Nogen der kan kigge på denne hijack log.

Kigger på den ;)

Download free Trial af SuperAntiSpyware Pro til Skrivebordet:

http://www.superantispyware.com/downloads/SUPERAntiSpywarePro1241.exe

Installer den, og lad den opdatere med nyeste opdateringer.

Så vil den spørge om din mail adresse, det er op til dig selv om du vil udfylde det.Tryk så på Næste og Næste igen -Udfør.

Dansk vejledning her:
http://www.spywarefri.dk/manualer/superantispyware-manual.htm

Luk progammet.



Og denne -

Hent Ccleaner  http://www.ccleaner.com/ccdownload.asp
Installer programmet, men lad vær med at køre det endnu!
Husk at vælge dansk ved installationen.
Fjern flueben ved - Tilføj Yahoo Toolbar. Hvis du ikke ønsker den.
Ccleaner programmet fjerner overflødige Temp filer.
Og gør de nedenstående scanninger hurtigere






Genstart til fejlsikret tilstand. Du trykker f8 nogle gange når Windows starter op.


Kør CCleaner.
Tryk så på "Renser" i menuen i venstre side.
Nu skal du trykke på knappen "Kør Cleaner" - det gør du mindst 2 gange.
Luk programmet.



Start superantispyware ved at højreklikke på den gule og sorte bille ved uret
Tryk på - Scan for, Adware,Malware  - linjen
Tryk på - Preference - Knappen.
Fjern flueben ved -Start SuperAntiSpyware when Windows starts.

tryk på Fanebladet -Scanning control.

ved scanning options, skal der kun være flueben i de to nederste

Fanebladet- Real Time Protections. Fjerner du fluben ved - Enable Real Time Protection

Tryk så på Close

Tryk på - Scan Your computer - Knappen. sæt flueben ved de drev der skal scannes. Det er vigtigt at drev hvor Windows (systemdrevet) ligger, har et  flueben.

Flyt så prikken ved- Perform quick Scan,  ned til - Perform complete Scan.

Tryk på Næste, så går den i gang med at scanne.

Det kan godt tage lang tid hvis du har meget på computeren


Når scanninngen er færdig popper der en boks op, tryk OK.

Sæt flueben ved alt den har fundet- næste. Så vil den fixe/slette infektionerne.

Lad den genstarte.


Efter genstart -

Klik på "Start" - Vælg "Søg".
Klik på linket "Skift indstillinger".
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
Find:
superantispyware scan log


Send en ny hijackthis herind, sammen med Superantispyware loggen

Hej Magictouch.
Her er de to filer jeg skulle sende,undskyld det tog lidt tid men jeg kom sent hjem igår,og idag er jeg først tilstede iaften.
Engine version: 4.33 (4.33.3.06020)
Engine API version: 2.01
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crwtoday.cdb - 566 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43343.cdb - 1186 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43342.cdb - 744 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43341.cdb - 841 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43340.cdb - 822 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43339.cdb - 1071 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43338.cdb - 989 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43337.cdb - 855 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43336.cdb - 1297 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43335.cdb - 1195 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43334.cdb - 900 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43333.cdb - 1381 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43332.cdb - 1340 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43331.cdb - 2735 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43330.cdb - 2078 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43329.cdb - 2490 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43328.cdb - 743 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43327.cdb - 958 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43326.cdb - 793 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43325.cdb - 713 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43324.cdb - 655 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43323.cdb - 655 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43322.cdb - 778 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43321.cdb - 846 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43320.cdb - 808 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43319.cdb - 764 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43318.cdb - 838 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43317.cdb - 363 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43316.cdb - 730 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43315.cdb - 627 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43314.cdb - 824 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43313.cdb - 842 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43312.cdb - 830 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43311.cdb - 862 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43310.cdb - 853 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43309.cdb - 733 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43308.cdb - 708 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43307.cdb - 839 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43306.cdb - 930 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43305.cdb - 759 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43304.cdb - 721 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43303.cdb - 638 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43302.cdb - 806 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43301.cdb - 504 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crw43300.cdb - 24 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crwebase.cdb - 78674 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwrtoday.cdb - 145 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwr43301.cdb - 697 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crwrisky.cdb - 1271 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwntoday.cdb - 342 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwn43303.cdb - 766 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwn43302.cdb - 850 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\cwn43301.cdb - 773 virus records
[Virus base] C:\WINDOWS\TEMP\RarSFX0\crwnasty.cdb - 4867 virus records
Total virus records: 130019
Key file: C:\WINDOWS\TEMP\RarSFX0\cureit.key
License key number: 0000000010
Registered to: Dr.Web CureIt Project
License key activates: 2005-03-05
License key expires: 2007-03-05

