virus øv øv

Logfile of HijackThis v1.99.1
Scan saved at 20:50:32, on 11-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ewido anti-spyware 4.0\ewido.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {EA0543B9-F67B-A389-5273-8A3A802D7290} - C:\WINDOWS\System32\hhwxzde.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O4 - HKLM\..\Run: [!ewido] "C:\Programmer\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunServices: [Microsoft Windows Protection] protected.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/errorsafe.com/www/download/2006/cabs/ErrorSafeFreeInstall_dk.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmer\ewido anti-spyware 4.0\guard.exe
O23 - Service: netconf32 - Unknown owner - C:\WINDOWS\netconf32.exe (file missing)
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\WINDOWS\update\updmangr.exe (file missing)



Hvad skal ændres her?

WinAntiVirusPro 2006 popper også op konstant uanset hvad jeg gør

Ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at:    20:17:14 11-07-2006

+ Scan result:   



C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\O7XRFR0Z\AppWrap[1].exe -> Adware.AdURL : Error during cleaning.
C:\WINDOWS\Temp\bw2.com -> Adware.AdURL : Error during cleaning.
C:\WINDOWS\SYSTEM32\guard.tmp -> Adware.Look2Me : Error during cleaning.
[1832] C:\WINDOWS\system32\wfbvw.dll -> Adware.Look2Me : Error during cleaning.
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\VSNK7UME\AppWrap[1].exe -> Adware.Zestyfind : Error during cleaning.
C:\WINDOWS\iconu.exe -> Adware.Zestyfind : Error during cleaning.
C:\WINDOWS\Downloaded Program Files\CONFLICT.10\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.11\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.12\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.13\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.14\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.15\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.16\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.17\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.18\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.19\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.20\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\WINDOWS\Downloaded Program Files\UERSK_0001_N68M2202NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Ignored.
C:\Documents and Settings\Ejer\Cookies\ejer@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Ejer\Cookies\ejer@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.


::Report end

Jeg ser på den :-)

-- Download dette fix til rodbiblioteket på din computer (som regel c:\):
http://www.atribune.org/ccount/click.php?id=4

-- Dobbeltklik på VundoFix.exe for at køre det. Sæt flueben ud for "Run VundoFix as a task". Du vil få en besked om at Vundofix vil lukke og genåbne indenfor ca. et minut. Klik på OK.

-- Når Vundofix genåbner, skal du klikke på "Scan for Vundo"-knappen.

-- Når den er færdig med at scanne, skal du klikke på "Remove Vundo"-knappen.

-- Du vil så blive spurgt om du er sikker på, at du vil fjerne filerne. Her skal du klikke på "Yes". Herefter bliver dit skrivebord blankt, og fixet vil forsøge at fjerne Vundo. Når den er færdig, vil værktøjet have lov til at lukke computeren ned. Det skal du acceptere.

-- Genstart herefter computeren.

-- Hent Look2Me-Destroyer herfra:
http://www.atribune.org/ccount/click.php?id=7
...og gem værktøjet på dit Skrivebord.

-- Luk alle åbne programvinduer - inklusiv Internet Explorer.

-- Dobbeltklik på Look2Me-Destroyer, sæt et flueben i "Run this program as a task". Du får en meddelelse om, at Look2Me-Destroyer vil lukke og åbne efter 10 sekunder - klik på OK.

Når Look2Me-Destroyer genåbner - klik på "Scan for L2M" - dine ikoner forsvinder - klik "Remove L2M". Klik OK når du får meddelelsen "Done scanning".

Nu får du meddelelsen "Done removing infected files!. Programmet vil lukke din computer - klik OK. Nu skal du finde filen C:\Look2Me-Destroyer.txt og c:\vundofix.txt og kopiere indholdet herind, sammen med en frisk HijackThis log.

-- Hvis din firewall vil blokere Look2Me-Destroyers adgang til nettet, så skal du lade programmet få adgang.
Hvis du får en runtime error 339, så skal du hente MSWINSCK.OCX herfra:
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
...og placere den i mappen C:\Windows\System32 Directory.

Det er smart lavet.

Jeg kan ikke hente den første EXE fil. har prøvet fra flere forskellige steder.

Now what?

