Er den helt gal eller hva'?

kigger

Du skal hente 2 scannere..

Først Dr.Web:
Hent og installer denne scanner:
http://www.superantispyware.com/downloads/SUPERAntiSpyware1241.exe
Start programmet, klik på Check for updates, når det er opdateret, luk programmet
(men lad være med at scanne endnu).

-----

Derefter SAS:
Hent denne scanner.
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
(men lad være med at scanne endnu).


--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
(Når du er erklæret ren igen, skal du huske at sætte indstillingerne tilbage)

--------------------------------------------------------------------

Hent denne bats fil og kør den :
http://www.spywareinfo.dk/download/cleantempxp2k.bat
den sletter alt i din temp mappe.


Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)


Du skal nu til at i gang med at fixe:
Kør Hijackthis, scan, sæt flueben ved linien/linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.

O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)

O4 - HKLM\..\Run: [winupdates] C:\Programmer\winupdates\winupdates.exe /auto

Find og slet den/disse manuelt:

C:\Programmer\winupdates<- hele mappen


Scan med Dr.web:
Dobbeltklik på drweb-cureit.exe, den vil køre en expressscan, det siger du ja til.
Når den skriver Done nederst til venstre, skal du klikke på Options->Change settings.
Skift til fanebladet Scan, fjern fluebenet ved Heuristic analysis.
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Rename.
Klik så på det eller de drev du vil have scannet, der kommer en rød prik for at vise det/de er valgt.

Klik så på den grønne pil ovre til højre på siden, så starter scanningen.
Første gang Dr.Web finder noget, klik "Yes to All", så fjerner den hvad den finder.
Klik så på Start->Søg, find filen drweb32w.log kopier det nederste af teksten herind, startende med:
Scan statistics.

-----

Scan med SAS:
Start programmet, klik på Scan your Computer, sæt flueben i de drev der skal scannes.
(Fixed disk betyder harddisk)
Flyt prikken til Perform complete scan og klik på Næste, så kører scanningen.

Når den er færdig kommer der et vindue med en opsummering, klik på OK, klik så på næste og så på Udfør.

Der kommer et vindue med Quarantine and removal Complete, klik på OK, klik på Udfør.
Luk programmet.

Start SuperAntiSpyware igen, klik på Preferences, skift til fanebladet Statistics/Logs, i vinduet dobbeltklikker du på SUPERAntiSpyware Scan Log, den åbner i notesblok, kopier resultatet herind.

Genstart og kom med en ny hijackthiss log samt logsne fra dr.web og SAS..

Jeg går i gang!

Jeg HAR kørt Dr. Web, men den kan ikke finde drweb32w.log efterfølgende!?!?!?!


SUPERAntiSpyware Scan Log
Generated 06/10/2006 at 11:28 AM

Core Rules Database Version : 2972
Trace Rules Database Version: 1071

Memory threats detected  : 0
Registry threats detected : 38
File threats detected    : 82

Trojan.TaskDir
    [taskdir] C:\WINDOWS\system32\taskdir.exe
    C:\WINDOWS\system32\taskdir.exe

Adware.Tracking Cookie
    C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@c.enhance[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adtech[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@media.fastclick[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@valueclick[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.realtechnetwork[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.as4x.tmcs[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adfair[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@webstat[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@52412438[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@1071427968[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ehg-ati.hitbox[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.estart[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@bannere.fyens[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@statse.webtrendslive[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@sextracker[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@revsci[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.planetactive[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adrevolver[3].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@banner.cdpoker[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@e2.emediate[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@counter13.sextracker[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@stat.onestat[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@lynxtrack[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@tracker.snatchblog[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adrevolver[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@cgi-bin[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@globalstat[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@www.spyiblock[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@cgi-bin[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@servedby.advertising[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@stats1.reliablestats[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@sexlist[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adecn[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@as1.falkag[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@image.masterstats[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@findwhat[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@revenue[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adopt.hbmediapro[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@cs.sexcounter[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@indextools[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ad[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@as-eu.falkag[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@server.iad.liveperson[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@clicktorrent[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@sel.as-eu.falkag[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adserver.adreactor[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@advertising[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ad1.emediate[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adserv.muchosucko[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@zedo[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ads.hveruge[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@mb[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@usenext[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@yieldmanager[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@hitbox[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@1071631171[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@track.adform[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@tripod.lycos[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@metacafe.122.2o7[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@ad.dumpalink[2].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@mb[3].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@www2.swebusexpress[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@adserver.banneradministration[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@1070847646[1].txt
    C:\Documents and Settings\Administrator\Cookies\administrator@1068856221[1].txt

Adware.WhenU
    HKCR\ACM.ACMFactory
    HKCR\ACM.ACMFactory\CLSID
    HKCR\ACM.ACMFactory\CurVer
    HKCR\ACM.ACMFactory.1
    HKCR\ACM.ACMFactory.1\CLSID
    HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
    HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
    HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
    HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
    HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib#Version
    HKCR\AppId\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}#AppID
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32#ThreadingModel
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
    HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
    HKCR\AppId\ACM.DLL
    HKCR\AppId\ACM.DLL#AppID
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
    HKCR\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
    HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
    HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
    HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
    HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
    HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib#Version
    HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
    HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
    HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
    HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
    HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib#Version

BearShare File Sharing Client
    C:\Programmer\BearShare\BearShare.exe
    C:\Documents and Settings\Administrator\Skrivebord\BearShare.lnk
    C:\Documents and Settings\All Users\Menuen Start\Programmer\BearShare.lnk
    D:\Download\P2P\BearShare Lite\BearShare.exe




Logfile of HijackThis v1.99.1
Scan saved at 13:23:25, on 10-06-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\SK-1300\mmkeymanager.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\programmer\powerstrip\pstrip.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\programmer\valve\steam\steam.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [AmitechKeyboard] C:\Programmer\SK-1300\mmkeymanager.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AtiPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programmer\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Send To &Bluetooth - C:\Programmer\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - https://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.3.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128211817227
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programmer\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Endnu engang har de vist deres værd, de 2 scannere..

Så er din log ren.

Efter sådan en tur er det altid en god ide og rydde op i dine systemgendannelses filerne.
Deaktiver systemgendannelse ( http://www.arlet.dk/systemgendannelsen.htm ) - genstart din computer - aktiver systemgendannelse.

Generel oprydning: http://www.arlet.dk/oprydning.htm

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan se her : www.arlet.dk/pakke.htm

Thx og husk nu at nyde det gode vejr - udendørs ;o)

Ja, nu må jeg lige et par timer ud i solen...