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 0
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 0 Kb/s
Scan time: 00:00:00
-----------------------------------------------------------------------------

[Scan path] C:\WINDOWS\System32\smss.exe
[Scan path] C:\WINDOWS\system32\csrss.exe
[Scan path] C:\WINDOWS\system32\winlogon.exe
[Scan path] C:\WINDOWS\system32\services.exe
[Scan path] C:\WINDOWS\system32\lsass.exe
[Scan path] C:\WINDOWS\system32\svchost.exe
[Scan path] C:\WINDOWS\system32\spoolsv.exe
[Scan path] C:\WINDOWS\system32\Pavsrv.exe
[Scan path] C:\WINDOWS\system32\Avengine.exe
[Scan path] C:\WINDOWS\system32\wdfmgr.exe
[Scan path] C:\WINDOWS\System32\alg.exe
[Scan path] C:\WINDOWS\Explorer.EXE
[Scan path] C:\Programmer\Panda Software\Panda Antivirus Titanium\Apvxdwin.exe
[Scan path] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
[Scan path] C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
[Scan path] C:\Programmer\Panda Software\Panda Antivirus Titanium\pavProxy.exe
[Scan path] C:\WINDOWS\system32\wuauclt.exe
[Scan path] C:\Programmer\Neostrada TP\NeostradaTP.exe
[Scan path] C:\PROGRA~1\NEOSTR~1\ComComp.exe
[Scan path] C:\PROGRA~1\NEOSTR~1\Watch.exe
[Scan path] C:\WINDOWS\TEMP\RarSFX0\_start.exe
[Scan path] C:\WINDOWS\TEMP\RarSFX0\cureit.exe
[Scan path] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
[Scan path] C:\Programmer\Fælles filer\{AC25E024-069D-1030-0624-02032201002d}\Update.exe
C:\Programmer\Fælles filer\{AC25E024-069D-1030-0624-02032201002d}\Update.exe infected with Trojan.Starter.65 - will be cured after reboot