Nu kom den :)

Hvad mener du med:

"- Hvis din firewall vil blokere Look2Me-Destroyers adgang til nettet, så skal du lade programmet få adgang.
Hvis du får en runtime error 339, så skal du hente MSWINSCK.OCX herfra:
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
...og placere den i mappen C:\Windows\System32 Directory."


Skal den netop ikke blokerer for det?

Den popper stadig op med forskellige ting :(

Her er logsne:


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 11-07-2006 21:55:14

Infected! C:\WINDOWS\system32\irnul5591.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000004.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000013.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000034.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000035.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000036.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000037.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000038.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000039.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000048.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000056.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000061.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000071.dll
Infected! C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000084.dll
Infected! C:\WINDOWS\SYSTEM32\irnul5591.dll
Infected! C:\WINDOWS\SYSTEM32\ixq.dll
Infected! C:\WINDOWS\SYSTEM32\l0p2la7o1d.dll
Infected! C:\WINDOWS\SYSTEM32\l4j8le1u1h.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\irnul5591.dll
C:\WINDOWS\system32\irnul5591.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000004.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000004.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000013.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000013.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000034.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000034.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000035.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000035.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000036.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000036.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000037.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000037.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000038.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000038.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000039.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000039.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000048.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000048.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000056.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000056.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000061.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000061.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000071.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000071.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000084.dll
C:\System Volume Information\_restore{D6521135-1503-42C0-A494-984EAB9506E4}\RP1\A0000084.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\SYSTEM32\irnul5591.dll
C:\WINDOWS\SYSTEM32\irnul5591.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\SYSTEM32\ixq.dll
C:\WINDOWS\SYSTEM32\ixq.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\SYSTEM32\l0p2la7o1d.dll
C:\WINDOWS\SYSTEM32\l0p2la7o1d.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\SYSTEM32\l4j8le1u1h.dll
C:\WINDOWS\SYSTEM32\l4j8le1u1h.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{9562663D-EC74-4464-A5BA-05461CF1CD09}"
HKCR\Clsid\{9562663D-EC74-4464-A5BA-05461CF1CD09}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{AC79F86B-D4B2-43AB-BC62-745F1B3A525A}"
HKCR\Clsid\{AC79F86B-D4B2-43AB-BC62-745F1B3A525A}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{EBC0D8F6-EE69-40AD-AD70-01146E3160C6}"
HKCR\Clsid\{EBC0D8F6-EE69-40AD-AD70-01146E3160C6}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F77FCC6D-2339-4E58-B1B2-ABBBC0A561BE}"
HKCR\Clsid\{F77FCC6D-2339-4E58-B1B2-ABBBC0A561BE}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3B5177E0-6992-4A7B-B714-06809F2D47CA}"
HKCR\Clsid\{3B5177E0-6992-4A7B-B714-06809F2D47CA}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{31FAFF56-43B2-41C8-A360-84ED3F051566}"
HKCR\Clsid\{31FAFF56-43B2-41C8-A360-84ED3F051566}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0A06552C-00A1-40C9-8A17-2BC5B4AB5608}"
HKCR\Clsid\{0A06552C-00A1-40C9-8A17-2BC5B4AB5608}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CCCDDAD8-04D5-4B63-9ABE-7084E20AC929}"
HKCR\Clsid\{CCCDDAD8-04D5-4B63-9ABE-7084E20AC929}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administratorer - Succeeded









Her er den anden:


VundoFix V5.1.1

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version...

Sun Java not detected
Scan started at 21:48:08 11-07-2006

Listing files found while scanning....

C:\windows\SYSTEM32\vtuts.dll
C:\windows\SYSTEM32\stutv.ini
C:\windows\SYSTEM32\stutv.bak1
C:\windows\SYSTEM32\stutv.bak2
C:\windows\SYSTEM32\stutv.ini2
C:\windows\SYSTEM32\stutv.tmp

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\windows\SYSTEM32\vtuts.dll
C:\windows\SYSTEM32\vtuts.dll Has been deleted!

Attempting to delete C:\windows\SYSTEM32\stutv.ini
C:\windows\SYSTEM32\stutv.ini Has been deleted!

