HJT- rapport, nogen der vil kigge?

Generelt: Du ka' også rulle de andre procedure som her beskrevet -> http://www.eksperten.dk/artikler/755

(Ikke nødvendigvis mig der følger op..)

http://housecall.trendmicro.com/

http://www.pandasoftware.com/products/activescan?NRMODE=Published&NRORIGINALURL=%2factivescan%2f&NRNODEGUID=%7b3B202047-35D4-4DA2-B310-B1DBEC2971F2%7d&NRCACHEHINT=Guest

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Nu har jeg fulgt den generelle procedure:

Dr.Web
Scan Statistics:
=============================================================================
Total session statistics
=============================================================================
Objects scanned: 98542
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 1
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 981 Kb/s
Scan time: 00:58:52
=============================================================================

Ewido:
---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            12:16:20, 22-03-2006
+ Rapport-Checksum:        71ABC081

+ Scanningsresultat:
    HKLM\SOFTWARE\Classes\CLSID\{12355F3E-90C3-41AA-8705-15969AF7F210} -> Adware.Webdir : Renset med backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12355F3E-90C3-41AA-8705-15969AF7F210} -> Adware.Webdir : Renset med backup
    HKU\S-1-5-21-1801674531-1563985344-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12355F3E-90C3-41AA-8705-15969AF7F210} -> Adware.Webdir : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@adbrite[1].txt -> TrackingCookie.Adbrite : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@adtech[2].txt -> TrackingCookie.Adtech : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@advertising[2].txt -> TrackingCookie.Advertising : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@atdmt[2].txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@b.casalemedia[1].txt -> TrackingCookie.Casalemedia : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@bluestreak[2].txt -> TrackingCookie.Bluestreak : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@burstnet[1].txt -> TrackingCookie.Burstnet : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@c5.zedo[1].txt -> TrackingCookie.Zedo : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@casalemedia[1].txt -> TrackingCookie.Casalemedia : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@com[1].txt -> TrackingCookie.Com : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@cz7.clickzs[1].txt -> TrackingCookie.Clickzs : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@doubleclick[1].txt -> TrackingCookie.Doubleclick : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@e-2dj6wflyaicpmep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@e-2dj6wjnyqpdpcfo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@ehg-nokiafin.hitbox[2].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@fastclick[2].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@hitbox[2].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@image.masterstats[1].txt -> TrackingCookie.Masterstats : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@media.fastclick[1].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@mediaplex[1].txt -> TrackingCookie.Mediaplex : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@qksrv[2].txt -> TrackingCookie.Qksrv : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@questionmarket[2].txt -> TrackingCookie.Questionmarket : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@revenue[1].txt -> TrackingCookie.Revenue : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@sel.as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@spylog[1].txt -> TrackingCookie.Spylog : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@statcounter[1].txt -> TrackingCookie.Statcounter : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@tacoda[2].txt -> TrackingCookie.Tacoda : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@targetnet[2].txt -> TrackingCookie.Targetnet : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@trafficmp[1].txt -> TrackingCookie.Trafficmp : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@webstat[1].txt -> TrackingCookie.Web-stat : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@z1.adserver[1].txt -> TrackingCookie.Adserver : Renset med backup
    C:\Documents and Settings\DH\Cookies\dh@zedo[1].txt -> TrackingCookie.Zedo : Renset med backup
    C:\WINDOWS\vgraph.dll -> Adware.Webdir : Renset med backup


::Rapport slut

HJT-Rapport:
Logfile of HijackThis v1.99.1
Scan saved at 12:22:36, on 22-03-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmer\Toshiba\Windows Utilities\Hotkey.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programmer\Fælles filer\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\FLLESF~1\PCSuite\Services\SERVIC~1.EXE
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Active Desktop Calendar\ADC.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Free Download Manager\fdm.exe
C:\Programmer\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\FLLESF~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Drivere\Ajax\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Programmer\Toshiba\Windows Utilities\Hotkey.exe" /lang DK
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Programmer\Fælles filer\PCSuite\DataLayer\DataLayer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Programmer\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Free Download Manager] C:\Programmer\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [PcSync] C:\Programmer\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programmer\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programmer\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programmer\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programmer\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {3D6DDD23-870A-4FC8-B3AF-5F67C935A9B7} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-1204.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Jeg kigger den igennem.

Loggen er ren. Ewido og Dr.Web tog de ting, der var i den oprindelige log :-) Har det hjulpet på din computer?

Hmm, syntes stadig den er sløv i opstart, men det er sikkert bare fordi den ville ha godt af en format c:....:D

Eller også kan du prøve at gennemgå nogle af disse tricks:

1. Prøv at downloade og installere Ccleaner herfra:
http://www.ccleaner.com/

Kør en rensnings-procedure med programmet -- både under "Renser" og "Problemer" menuerne i programmet. Lad den fjerne alt hvad den finder. Genstart, og se om det har hjulpet.

2. Prøv at defragmentere din HD: Dobbeltklik på Denne Computer, højreklik på din HD, vælg Egenskaber-Funktioner-Defragmenter nu, og kør en defragmentering. Det kan godt tage lang tid. Genstart, og se om det har hjulpet.

3. Prøv et sfc-scan: Klik på Start=>Kør skriv: SFC /scannow  (husk mellemrum mellem SFC og /scannow)
Din windows skive skal sidde i drevet. Den tjekker og reparer dine systemfiler.

4. Prøv en repair: http://www.hcma.dk/tips1to10.htm#no4
Efter en repair er det vigtigt at gå ind og få opdateret windows-styresystemet (da styresystemet føres tilbage til det niveau som findes på din installations-skive):
http://windowsupdate.microsoft.com/

Genstart, og se om det har hjulpet.


5. Klik på start-kør, skriv devmgmt.msc og klik på OK.

Så åbner enhedshåndteringen. Klik på +-tegnet ud for "IDE ATA/ATAPI-controllere", og højreklik på "Primær IDE-kanal", og vælg Egenskaber. Klik på fanebladet "Avancerede indstillinger". Hvis der står "Kun PIO" ved overførsels-tilstanden, ved nogle af enhederne, kan det være årsagen til en langsom computer. Du kan prøve at ændre dette på 2 måder:

a. Prøv først at lave om på dette ved at skifte til "DMA, hvis den er tilgængelig", klik på OK, og genstart computeren. Hjalp det?

b. Hvis nej, så prøv igen at gå ind i enhedshåndteringen, Klik på +-tegnet ud for "IDE ATA/ATAPI-controllere", og højreklik på "Primær IDE-kanal", og vælg Egenskaber. Klik på fanebladet "Driver", og klik på fjern. Når processen er færdig skal du genstarte computeren, hvorved styresystemet nyinstallerer din HD, og giver den standard-indstillingerne.


6. Endelig er der også nogle forslag på dette link, som du kan afprøve:
http://www.spywareinfo.dk/index.htm#/tip-og-tricks/langsom-op-og-nedlukning-xp.htm