[Scan path] C:\WINDOWS\System32\CTFMON.EXE
[Scan path] C:\Documents and Settings\torben lind\Menuen Start\Programmer\Start\desktop.ini
[Scan path] C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\desktop.ini
[Scan path] C:\Programmer\SAGEM\SAGEM F@st 800-840\dslmon.exe
[Scan path] C:\WINDOWS\system32\mmsys.cpl
[Scan path] C:\WINDOWS\system32\icmui.dll
[Scan path] C:\WINDOWS\system32\rshx32.dll
[Scan path] C:\WINDOWS\system32\docprop.dll
[Scan path] C:\WINDOWS\system32\ntshrui.dll
[Scan path] C:\WINDOWS\System32\themeui.dll
[Scan path] C:\WINDOWS\system32\deskadp.dll
[Scan path] C:\WINDOWS\system32\deskmon.dll
[Scan path] C:\WINDOWS\system32\dssec.dll
[Scan path] C:\WINDOWS\system32\SlayerXP.dll
[Scan path] C:\WINDOWS\system32\shscrap.dll
[Scan path] C:\WINDOWS\system32\diskcopy.dll
[Scan path] C:\WINDOWS\system32\ntlanui2.dll
[Scan path] C:\WINDOWS\system32\printui.dll
[Scan path] C:\WINDOWS\system32\dskquoui.dll
[Scan path] C:\WINDOWS\system32\syncui.dll
[Scan path] C:\WINDOWS\System32\hticons.dll
[Scan path] C:\WINDOWS\system32\fontext.dll
[Scan path] C:\WINDOWS\system32\deskperf.dll
[Scan path] C:\WINDOWS\system32\cryptext.dll
[Scan path] C:\WINDOWS\system32\NETSHELL.dll
[Scan path] C:\WINDOWS\system32\wiashext.dll
[Scan path] C:\WINDOWS\System32\remotepg.dll
[Scan path] C:\WINDOWS\system32\wuaucpl.cpl
[Scan path] C:\WINDOWS\System32\wshext.dll
[Scan path] C:\Programmer\Fælles filer\System\Ole DB\oledb32.dll
[Scan path] C:\WINDOWS\System32\mstask.dll
[Scan path] C:\WINDOWS\system32\shdocvw.dll
[Scan path] C:\WINDOWS\System32\shmedia.dll
[Scan path] C:\WINDOWS\System32\browseui.dll
[Scan path] C:\WINDOWS\System32\sendmail.dll
[Scan path] C:\WINDOWS\System32\occache.dll
[Scan path] C:\WINDOWS\System32\webcheck.dll
[Scan path] C:\WINDOWS\System32\appwiz.cpl
[Scan path] C:\WINDOWS\system32\shimgvw.dll
[Scan path] C:\WINDOWS\System32\netplwiz.dll
[Scan path] C:\WINDOWS\System32\zipfldr.dll
[Scan path] C:\WINDOWS\System32\cdfview.dll
[Scan path] C:\WINDOWS\System32\msieftp.dll
[Scan path] C:\WINDOWS\System32\docprop2.dll
[Scan path] C:\WINDOWS\System32\dsquery.dll
[Scan path] C:\WINDOWS\System32\dsuiext.dll
[Scan path] C:\WINDOWS\System32\mydocs.dll
[Scan path] C:\WINDOWS\System32\cscui.dll
[Scan path] C:\WINDOWS\msagent\agentpsh.dll
[Scan path] C:\WINDOWS\System32\dfsshlex.dll
[Scan path] C:\WINDOWS\System32\photowiz.dll
[Scan path] C:\WINDOWS\System32\mmcshext.dll
[Scan path] C:\WINDOWS\system32\cabview.dll
[Scan path] C:\Programmer\Outlook Express\wabfind.dll
[Scan path] C:\WINDOWS\system32\wmpshell.dll
[Scan path] C:\WINDOWS\System32\twext.dll
[Scan path] C:\WINDOWS\System32\extmgr.dll
[Scan path] C:\Programmer\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL
[Scan path] C:\Programmer\WinAce\arcext.dll
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\Web Folders\MSONSEXT.DLL
[Scan path] C:\WINDOWS\system32\mscoree.dll
[Scan path] C:\WINDOWS\system32\dfshim.dll
[Scan path] C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
[Scan path] C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
[Scan path] C:\Programmer\Microsoft Office\Office12\msohev.dll
[Scan path] C:\PROGRA~1\FLLESF~1\MICROS~1\OFFICE12\msoshext.dll
[Scan path] C:\WINDOWS\system32\Audiodev.dll
[Scan path] C:\WINDOWS\system32\SHELL32.dll
[Scan path] C:\WINDOWS\System32\stobject.dll
[Scan path] C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[Scan path] C:\WINDOWS\System32\DRIVERS\ACPI.sys
[Scan path] C:\WINDOWS\System32\Drivers\adildr.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
[Scan path] C:\WINDOWS\system32\drivers\aec.sys
[Scan path] C:\WINDOWS\System32\drivers\afd.sys
[Scan path] C:\WINDOWS\system32\drivers\ALCXWDM.SYS
[Scan path] c:\windows\system32\svchost.exe
[Scan path] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\asyncmac.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\atapi.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\atmarpc.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\audstub.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\cdrom.sys
[Scan path] C:\WINDOWS\System32\cisvc.exe
[Scan path] C:\WINDOWS\system32\clipsrv.exe
[Scan path] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
[Scan path] c:\windows\system32\dllhost.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\disk.sys
[Scan path] c:\windows\system32\dmadmin.exe
[Scan path] C:\WINDOWS\System32\drivers\dmboot.sys
[Scan path] C:\WINDOWS\System32\drivers\dmio.sys
[Scan path] C:\WINDOWS\System32\drivers\dmload.sys
[Scan path] C:\WINDOWS\system32\drivers\DMusic.sys
[Scan path] C:\WINDOWS\system32\drivers\drmkaud.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\fdc.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\flpydisk.sys
[Scan path] C:\WINDOWS\system32\drivers\fltmgr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ftdisk.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\gameenum.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\msgpc.sys