Attempting to delete C:\windows\SYSTEM32\stutv.bak1
C:\windows\SYSTEM32\stutv.bak1 Has been deleted!

Attempting to delete C:\windows\SYSTEM32\stutv.bak2
C:\windows\SYSTEM32\stutv.bak2 Has been deleted!

Attempting to delete C:\windows\SYSTEM32\stutv.ini2
C:\windows\SYSTEM32\stutv.ini2 Has been deleted!

Attempting to delete C:\windows\SYSTEM32\stutv.tmp
C:\windows\SYSTEM32\stutv.tmp Has been deleted!

Performing Repairs to the registry.
Done!

Glemte HiJack:

Logfile of HijackThis v1.99.1
Scan saved at 22:01:37, on 11-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ewido anti-spyware 4.0\ewido.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {EA0543B9-F67B-A389-5273-8A3A802D7290} - C:\WINDOWS\System32\hhwxzde.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O4 - HKLM\..\Run: [!ewido] "C:\Programmer\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\RunServices: [Microsoft Windows Protection] protected.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/errorsafe.com/www/download/2006/cabs/ErrorSafeFreeInstall_dk.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmer\ewido anti-spyware 4.0\guard.exe
O23 - Service: netconf32 - Unknown owner - C:\WINDOWS\netconf32.exe (file missing)
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\WINDOWS\update\updmangr.exe (file missing)

Vi er heller ikke færdige endnu ;-)

-- Hent "SuperAntiSpyware free" herfra:
http://www.spywarefri.dk/downloads1.htm
Installer, og opdater scannereren. Men vent med at scanne.

Fuld vejledning til superantispyware finder du her:
http://www.spywarefri.dk/manualer/superantispyware-manual.htm

-- Klik på Start-kør. Skriv: Services.msc, og klik på OK.
Find følgende services, højreklik på dem og vælg egenskaber. Under starttype vælger du deaktiveret. Klik også på Stop:
netconf32
Windows Update Manager Tool

-- Klik Start-kør, skriv cmd, og klik på OK. I det sorte billede skriver du:
sc delete "netconf32" <efterfulgt af Enter>
sc delete "UpdateManagerTool" <efterfulgt af Enter>
Luk det sorte billede.

-- Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.
R3 - URLSearchHook: (no name) - {EA0543B9-F67B-A389-5273-8A3A802D7290} - C:\WINDOWS\System32\hhwxzde.dll (file missing)
O4 - HKCU\..\RunServices: [Microsoft Windows Protection] protected.exe
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/errorsafe.com/www/download/2006/cabs/ErrorSafeFreeInstall_dk.cab
O23 - Service: netconf32 - Unknown owner - C:\WINDOWS\netconf32.exe (file missing)
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\WINDOWS\update\updmangr.exe (file missing)

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Du skal nu til at slette. Som indledning hertil skal du have slået "Udvidet filvisning" til:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

-- Slet herefter følgende (hvis du kan finde dem):
Mapper:
C:\WINDOWS\update\

Filer:
C:\WINDOWS\System32\hhwxzde.dll
C:\WINDOWS\netconf32.exe

Søg efter denne fil, og slet den, hvis du finder den:
protected.exe

-- Start SuperAntispyware, klik "Scan your computer", sæt flueben i dine drev, ovre til venstre i vinduet. Ovre til højre i vinduet, sætter du prik i "Perform Complete Scan". Klik "næste", nu scanner den. Når den er færdig, så markerer du det den finder, og lader scannereren fjerne det.

-- Kør Ewido igen, og denne gang skal du tillade den at slette alt hvad den finder.

-- Genstart til normal tilstand. Åbn SuperAntispyware-scannereren igen, og klik "preferences"-> "stastics/logs". Marker loggen, og klik "View log". Kopier loggen her ind i tråden, sammen med en ny HijackThis log.

