Avatar billede aare_o Nybegynder
01. maj 2006 - 16:51 Der er 9 kommentarer og
2 løsninger

Dr. web, Super antispyware og Hijackthis

Læste lige denne artikel og der kom dette resultat. Håber der er nogle der gider kigge på det og kan hjælpe mig.
<url>http://www.eksperten.dk/artikler/954<url/>
Dr. web
Scan statistics

Objects scanned: 12
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1323 Kb/s
Scan time: 00:00:01

SUPERAntiSpyware Scan Log
Generated 05/01/2006 at 04:27 PM

Core Rules Database Version : 2906
Trace Rules Database Version: 1038

Memory threats detected  : 0
Registry threats detected : 31
File threats detected    : 33

Trojan.GimmySmilies
    [newname] C:\windows\newname16.exe
    C:\windows\newname16.exe
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\698N7SFC\newname16[1].exe
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\733CCY77\newname15[1].exe
    C:\WINDOWS\newname15.exe
    C:\WINDOWS\Prefetch\NEWNAME15.EXE-0564CA60.pf

Trojan.ZQuest
    HKLM\Software\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}
    HKCR\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}
    HKCR\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}
    HKCR\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}\InProcServer32
    HKCR\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}\InProcServer32#ThreadingModel
    C:\WINDOWS\DH.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6001CDF7-6F45-471b-A203-0225615E35A7}

Adware.Tracking Cookie
    C:\Documents and Settings\Lasse\Cookies\lasse@adtech[1].txt
    C:\Documents and Settings\Lasse\Cookies\lasse@mmm.media-motor[1].txt
    C:\Documents and Settings\Lasse\Cookies\lasse@mediaplex[1].txt
    C:\Documents and Settings\Lasse\Cookies\lasse@track.adform[2].txt
    C:\Documents and Settings\Lasse\Cookies\lasse@www.popupsandbanners[2].txt
    C:\Documents and Settings\LocalService\Cookies\system@banners.searchingbooth[1].txt
    C:\Documents and Settings\LocalService\Cookies\system@media.top-banners[1].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@ad.yieldmanager[1].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@http.edge.vru4[2].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@microsoftwga.112.2o7[1].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@mmm.media-motor[2].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@toplist[1].txt
    C:\Documents and Settings\Sidse\Cookies\sidse@www.popupsandbanners[2].txt

Adware.WebHancer
    HKLM\Software\WebHancer
    HKLM\Software\WebHancer#BaseDir
    HKLM\Software\WebHancer\CC
    HKLM\Software\WebHancer\CC#DistTag
    HKLM\Software\WebHancer\CC#id
    C:\Programmer\WEBHANCER\Programs\whAgent.ini
    C:\Programmer\WEBHANCER\Programs
    C:\Programmer\WEBHANCER
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\733CCY77\WHCC2[1].exe
    C:\WHCC2.exe

Adware.Director
    HKU\.DEFAULT\Software\Director
    HKU\S-1-5-18\Software\Director

Trojan.SmartLoad
    HKLM\Software\Microsoft\drsmartload2
    HKLM\Software\Microsoft\drsmartload2#Installed
    C:\WINDOWS\drsmartload2.dat

Browser Hijacker.Internet Explorer Settings Hijack
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Start Page [ http://www.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Start Page [ http://www.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-21-1409082233-2111687655-1957994488-1004\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKLM\Software\Microsoft\Internet Explorer\Main#Search Page [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-21-1409082233-2111687655-1957994488-1004\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main#Search Bar [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-21-1409082233-2111687655-1957994488-1004\Software\Microsoft\Internet Explorer\Main#Search Bar [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main#Search Bar [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-21-1409082233-2111687655-1957994488-1004\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]

Trojan.MC Downloader Variant
    C:\Documents and Settings\Lasse\DoctorWeb\Quarantine\mc-110-12-0000336.exe

Trojan.Unknown Origin
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\733CCY77\sk02[1].exe
    C:\WINDOWS\teller2.chk

Trojan.DollarRevenue
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\8IU3KO4H\drsmartload45a[1].exe
    C:\RECYCLER\S-1-5-21-1409082233-2111687655-1957994488-1004\Dc4.exe
    C:\WINDOWS\drsmartload45a.#xe

Adware.Unknown Origin
    C:\WINDOWS\system32\ad.html

Unclassified.Unknown Origin/System
    C:\WINDOWS\system32\winocx.exe


Logfile of HijackThis v1.99.1
Scan saved at 16:39:44, on 1-05-2006
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\windows\mousepad16.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\devldr32.exe
C:\Documents and Settings\Lasse\Dokumenter\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.the-click.info/mediam.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {10715114-DCCC-4214-A241-E15A93FBC4FA} - \
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad16.exe
O4 - HKLM\..\Run: [WinFix service] faomlxgi.exe
O4 - HKLM\..\Run: [dll services] fvbzohgvd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunServices: [WinFix service] faomlxgi.exe
O4 - HKLM\..\RunServices: [dll services] fvbzohgvd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146412864341
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows System Tray - Unknown owner - C:\WINDOWS\systay.exe (file missing)
Avatar billede ejvindh Ekspert
01. maj 2006 - 19:49 #1
Jeg kigger den igennem :-)
Avatar billede ejvindh Ekspert
01. maj 2006 - 19:55 #2
-- Hent Ewido herfra (14 dages version af plus-versionen)
http://www.spywarefri.dk/downloads1/ewido-setup.exe
Installer og opdater programmet. Vent med at scanne.

