Highjack Log hjælp?

Kopier venligst alt fra loggen herind.

Logfile of HijackThis v1.97.3
Scan saved at 11:54:14 AM, on 25/05/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\snmp.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\tardisnt.exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\System32\msnserve.exe
C:\Programmer\TGTSoft\StyleXP\StyleXP.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\msiexec.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HiJackThis\HijackThis.exe

O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtsts.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [Microsoft Windows Protection] protected.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] msnserve.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Protection] protected.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] msnserve.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Microsoft Windows Protection] protected.exe
O4 - HKCU\..\RunServices: [Microsoft Windows Protection] protected.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc3.cab

Hvor er dit antivirusprogram?

Jeg er klar med vejledning om lidt.

Læs alle punkterne inden du gør noget.

(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe.

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtsts.dll
O4 - HKLM\..\Run: [Microsoft Windows Protection] protected.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] msnserve.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Protection] protected.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] msnserve.exe
O4 - HKCU\..\Run: [Microsoft Windows Protection] protected.exe
O4 - HKCU\..\RunServices: [Microsoft Windows Protection] protected.exe

(4)
Åbn en tilfældig mappe, i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende fil(er):
C:\WINDOWS\System32\msnserve.exe
C:\WINDOWS\system32\vtsts.dll
protected.exe
msnserve.exe

(5)
Start -> kør -> skriv "cleanmgr" -> Slet Temporary internet files, papirkurv og midlertidige filer. Gentag for alle dine drev.

(6)
Kør scanneren mwav.exe, og sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files. Tryk på Scan Clean.
Scanningen kan godt tage nogen tid.

(7)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind.

(8)
Når vi er helt færdige, så husk at aktiver systemgendannelse igen.

Det kunne nok være en god ide, at lave den næste HJT-log med en nyere version af programmet:
http://danborg.org/spy1/HJT/hijackthis.exe

Mit gæt vil være, at der vil ligge en O20-linie i denne log, som peger på C:\WINDOWS\system32\vtsts.dll.

Det er nemlig en Virtumonde-infektion ;-)

Det er korrekt som ejvindh skriver, at du bør bruge det nyeste version af hijackthis.

Jeg arbejder lige lidt på sagen....

Jeg har IKKE noget Anti-Virus program... er ved at finde en jeg kan købe...

Men se lige her:
File C:\WINDOWS\system32\vtsts.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\icont.exe tagged as not-a-virus:AdWare.Win32.AdURL.c. No Action Taken.
File C:\WINDOWS\System32\awtsr.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddaba.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddabx.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddaby.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddayx.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddccy.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ddcyw.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\gebca.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\gebcb.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\geebc.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\h6j4lg1q16.dll tagged as not-a-virus:AdWare.Win32.Look2Me.ab. No Action Taken.
File C:\WINDOWS\System32\jkhfe.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\jkhhf.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\jkkji.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\jkkjk.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mljgd.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mljgf.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mljjh.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mlljh.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mllmm.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mllmn.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\mtg4c32.dll tagged as not-a-virus:AdWare.Win32.Look2Me.ab. No Action Taken.
File C:\WINDOWS\System32\pmkhe.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\pmkhf.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\pmkjk.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ssqpn.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ssqpo.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\sstqn.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ssttt.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\ssttu.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\vtsts.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\vturo.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\vturr.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.
File C:\WINDOWS\System32\vtuts.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.bm. No Action Taken.

Nu har jeg været inde og slette alle de filer der er nævnt i listen...

Men der er 1 jeg bare ikke kan komme af med....

ejvindh: Jeg kan ikke komme af med den vtst.dll

Den Nye:
Logfile of HijackThis v1.99.1
Scan saved at 16:34:48, on 25-05-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\snmp.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\tardisnt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmer\TGTSoft\StyleXP\StyleXP.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\HiJackThis\hijackthis.exe
C:\WINDOWS\System32\wuauclt.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtsts.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\j66m0gj1e6o.dll (file missing)
O20 - Winlogon Notify: vtsts - C:\WINDOWS\SYSTEM32\vtsts.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlzIEdyYXZlcnNnYWFyZA\command.exe (file missing)
O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\System32\winjava.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programmer\Network Monitor\netmon.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Tardis time service (Tardis) - Unknown owner - C:\WINDOWS\System32\tardisnt.exe

Jeg er lige på vej ud af døren, men denne procedure burde kunne slå Virtumonde ned (der er flere ting i loggen, men de kan vist tages på almindelig vis):

-- Download dette fix til dit skrivebord:
http://www.atribune.org/ccount/click.php?id=4

-- Dobbeltklik på VundoFix.exe for at køre det. Sæt flueben ud for "Run VundoFix as a task". Du vil få en besked om at Vundofix vil lukke og genåbne indenfor ca. et minut. Klik på OK.