Den fandt ikke noget i Evido. Efter genstart kommer der stadig reklamer op:

SUPERAntiSpyware Scan Log
Generated 07/11/2006 at 10:51 PM

Core Rules Database Version : 3014
Trace Rules Database Version: 1080

Memory threats detected  : 0
Registry threats detected : 5
File threats detected    : 48

Trojan.WinUpdate
    [WinUpdate.exe] C:\Programmer\Windows\WinUpdate.exe
    C:\Programmer\Windows\WinUpdate.exe
    HKU\S-1-5-21-436374069-1450960922-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#WinUpdate.exe [ C:\Programmer\Windows\WinUpdate.exe ]

Unclassified.Unknown Origin
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{F2FA09FB-EE7A-46d8-9145-A1EEF7850052}

Adware.Tracking Cookie
    C:\Documents and Settings\Ejer\Cookies\ejer@adtech[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@tradedoubler[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@winantivirus[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@revsci[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@banner.cdpoker[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@dk.winantivirus[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@stats1.reliablestats[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@burstnet[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@go.winantivirus[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@mediaplex[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@media.top-banners[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@etc804-wavp6[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@ad.yieldmanager[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@www.burstnet[2].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@tacoda[1].txt
    C:\Documents and Settings\Ejer\Cookies\ejer@indexstats[1].txt
    C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\Cookies\ejer@media.top-banners[1].txt

Browser Hijacker.Internet Explorer Settings Hijack
    HKU\S-1-5-21-436374069-1450960922-682003330-1003\Software\Microsoft\Internet Explorer\Search\SearchAssistant Explorer\Main#Default_Search_URL [ http://searchbar.findthewebsiteyouneed.com ]

Adware.ClickSpring/Yazzle
    HKLM\Software\Snowball Wars

Browser Hijacker.Favorites
    C:\RECYCLER\S-1-5-21-436374069-1450960922-682003330-1003\Dc1.url
    C:\RECYCLER\S-1-5-21-436374069-1450960922-682003330-1003\Dc2.url
    C:\RECYCLER\S-1-5-21-436374069-1450960922-682003330-1003\Dc3.url

Trojan.ErrorSafe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.10\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.11\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.12\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.13\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.14\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.15\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.16\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.17\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.18\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.19\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.20\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.6\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.7\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.8\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\CONFLICT.9\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Downloaded Program Files\UERSK_0001_N68M2202NetInstaller.exe
    C:\WINDOWS\Prefetch\UERSK_0001_N68M2202NETINSTALL-1BE3293F.pf
    C:\WINDOWS\Prefetch\UERSK_0001_N68M2202NETINSTALL-2A28726F.pf

Trojan.Unknown Origin
    C:\WINDOWS\RGl0IGJydWdlcm5hdm4\l35XK3LVxqx5wAc1xAb.vbs
    C:\WINDOWS\uninstall_nmon.vbs

Unclassified.Unknown Origin/System
    C:\WINDOWS\SYSTEM32\flpwin.dll

Adware.ClickSpring/PuritySCAN
    C:\WINDOWS\SYSTEM32\wnsapisv.exe

HIJACKTHIS:

Logfile of HijackThis v1.99.1
Scan saved at 23:15:27, on 11-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ewido anti-spyware 4.0\ewido.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O4 - HKLM\..\Run: [!ewido] "C:\Programmer\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmer\ewido anti-spyware 4.0\guard.exe

Er den ren? :)

Ja, HJT-loggen er ren. Men mener du stadig der kommer popups? Hvis ja, så prøv lige at omdøbe Hijackthis.exe-programmet til HT.exe, og lav en ny log med den omdøbte fil, som du lægger herind.

Nej det stoppede. Mange tak for hjælpen. En anden gang hvordan kan jeg så vide at det er den fil jeg skal gå ind at slette?

Lyder dejligt :-)

Jeg kan ikke give dig en generel forklaring på, hvordan man identificerer infektioner, idet det kræver et godt kendskab til de mekanismer, som infektionerne arbejder efter. Jeg har skrevet en artikel, der indfører i arbejdet, men den har du læst kan jeg se (642).

Jeg takker for point :-)

For at gøre arbejdet helt færdig:
Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.
Og så kan det også være en god ide at skjule dine systemfiler og -mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Det kan også være en god ide at få renset ud i dine midlertidige filer. Det kan gøres på en hurtig og nem måde med denne fil
www.spywareinfo.dk/download/cleantempxp2k.bat
---------------------------

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Du finder links og gode råd her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg vil også foreslå, at du læser denne artikel om hvordan du kan undgå at blive inficeret i fremtiden:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414