[Scan path] C:\WINDOWS\System32\Drivers\HTTP.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\i8042prt.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\imapi.sys
[Scan path] C:\WINDOWS\System32\imapi.exe
[Scan path] C:\WINDOWS\system32\drivers\ip6fw.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipinip.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipnat.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ipsec.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\irenum.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\isapnp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\kbdclass.sys
[Scan path] C:\WINDOWS\system32\drivers\kmixer.sys
[Scan path] C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
[Scan path] C:\WINDOWS\System32\mnmsrvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\mouclass.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mrxdav.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
[Scan path] C:\WINDOWS\System32\msdtc.exe
[Scan path] c:\windows\system32\msiexec.exe
[Scan path] C:\WINDOWS\system32\drivers\MSKSSRV.sys
[Scan path] C:\WINDOWS\system32\drivers\MSPCLOCK.sys
[Scan path] C:\WINDOWS\system32\drivers\MSPQM.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\mssmbios.sys
[Scan path] C:\WINDOWS\system32\drivers\msmpu401.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndistapi.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndisuio.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ndiswan.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\netbios.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\netbt.sys
[Scan path] C:\WINDOWS\system32\netdde.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\nv4.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\OFFICE12\ODSERV.EXE
[Scan path] C:\WINDOWS\system32\OOD2000.exe
[Scan path] C:\Programmer\Fælles filer\Microsoft Shared\Source Engine\OSE.EXE
[Scan path] C:\WINDOWS\System32\DRIVERS\parport.sys
[Scan path] C:\WINDOWS\system32\drivers\pavdrv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\pci.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\pciide.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspptp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\processr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\psched.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\ptilink.sys
[Scan path] C:\WINDOWS\System32\Drivers\PxHelp20.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rasacd.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspppoe.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\raspti.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rdbss.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\rdpdr.sys
[Scan path] C:\WINDOWS\system32\sessmgr.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\redbook.sys
[Scan path] C:\WINDOWS\System32\locator.exe
[Scan path] C:\WINDOWS\System32\rsvp.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\RTL8139.SYS
[Scan path] C:\Programmer\SUPERAntiSpyware\SASDIFSV.SYS
[Scan path] C:\Programmer\SUPERAntiSpyware\SASENUM.SYS
[Scan path] C:\Programmer\SUPERAntiSpyware\SASKUTIL.sys
[Scan path] C:\WINDOWS\System32\SCardSvr.exe
[Scan path] C:\WINDOWS\system32\drivers\scsiport.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\secdrv.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\serenum.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\serial.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\sisagp.sys
[Scan path] C:\WINDOWS\system32\drivers\splitter.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\sr.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\srv.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\stealth.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\swenum.sys
[Scan path] C:\WINDOWS\system32\drivers\swmidi.sys
[Scan path] C:\WINDOWS\system32\drivers\sysaudio.sys
[Scan path] C:\WINDOWS\system32\smlogsvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\tcpip.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\termdd.sys
[Scan path] C:\WINDOWS\System32\tlntsvr.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\update.sys
[Scan path] C:\WINDOWS\System32\ups.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\usbhub.sys
[Scan path] C:\WINDOWS\System32\DRIVERS\usbohci.sys
[Scan path] C:\WINDOWS\system32\DRIVERS\usbscan.sys
[Scan path] C:\WINDOWS\System32\drivers\vga.sys
[Scan path] C:\WINDOWS\System32\vssvc.exe
[Scan path] C:\WINDOWS\System32\DRIVERS\wanarp.sys
[Scan path] C:\WINDOWS\system32\drivers\wdmaud.sys
[Scan path] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[Scan path] C:\WINDOWS\system32\ntsd.exe
-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 219
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1676 Kb/s
Scan time: 00:00:29
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 219
Infected objects found: 1
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1676 Kb/s
Scan time: 00:00:29
=============================================================================


Logfile of HijackThis v1.99.1
Scan saved at 07:24:36, on 17-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pavsrv.exe
C:\WINDOWS\system32\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Programmer\Java\jre1.5.0\bin\jusched.exe
C:\Programmer\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Programmer\Panda Software\Panda Antivirus Titanium\pavProxy.exe
C:\Programmer\Neostrada TP\NeostradaTP.exe
C:\Programmer\Neostrada TP\ComComp.exe
C:\Programmer\Neostrada TP\Watch.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\WinAce\WinAce.exe
C:\WINDOWS\TEMP\~AceTemp\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - Global Startup: DSLMON.lnk = C:\Programmer\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O8 - Extra context menu item: E&ksporter til Microsoft Excel - c:\programmer\microsoft office\office11\excel.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DAA3D90-F154-4A56-A723-7D39829DBD4C}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmer\Fælles filer\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs:  C:\WINDOWS\system32\rundll.dll
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\WINDOWS\SYSTEM32\pavsrv.exe

Helt i orden, jeg løber ingen steder ;) Men jeg er lidt spændt på at høre hvorfor du har kørt drweb ?  Jeg ville da hellere se en log fra Superantispyware, som jeg foreslog i mit indlæg, sammen med en ny hijackthis log. Så det ligner en "ommer" ;-)

Hej magictouch.
Det var en smutter,jeg skrev i søgekriterier kun superantispyware og fik et tekst dokument frem,men som du rigtig siger,det var det forkerte,men her følger det rigtige fra scanning i går aftes.UNDSKYLD

SUPERAntiSpyware Scan Log
Generated 07/16/2006 at 11:26 PM

Core Rules Database Version : 3019
Trace Rules Database Version: 1084

Memory threats detected  : 0
Registry threats detected : 0
File threats detected    : 4

BearShare File Sharing Client
    C:\Programmer\BearShare\BearShare.exe
    C:\Documents and Settings\All Users\Menuen Start\Programmer\BearShare.lnk
    C:\Documents and Settings\torben lind\Skrivebord\BearShare.lnk
    C:\WINDOWS\Prefetch\BEARSHARE.EXE-1F7FB804.pf

Helt i orden, selv stjerner kan fejle *S*

Kør en scanning med Hijackthis, så du kan se alle filer.

Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O20 - AppInit_DLLs:  C:\WINDOWS\system32\rundll.dll


Genstart til fejlsikret tilstand. Du trykker F8 nogle gange når Windows starter op.

Åbn Stifinder, gå op i værktøjslinjen, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Slet nedenstående filer og mapper, mærket med fedt. Bliv ikke forbavset  hvis du ikke kan finde alle filer  eller mapper, da de kan være fjernet automatisk under fixet med Hijackthis.




dll Filer:
C:\WINDOWS\system32\rundll.dll


Klik på "Start" - Vælg "Søg".
Klik på linket "Skift indstillinger".
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
Find og slet:
p2pnetworking.exe
popcorn72.exe
1.dat
2.dat
3.dat
msblank.html
winctrl16.exe
winctrl32.exe
winctrl64.exe

Genstart normalt, send en ny hijackthis log og fortæl hvordan den kører nu

Hej magictouch.
Jeg har ikke nogen pop up reklamer og jeg mener,at maskinen kører som før problemet.
Du har så sandelig fortjent dine point,læg et svar og de er dine,hvis der ikke er noget galt med hijack loggen,det er dejligt at kunne få noget hjælp på dansk når man opholder sig i Polen.
På forhånd mange tak for hjælpen.

Logfile of HijackThis v1.99.1
Scan saved at 20:39:10, on 18-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\OOD2000.exe
C:\WINDOWS\system32\pavsrv.exe
C:\WINDOWS\system32\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Programmer\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Programmer\Panda Software\Panda Antivirus Titanium\pavProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\WinAce\WinAce.exe
C:\WINDOWS\TEMP\~AceTemp\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - Global Startup: DSLMON.lnk = C:\Programmer\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - c:\programmer\microsoft office\office11\excel.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmer\Fælles filer\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\WINDOWS\SYSTEM32\pavsrv.exe

Med glæde, det anede mig at du ikke var lige i området, med den Startside *S*

Efter sådan en oprydning er det altid en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse, læs her hvordan:
http://www.spywareinfo.dk/index.htm#/tip-og-tricks/deaktiver_systemgendannelse.htm



Skjul system filerne igen –
Åbn Stifinder, gå op i værktøjslinjen, klik på Funktioner=>Mappeindstillinger=>Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt flueben ved "Skjul filtypenavne for kendte filtyper".
Flyt prikken væk fra "Vis skjulte filer og mapper".


For at sikre din pc fremover ville det være en god idé at bruge nogle af programmerne fra vores lille pakke som du kan se her:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Hej magictouch.
Jeg gør brug af dine råd til sikring af comp.,og her er dine velfortjente point.
Endnu engang tak for hjælpen.

Velbekomme, og tak for point *S*