-- Når Vundofix genåbner, skal du klikke på "Scan for Vundo"-knappen.

-- Når den er færdig med at scanne, skal du klikke på "Remove Vundo"-knappen.

-- Du vil så blive spurgt om du er sikker på, at du vil fjerne filerne. Her skal du klikke på "Yes". Herefter bliver dit skrivebord blankt, og fixet vil forsøge at fjerne Vundo. Når den er færdig, vil værktøjet have lov til at lukke computeren ned. Det skal du acceptere.

-- Genstart herefter computeren, og lav en ny log med HJT, som du lægger herind.

Logfile of HijackThis v1.99.1
Scan saved at 18:02:41, on 25-05-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\snmp.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\tardisnt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmer\TGTSoft\StyleXP\StyleXP.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Virus Tools\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\j66m0gj1e6o.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlzIEdyYXZlcnNnYWFyZA\command.exe (file missing)
O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\System32\winjava.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programmer\Network Monitor\netmon.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Tardis time service (Tardis) - Unknown owner - C:\WINDOWS\System32\tardisnt.exe

http://www.spywarefri.dk/downloads1/ewido-setup.exe
Installer og opdater programmet. Kør en fuld scanning med Ewido, og tillad programmet at fixe de ting, som det finder. Programmet laver en lille log, som du skal kopiere herind.

Jeg synes jeg har installeret programmer nok!

Er HighJack Log ikke ok??

Nej

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            20:21:53, 25-05-2006
+ Rapport-Checksum:        73553837

+ Scanningsresultat:
    :mozilla.6:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Adtech : Renset med backup
    :mozilla.7:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Adtech : Renset med backup
    :mozilla.22:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.33:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.2o7 : Renset med backup
    :mozilla.34:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.2o7 : Renset med backup
    :mozilla.35:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.2o7 : Renset med backup
    :mozilla.36:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.2o7 : Renset med backup
    :mozilla.38:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.2o7 : Renset med backup
    :mozilla.40:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Doubleclick : Renset med backup
    :mozilla.43:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Advertising : Renset med backup
    :mozilla.59:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.60:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.66:C:\Documents and Settings\Dennis\Application Data\Mozilla\Firefox\Profiles\6ts118dd.default\cookies.txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\Dennis\Cookies\dennis@atdmt[2].txt -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.11:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.12:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.13:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.19:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000012.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.8:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.9:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.16:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.17:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000014.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.7:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.8:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.16:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.17:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000015.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.7:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.8:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.16:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.17:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000022.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.6:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.7:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.16:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.17:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000023.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.7:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.9:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.16:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.17:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.18:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.24:C:\RECYCLER\NPROTECT\00000139.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.10:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.11:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.19:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.20:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.21:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.27:C:\RECYCLER\NPROTECT\00000142.MOZ -> TrackingCookie.Atdmt : Renset med backup
    :mozilla.7:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.8:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Adtech : Renset med backup
    :mozilla.19:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Mediaplex : Renset med backup
    :mozilla.20:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.21:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Qksrv : Renset med backup
    :mozilla.27:C:\RECYCLER\NPROTECT\00000143.MOZ -> TrackingCookie.Atdmt : Renset med backup
    C:\WINDOWS\system32\config\systemprofile\Dokumenter\Μicrosoft\nopdb.exe -> Downloader.PurityScan.cl : Renset med backup


::Rapport slut

Den ser ok ud :)

Nu skal vi så se en ny fra Hijackthis :)

Logfile of HijackThis v1.99.1
Scan saved at 20:51:10, on 25-05-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\snmp.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\tardisnt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmer\TGTSoft\StyleXP\StyleXP.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Virus Tools\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\j66m0gj1e6o.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlzIEdyYXZlcnNnYWFyZA\command.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\System32\winjava.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programmer\Network Monitor\netmon.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Tardis time service (Tardis) - Unknown owner - C:\WINDOWS\System32\tardisnt.exe

Fix:

O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\j66m0gj1e6o.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVubmlzIEdyYXZlcnNnYWFyZA\command.exe (file missing)
O23 - Service: Enables Java Support (Java) - Unknown owner - C:\WINDOWS\System32\winjava.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programmer\Network Monitor\netmon.exe (file missing)

Genstart og ny log

Svar?

Ny log?

Du får svar når loggen er godkendt ren.

Jeg har afleveret computeren tilbage, det var en bare skulle gøre ren for en ven... så jeg kan ikke sende en ny log desværre....

ok - så må vi gå ud fra den var ren :)