.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Morten\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dr.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programmer\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Denne [ewido] er faktisk også ganske effektiv...

Jeg ka' heller ikke spore yderliger 'snavs' i din HiJackThis LOG...

.. bruger du denne "Messenger" ting ?

Ellers kvæl den eks med:
[Start]|[Kør]|[MSConfig] - Enter - Fanen START - fraklik "Messenger" [MSMSGS] linien - OK - Genstart...

Ping...

(Det var et [svar]...)

Nej bruger ikke min Messenger, er slået fra nu.
Men det er noget der undre mig. Min Windows Firewall bliver er slået fra. Når jeg slår den til, og genstarter er den slået fra igen.

Men tak for hjælpen :-))