-- Hent Brute Force Uninstaller, og pak det ud til sin egen mappe (c:\BFU):
http://www.merijn.org/files/bfu.zip

-- Højreklik på følgende link, og vælg "Gem som" for at downloade Alcan Remover. Gem det i samme mappe som du gemte Brute Force Uninstaller i (c:\BFU):
http://metallica.geekstogo.com/alcanshorty.bfu

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Klik på "Min computer", og naviger frem til c:\BFU mappen. Dobbeltklik på BFU.exe. I det vindue som nu dukker frem skal du copy/paste denne linie ind:
c:\bfu\alcanshorty.bfu

Klik herefter på "execute", og lad programmet gøre sit arbejde. Vent  and let it do it’s job. Når scriptet er færdig, klikker du på OK, og derefter på EXIT.

-- Kør en fuld scanning med Ewido, og tillad programmet at fixe de ting, som det finder. Programmet laver en lille log, som du skal kopiere herind.

-- Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.the-click.info/mediam.html
O2 - BHO: (no name) - {10715114-DCCC-4214-A241-E15A93FBC4FA} - \
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad16.exe
O4 - HKLM\..\Run: [WinFix service] faomlxgi.exe
O4 - HKLM\..\Run: [dll services] fvbzohgvd.exe
O4 - HKLM\..\RunServices: [WinFix service] faomlxgi.exe
O4 - HKLM\..\RunServices: [dll services] fvbzohgvd.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

-- Genstart til normal tilstand.

-- Klik på Start-kør. Skriv: Services.msc, og klik på OK.
Find følgende services, højreklik på dem og vælg egenskaber. Under starttype vælger du deaktiveret. Klik også på Stop:
Windows System Tray

-- Genstart herefter computeren nok engang, og læg en frisk Hijackthislog herind, sammen med loggen fra Ewido.
Avatar billede aare_o Nybegynder
02. maj 2006 - 17:35 #3
Okay tak det vil jeg gøre i morgen.
Avatar billede aare_o Nybegynder
03. maj 2006 - 21:42 #4
---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            21:06:14, 3-05-2006
+ Rapport-Checksum:        27D7C2C3

+ Scanningsresultat:
    C:\Documents and Settings\Camilla\Cookies\camilla@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Camilla\Cookies\camilla@project2.realtracker[1].txt -> TrackingCookie.Realtracker : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@advertising[1].txt -> TrackingCookie.Advertising : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@project2.realtracker[1].txt -> TrackingCookie.Realtracker : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@sel.as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Emma\Cookies\emma@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@adtech[2].txt -> TrackingCookie.Adtech : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@atdmt[2].txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@casalemedia[1].txt -> TrackingCookie.Casalemedia : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@ehg.hitbox[2].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@fastclick[2].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@hitbox[2].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@media.fastclick[2].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@mediaplex[1].txt -> TrackingCookie.Mediaplex : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@overture[1].txt -> TrackingCookie.Overture : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@sel.as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Renset med backup
    C:\Documents and Settings\Lasse\Cookies\lasse@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Renset med backup
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\733CCY77\drsmartload[1].exe -> Downloader.Adload.ba : Renset med backup
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\733CCY77\mousepad16[1].exe -> Trojan.VB.ali : Renset med backup
    C:\Documents and Settings\LocalService\Lokale indstillinger\Temporary Internet Files\Content.IE5\8IU3KO4H\gimmysmileys[2].#xe -> Adware.180Solutions : Renset med backup
    C:\RECYCLER\S-1-5-21-1409082233-2111687655-1957994488-1004\Dc3.exe -> Downloader.Adload.ba : Renset med backup
    C:\VSL.dl_ -> Downloader.Small.ctp : Renset med backup
    C:\WINDOWS\gimmysmileys.#xe -> Adware.180Solutions : Renset med backup


::Rapport slut

Logfile of HijackThis v1.99.1
Scan saved at 21:40:35, on 3-05-2006
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\devldr32.exe
C:\Documents and Settings\Lasse\Dokumenter\Programmer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google-søgning - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Oversæt engelsk ord - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lignende sider - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Tilbage via links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Øjebliksbillede af side i cache - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146412864341
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
Avatar billede ejvindh Ekspert
03. maj 2006 - 21:53 #5
Loggen er ren. Har du også fået løst dit problem?

For at gøre arbejdet helt færdig:
Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så kan det også være en god ide at skjule dine systemfiler og -mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Det kan også være en god ide at få renset ud i dine midlertidige filer. Det kan gøres på en hurtig og nem måde med denne fil
www.spywareinfo.dk/download/cleantempxp2k.bat
---------------------------

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Du finder links og gode råd her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg vil også foreslå, at du læser denne artikel om hvordan du kan undgå at blive inficeret i fremtiden:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
03. maj 2006 - 22:06 #6
ServicePack2 ? WindowsUpdate ?
Avatar billede ejvindh Ekspert
04. maj 2006 - 11:16 #7
04. maj 2006 - 11:21 #8
... nu får vi se / læse om <aare_o> har forstået det...
Avatar billede aare_o Nybegynder
04. maj 2006 - 11:24 #9
Det er der for jeg ikke har opdateret i nu, ville sikre at alt er væk.
Avatar billede ejvindh Ekspert
10. maj 2006 - 10:37 #10
Husk at lukke spørgsmålet :-)
Avatar billede ejvindh Ekspert
07. juni 2006 - 11:59 #11
Husk at lukke spørgsmålet.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester