Søg
Avatar billede djurhuus20 Nybegynder
10. december 2006 - 20:43 Der er 25 kommentarer

Trojansk hest

Kære Eksperten.dk

Modtog et link over messenger fra en kontaktperson på min liste. Efter trykket på denne, begyndte min computer per automatisk at sende det samme link til alle mine kontaktpersoner på msn. Jeg har nu en masse problemer med at komme på nettet i det hele taget. Den er lansom, kan ikke hente billederne på internetsiderne og åbner konstant reklamesider og andet, Hjælp! Jeg har virkelig ikke forstand på dette, og ved ikke hvorledes det skal håndteres. Har prøvet at køre forskellige virus programmer på min computer. De finder vira'et og meddeler at det bliver slettet, men ligemeget hjælper det. Det er der nemlig stadig bagefter.

Håber på et oprigtigt og helst grundigt svar.

Djurhuus20
Avatar billede Computer Hjælp (Gratis) Mester
10. december 2006 - 21:25 #1
Velkommen til Eksperten.dk
Generelt -> http://expfaq.1go.dk/
Avatar billede Computer Hjælp (Gratis) Mester
10. december 2006 - 21:25 #2
Gennemfør proceduren herfra ->
http://www.eksperten.dk/artikler/1021
- skal jeg nok følge op...
------------------------------------------------------------------------
Avatar billede djurhuus20 Nybegynder
13. december 2006 - 21:03 #3
Kære dr1

Her er de logs jeg blev bedt om at sætte ind. Forstår ikke meget af dem selv.

Ewido log:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            17:37:04, 12-12-2006
+ Report-Checksum:        3D862DA1

+ Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Classes\GSDA.GSDACtl\CLSID\\ -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Classes\GSDA.GSDACtl.1\CLSID\\ -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/gsda.dll\\.Owner -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/gsda.dll\\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1018.dll\\.Owner -> Spyware.Gator : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1018.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1101.dll\\.Owner -> Spyware.Gator : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1101.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/StarInstall.ocx\\.Owner -> Dialer.Generic : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/StarInstall.ocx\\{E0B795B4-FD95-4ABD-A375-27962EFCE8CF} -> Dialer.Generic : Cleaned with backup
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{669695BC-A811-4A9D-8CDF-BA8C795F261C} -> Spyware.PowerStrip : Cleaned with backup
    HKU\S-1-5-21-2306665932-2055962413-3641420591-1006\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{669695BC-A811-4A9D-8CDF-BA8C795F261C} -> Spyware.PowerStrip : Cleaned with backup
    HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{669695BC-A811-4A9D-8CDF-BA8C795F261C} -> Spyware.PowerStrip : Error during cleaning
    C:\Documents and Settings\Ask\Dokumenter\Billeder\SjovOgSpas\Stuff\Programmer\Nero.Burning.ROM.v6.3.0.3.Ultra.Edition-ORiON.ShareReactor.rar/Ahead.Nero.Burning.ROM.v6.3.0.3.Ultra.Edition.Incl.Keygen-ORiON\Keygen.exe -> TrojanDropper.Delf.gi : Cleaned with backup
    C:\Documents and Settings\Ask\Dokumenter\Billeder\SjovOgSpas\Stuff\Programmer\Real RealPlayer V9.0 (RealOne) Full Ver.rar/RealPlayer V9.0 (RealOne) Full Ver\RealOnePlayer.exe -> Backdoor.Optix.Pro.o : Cleaned with backup
    C:\Documents and Settings\Ask\Lokale indstillinger\Temp\Cookies\ask@com[1].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\Ask\Lokale indstillinger\Temp\Cookies\ask@download.com[1].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\Ask\Lokale indstillinger\Temp\__unin__.#xe -> Spyware.Altnet : Cleaned with backup
    C:\Programmer\WebSecureAlert\WebSecureAlert.#xe -> Adware.Gator : Cleaned with backup
    C:\Programmer\WebSecureAlert\WSAHelper.#ll -> Adware.Gator : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\gsda.#ll -> Dialer.Generic : Cleaned with backup
    C:\WINDOWS\installer[veo-10049,de].#xe -> Dialer.Generic : Cleaned with backup


::Report End

Superantispyware log:

SUPERAntiSpyware Scan Log
Generated 12/12/2006 at 03:33 PM

Application Version : 3.3.1020

Core Rules Database Version : 3146
Trace Rules Database Version: 1162

Scan type      : Complete Scan
Total Scan Time : 00:08:44

Memory items scanned      : 194
Memory threats detected  : 0
Registry items scanned    : 5910
Registry threats detected : 33
File items scanned        : 710
File threats detected    : 21

Trojan.Downloader-AVPMon
    [Recoveru systems] C:\DOCUME~1\ASK\LOKALE~1\TEMP\SVCHOST.EXE
    C:\DOCUME~1\ASK\LOKALE~1\TEMP\SVCHOST.EXE

Trojan.Downloader-RPCC
    Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc
    C:\WINDOWS\SYSTEM32\RPCC.DLL
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc#DllName
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc#Asynchronous
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc#Impersonate
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\rpcc#Startup

Adware.Tracking Cookie
    C:\Documents and Settings\Ask\Cookies\ask@adserver.banneradministration[1].txt
    C:\Documents and Settings\Ask\Cookies\ask@tradedoubler[2].txt
    C:\Documents and Settings\Ask\Cookies\ask@atdmt[2].txt
    C:\Documents and Settings\Ask\Cookies\ask@advertising[1].txt
    C:\Documents and Settings\Ask\Cookies\ask@mediaplex[1].txt
    C:\Documents and Settings\Ask\Cookies\ask@track.adform[1].txt
    C:\Documents and Settings\Ask\Cookies\ask@ad.yieldmanager[1].txt
    C:\Documents and Settings\Ask\Cookies\ask@adtech[1].txt

Trojan.WinAntiSpyware/WinAntiVirus 2006
    HKCR\AppId\WinPGI.DLL
    HKCR\AppId\WinPGI.DLL#AppID
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#Type
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#Start
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#Tag
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN#Group
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN\Security
    HKLM\SYSTEM\CurrentControlSet\Services\FOPN\Security#Security
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run#WinAntiVirusPro2006 [ "C:\Programmer\WinAntiVirus Pro 2006\WinAV.exe" /min ]
    C:\WINDOWS\system32\av.cpl
    C:\WINDOWS\system32\stera.exe

Adware.Avenue Media/Internet Optimizer
    HKU\S-1-5-21-2306665932-2055962413-3641420591-1006\Software\Microsoft\Internet Explorer\URLSearchHooks#_{CFBFAE00-17A6-11D0-99CB-00C04FD64497}

Adware.Toolbar888
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid32
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib#Version

Adware.ClickSpring/Yazzle
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#UninstallString

Adware.MyWay
    C:\Programmer\MyWay

Adware.IPWins
    HKU\S-1-5-21-2306665932-2055962413-3641420591-1006\Software\IpWins
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#UninstallString
    C:\Programmer\ipwins\ipwins.#xe
    C:\Programmer\ipwins\pop13.tmp
    C:\Programmer\ipwins\pop4B.tmp
    C:\Programmer\ipwins\pop5F.tmp
    C:\Programmer\ipwins\popF7.tmp
    C:\Programmer\ipwins\Services.dll
    C:\Programmer\ipwins\Uninst.exe
    C:\Programmer\ipwins

Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 17:54:04, on 12-12-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Virus Dr\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jucheck.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
c:\Programmer\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Virus Dr\halløj\belle.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/0406/bF7.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O2 - BHO: C:\WINDOWS\System32\zkPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\System32\zkPeCrypt.dll (file missing)
O2 - BHO: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [buKAZK7] C:\WINDOWS\chhafwj.exe
O4 - HKLM\..\Run: [Kdotunle] C:\Program Files\Imtdt\Fecn.exe
O4 - HKLM\..\Run: [Etlmhyze] C:\Program Files\Wgaonv\Abpewby.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [staveplade] "C:\Documents and Settings\Ask\Skrivebord\TVGuide\staveplade.exe"
O4 - HKCU\..\Run: [Ria] C:\Programmer\??crosoft\?xplorer.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\System32\z23041138246.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\WINDOWS\System32\z23041159317.exe "
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Virus Dr\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: GetRight Mini-Browser - C:\Programmer\GetRightIETools\GRMiniBrowser.htm
O8 - Extra context menu item: Search FileMirrors - C:\Programmer\GetRightIETools\FileMirrors.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://www.virtuel-hfc.kk.dk/qp2.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.drivecleaner.com/installdrivecleanerstart_dk.cab
O16 - DPF: {1C763326-813B-466F-AF7A-8618C10955D6} (SysCheck.SystemCheck) - http://services.yummy.net/download/WebInstall.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/3106551f1cbde37cd719/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/ActiveData.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEED689B-76D0-4129-8C60-BDEAFF303467}: NameServer = 69.57.146.14
O17 - HKLM\System\CS1\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS2\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS3\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS3\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Virus Dr\SASWINLO.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Virus Dr\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Virus Dr\security suite\ewidoguard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\Programmer\RadLinker\RadClock.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Håber at jeg kan få noget hjælp. Har virkelig brug for det.
Avatar billede Computer Hjælp (Gratis) Mester
14. december 2006 - 06:54 #4
... har du også gennemført DrWeb ?
Avatar billede Computer Hjælp (Gratis) Mester
14. december 2006 - 06:56 #5
PUHA - det er en del snavs/virus tilbage - det er ikke kun pga omtalte "link over messenger" - en del har været der før dette...

Procedure følger...
Avatar billede Computer Hjælp (Gratis) Mester
14. december 2006 - 07:59 #6
Hvis du ikke allerede HAR gennemført DrWeb:

Brug denne DrWeb scanner:
Kig denne vejledning grundigt igennem.
http://fromsej.dk/Vejledninger/html/drweb.html
(Du skal ikke aktivere den endnu)

Genstart i fejlsikret tilstand - F8 i opstart.

Dobbeltklik på drweb-cureit.exe, den vil køre en expressscan, det siger du ja til.
Når den skriver Done nederst til venstre, skal du klikke på Options->Change settings.
Skift til fanebladet Scan, fjern fluebenet ved Heuristic analysis.
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Rename.
Klik så på det eller de drev du vil have scannet, der kommer en rød prik for at vise det/de er valgt.

Klik så på den grønne pil ovre til højre på siden, så starter scanningen.
Første gang Dr.Web finder noget, klik "Yes to All", så fjerner den hvad den finder.
Klik så på Start->Søg, find filen drweb32w.log kopier teksten herind.
Avatar billede Computer Hjælp (Gratis) Mester
14. december 2006 - 08:03 #7
-- Hent S!Ri's SmitfraudFix.zip og pak det ud til dit Skrivebord.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Programmet pakker sig ud i en mappe, der hedder SmitfraudFix.

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Åbn mappen SmitfraudFix som du fik på Skrivebordet, og dobbeltklik på SmitfraudFix.cmd og tast 2 - svar ja til at rense (y=yes). Lad programmet gennemføre en rensning. Det vil også checke om systemfilen wininet.dll er inficeret. Hvis den er det, vil du blive bedt om tilladelse til at erstatte den med en anden. Her skal du vælge "Yes", ved at taste "y".

Programmet bliver muligvis nødt til at genstarte undervejs. Herefter vil der dukke en liste med resultaterne af rensningen op . Kopiér denne liste ind i tråden.

-- Genstart og læg en frisk Hijackthislog herind, samt loggen fra SmitfraudFix (C:\rapport.txt).

NB: Filen "process.exe" som ligger i dette værktøj bliver af visse antivirus-programmer identificeret som "RiskTool". Det har dog ikke noget på sig!
Avatar billede djurhuus20 Nybegynder
14. december 2006 - 21:23 #8
Tusind tak for hjælpen. Det er virkelig en STOR hjælp. Her er dr.web log. Jeg gør det andet du har skrevet lige om lidt.

ipwins.exe;c:\programmer\ipwins;Adware.Maxifiles;;
cmd32.exe;c:\windows\system32;Trojan.DownLoader.15527;Deleted.;
z23041159317.exe;c:\windows\system32;Trojan.DownLoader.15541;Deleted.;
sysvx_.exe;c:\windows;Trojan.Proxy.1271;Deleted.;
gcue.exe;C:\;Trojan.DownLoader.15701;Deleted.;
wdcsadsad;C:\Documents and Settings\Ask;Trojan.Proxy.1271;Deleted.;
wpcem.exe;C:\Documents and Settings\Ask;Trojan.EmailSpy;Deleted.;
$28491FA6.t$m;C:\Documents and Settings\Ask\Lokale indstillinger\Temp;Trojan.DownLoader.10963;Deleted.;
__unin__.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp;Adware.Altnet;Renamed.;
UERSK_0001_N91M2407NetInstaller.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp\ICD5.tmp;Trojan.DownLoader.10963;Deleted.;
UERSK_0001_N91M2407NetInstaller.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp\ICD6.tmp;Trojan.DownLoader.10963;Deleted.;
UERSK_0001_N91M2407NetInstaller.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp\ICD8.tmp;Trojan.DownLoader.10963;Deleted.;
setup.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp\NI.UWA6PK_0001_N91M2107;Trojan.Fakealert;Deleted.;
InstHelp.exe;C:\Documents and Settings\Ask\Lokale indstillinger\Temp\temp.frD47B;Trojan.Fakealert;Deleted.;
!update-4295[1].0000;C:\Documents and Settings\Ask\Lokale indstillinger\Temporary Internet Files\Content.IE5\0LMJC5YH;Trojan.DownLoader.12196;Deleted.;
Yazzle1122OinAdmin.exe;C:\Programmer\Fælles filer;Adware.ClickSpring;Renamed.;
888Bar.dll;C:\Programmer\Fælles filer\{30980065-0957-1030-0606-03030318002d};Adware.IWantSearch;Renamed.;
UnInstall.exe;C:\Programmer\Fælles filer\{30980065-0957-1030-0606-03030318002d};Adware.IWantSearch;Renamed.;
888Bar.dll;C:\Programmer\Fælles filer\{30980065-0959-1030-0606-03030318002d};Adware.IWantSearch;Renamed.;
UnInstall.exe;C:\Programmer\Fælles filer\{30980065-0959-1030-0606-03030318002d};Adware.IWantSearch;Renamed.;
ipwins.exe;C:\Programmer\ipwins;Adware.Maxifiles;Renamed.;
WebSecureAlert.exe;C:\Programmer\WebSecureAlert;Adware.Gator;Renamed.;
WebSecureUninstaller.exe;C:\Programmer\WebSecureAlert;Adware.Gator;Renamed.;
WSAHelper.dll;C:\Programmer\WebSecureAlert;Adware.Gator;Renamed.;
vncviewer.exe;C:\Shared Stuff\Upload\RealVNC;Program.RemoteAdmin;Renamed.;
vnchooks.dll;C:\Shared Stuff\Upload\RealVNC\WinVNC;Program.RemoteAdmin;Renamed.;
winvnc.exe;C:\Shared Stuff\Upload\RealVNC\WinVNC;Program.RemoteAdmin;Renamed.;
A0052141.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Adware.IWantSearch;Renamed.;
A0052143.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Trojan.Spambot;Deleted.;
A0052147.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Adware.IWantSearch;Renamed.;
A0052149.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Adware.IWantSearch;Renamed.;
A0052151.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Adware.IWantSearch;Renamed.;
A0052153.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP319;Adware.IWantSearch;Renamed.;
A0052159.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0052160.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0052171.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0052173.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053135.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053146.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053147.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0053148.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053151.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053153.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053155.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053157.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053160.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053162.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053164.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053166.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053168.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053170.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053171.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053172.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0053179.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053181.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053183.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053185.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053187.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053189.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053191.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053193.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053195.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053197.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053199.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053201.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053203.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053205.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053207.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053209.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053234.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053236.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053238.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053240.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053242.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053244.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053246.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053248.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053250.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053252.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053254.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053256.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053258.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053260.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053262.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053264.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053266.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053268.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053269.scr;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Win32.HLLM.Generic.282;Deleted.;
A0053270.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Win32.HLLW.Agobot;Deleted.;
A0053279.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053281.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0053282.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053284.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0053285.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054281.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.718;Deleted.;
A0054284.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.795;Deleted.;
A0054286.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054292.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054294.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054296.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054298.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054300.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054302.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054575.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054576.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054589.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.718;Deleted.;
A0054591.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054592.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.795;Deleted.;
A0054593.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054594.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054595.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054597.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054598.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054599.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054610.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.718;Deleted.;
A0054612.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.795;Deleted.;
A0054614.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054618.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054620.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054621.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054622.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054623.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054626.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.718;Deleted.;
A0054633.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054634.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054635.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054636.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054639.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Doma;Deleted.;
A0054640.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.795;Deleted.;
A0054641.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.EmailSpy;Deleted.;
A0054642.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054643.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054645.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054646.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054653.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.10963;Deleted.;
A0054655.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054656.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054657.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054658.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054659.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054660.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054661.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Spambot;Deleted.;
A0054662.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Program.mIRC.603;Renamed.;
A0054663.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.13046;Deleted.;
A0054664.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Adware.IWantSearch;Renamed.;
A0054665.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.11981;Deleted.;
A0054666.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Doma;Deleted.;
A0054667.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.MulDrop.4521;Deleted.;
A0054670.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.15703;Deleted.;
A0054671.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.Proxy.795;Deleted.;
A0054672.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.15595;Deleted.;
A0054673.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.14191;Deleted.;
A0054674.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP320;Trojan.DownLoader.14191;Deleted.;
A0054702.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.DownLoader.15676;Deleted.;
A0054706.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Fakealert;Deleted.;
A0054722.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Proxy.795;Deleted.;
A0054723.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Spambot;Deleted.;
A0054724.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Spambot;Deleted.;
A0054725.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Spambot;Deleted.;
A0054727.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Trojan.Spambot;Deleted.;
A0054731.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Adware.IWantSearch;Renamed.;
A0054732.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP322;Adware.IWantSearch;Renamed.;
A0055008.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP327;Program.ServUServer.4103;Renamed.;
A0055208.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP328;Trojan.Proxy.718;Deleted.;
A0055209.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP328;Trojan.Proxy.795;Deleted.;
A0056205.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.Proxy.718;Deleted.;
A0056206.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.Proxy.795;Deleted.;
A0056214.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.DownLoader.15690;Deleted.;
A0056215.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.Spambot;Deleted.;
A0057203.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.Proxy.795;Deleted.;
A0057209.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP330;Trojan.Spambot;Deleted.;
A0057247.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Trojan.DownLoader.15527;Deleted.;
A0057248.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Trojan.DownLoader.15541;Deleted.;
A0057249.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Trojan.Proxy.1271;Deleted.;
A0057250.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Trojan.DownLoader.15701;Deleted.;
A0057251.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Trojan.EmailSpy;Deleted.;
A0057252.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.ClickSpring;Renamed.;
A0057253.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.IWantSearch;Renamed.;
A0057254.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.IWantSearch;Renamed.;
A0057255.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.IWantSearch;Renamed.;
A0057256.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.IWantSearch;Renamed.;
A0057257.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.Maxifiles;Renamed.;
A0057258.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.Gator;Renamed.;
A0057259.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.Gator;Renamed.;
A0057260.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Adware.Gator;Renamed.;
A0057261.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Program.RemoteAdmin;Renamed.;
A0057262.dll;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Program.RemoteAdmin;Renamed.;
A0057263.exe;C:\System Volume Information\_restore{E3BD3D8E-C956-43A9-AA7E-AF71CF170311}\RP332;Program.RemoteAdmin;Renamed.;
installer[veo-10049,de].exe;C:\WINDOWS;Dialer.Intex;Renamed.;
gsda.dll;C:\WINDOWS\Downloaded Program Files;Adware.GameSpy;Renamed.;
UERSK_0001_N91M2407NetInstaller.exe;C:\WINDOWS\Downloaded Program Files;Trojan.DownLoader.10963;Deleted.;
UWA6PK_0001_N91M2107NetInstaller.exe;C:\WINDOWS\Downloaded Program Files;Trojan.DownLoader.10963;Deleted.;
UERSK_0001_N91M2407NetInstaller.exe;C:\WINDOWS\Downloaded Program Files\CONFLICT.1;Trojan.DownLoader.10963;Deleted.;
UWA6PK_0001_N91M2107NetInstaller.exe;C:\WINDOWS\Downloaded Program Files\CONFLICT.1;Trojan.DownLoader.10963;Deleted.;
UERSK_0001_N91M2407NetInstaller.exe;C:\WINDOWS\Downloaded Program Files\CONFLICT.2;Trojan.DownLoader.10963;Deleted.;
mmx249.exe;C:\WINDOWS\inet20000;Trojan.Spambot;Deleted.;
wpcem.exe;C:\WINDOWS\inet20000;Trojan.EmailSpy;Deleted.;
comdlg64.dll;C:\WINDOWS\system32;Trojan.Proxy.718;Deleted.;
google.png.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
kI4GO5K.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
ost.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
se.exe.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
sysvx.exe;C:\WINDOWS\system32;Trojan.Proxy.795;Deleted.;
w.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
w.exe.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
ymyucl.dll;C:\WINDOWS\system32;Trojan.DownLoader.14131;Deleted.;
z16.exe;C:\WINDOWS\system32;Trojan.Proxy.1271;Deleted.;
z2127.exe;C:\WINDOWS\system32;Trojan.Spambot;Deleted.;
z23041103006.exe;C:\WINDOWS\system32;Trojan.DownLoader.15542;Deleted.;
z2515.exe;C:\WINDOWS\system32;Trojan.DownLoader.15527;Deleted.;
Avatar billede djurhuus20 Nybegynder
14. december 2006 - 22:06 #9
SmitFraudFix v2.130

Scan done at 21:42:20,63, 14-12-2006
Run from C:\Documents and Settings\Ask\Skrivebord\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"

[HKEY_CLASSES_ROOT\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\System32\zkPeCrypt.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\System32\zkPeCrypt.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"

[HKEY_CLASSES_ROOT\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\System32\zkPeCrypt.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\System32\zkPeCrypt.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End


Logfile of HijackThis v1.99.1
Scan saved at 22:00:41, on 14-12-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Virus Dr\security suite\ewidoctrl.exe
C:\Virus Dr\security suite\ewidoguard.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jucheck.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\Virus Dr\halløj\belle.exe
C:\Virus Dr\SUPERAntiSpyware.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/0406/bF7.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O2 - BHO: C:\WINDOWS\System32\zkPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\System32\zkPeCrypt.dll (file missing)
O2 - BHO: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [buKAZK7] C:\WINDOWS\chhafwj.exe
O4 - HKLM\..\Run: [Kdotunle] C:\Program Files\Imtdt\Fecn.exe
O4 - HKLM\..\Run: [Etlmhyze] C:\Program Files\Wgaonv\Abpewby.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [staveplade] "C:\Documents and Settings\Ask\Skrivebord\TVGuide\staveplade.exe"
O4 - HKCU\..\Run: [Ria] C:\Programmer\??crosoft\?xplorer.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\System32\z23041138246.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\WINDOWS\System32\z23041159317.exe "
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Virus Dr\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: GetRight Mini-Browser - C:\Programmer\GetRightIETools\GRMiniBrowser.htm
O8 - Extra context menu item: Search FileMirrors - C:\Programmer\GetRightIETools\FileMirrors.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://www.virtuel-hfc.kk.dk/qp2.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.drivecleaner.com/installdrivecleanerstart_dk.cab
O16 - DPF: {1C763326-813B-466F-AF7A-8618C10955D6} (SysCheck.SystemCheck) - http://services.yummy.net/download/WebInstall.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/3106551f1cbde37cd719/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/ActiveData.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEED689B-76D0-4129-8C60-BDEAFF303467}: NameServer = 69.57.146.14
O17 - HKLM\System\CS1\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS2\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS3\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS3\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Virus Dr\SASWINLO.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Virus Dr\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Virus Dr\security suite\ewidoguard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\Programmer\RadLinker\RadClock.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Avatar billede Computer Hjælp (Gratis) Mester
15. december 2006 - 09:06 #10
Lige en hurtig ->
Er der nogen speciel årsag til at du ikke har M$ ServicePack2 instaleret ? Tilsyneladende har du KUN M$ ServicePack1 UDEN de MANGE efterfølgende WindowsUpdate elementer... Bla. derfor er du stadig MEGET inficeret !!!

"Ubeskyttede pc’er holder i 20 minutter]":
http://forum.mib-eu.dk/forum_posts.asp?TID=44

Provokation: Det er måske derfor ->
http://hemmingsvej.dk/spywarefri/Tekster/XPUlovligKEY.jpg ???
Avatar billede djurhuus20 Nybegynder
15. december 2006 - 15:29 #11
Nej det er der egentlig ikke. Ved ikke om du har kunnet tyde at mine skills inde for computere ikke er omfangende, så må ærligt indrømme at jeg ikke var klar over det var nødvendigt. Hvor anskaffer man sig en servicepack 2 henne ?
Avatar billede Computer Hjælp (Gratis) Mester
15. december 2006 - 20:18 #12
Du kan hente ServicePack2 (SP2) her som 'løs' fil (~280Mb):
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/
Download/copy til et passende sted på dit system.
Afbryd fra det 'farlige' internet (stikket fysisk UD).
Instaler SP2 pakken.
Når det er så gået godt og efter en genstart eller to - først DA tilslut internettet igen og gå i start ->programmer ->Windowsupdate og lade din maskine scanne for nyeste opdateringer. Installer dem du får anbefalet.
Der skal nok være mere end 60 'pakker' ...

MEN MEN MEN - i DIT tilfælde med en stærkt inficeret XP vil det ikke gå godt at lægge SP2 på...
MEN MEN MEN - i DIT tilfælde med en stærkt inficeret XP vil det ikke gå godt at lægge SP2 på...
Avatar billede Computer Hjælp (Gratis) Mester
15. december 2006 - 20:19 #13
Procedure følger...
Avatar billede Computer Hjælp (Gratis) Mester
19. december 2006 - 05:53 #14
(Selvom der ikke er gået 9 dage - tihi...)

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=0406&s=search&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=1c02&lc=0406&ac
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/0406/bF7.asp
R3 - URLSearchHook: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O2 - BHO: C:\WINDOWS\System32\zkPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\System32\zkPeCrypt.dll (file missing)
O2 - BHO: (no name) - {BFC7F172-67ED-7E23-EC59-3976123456E6} - C:\WINDOWS\System32\kqv.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [buKAZK7] C:\WINDOWS\chhafwj.exe
O4 - HKLM\..\Run: [Kdotunle] C:\Program Files\Imtdt\Fecn.exe
O4 - HKLM\..\Run: [Etlmhyze] C:\Program Files\Wgaonv\Abpewby.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [Ria] C:\Programmer\??crosoft\?xplorer.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\System32\z23041138246.exe "
O4 - HKCU\..\Run: [WinUpdate] "C:\WINDOWS\System32\z23041159317.exe "
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://www.virtuel-hfc.kk.dk/qp2.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.drivecleaner.com/installdrivecleanerstart_dk.cab
O16 - DPF: {1C763326-813B-466F-AF7A-8618C10955D6} (SysCheck.SystemCheck) - http://services.yummy.net/download/WebInstall.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/3106551f1cbde37cd719/netzip/RdxIE601.cab
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)

O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEED689B-76D0-4129-8C60-BDEAFF303467}: NameServer = 69.57.146.14
O17 - HKLM\System\CS1\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS2\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CS3\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CS3\Services\VxD\MSTCP: NameServer = 69.57.146.14
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14

Genstart i fejlsikret tilstand http://www.spywareinfo.dk/#/htm/fejlsikret_tilstand.htm

For at kunne se alle filer og mapper, så følg denne vejledning:
http://www.spywareinfo.dk/tip-og-tricks/mappeindstillinger.htm

Søg og slet de markerede filer/mapper hvis de stadig findes. Ellers fortsætter du bare vejledningen. De kan være røget i fixet.

C:\WINDOWS\System32\kqv.dll
C:\WINDOWS\chhafwj.exe
C:\Program Files\Imtdt\Fecn.exe
C:\Program Files\Wgaonv\Abpewby.exe
C:\WINDOWS\System32\nordsys.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\WINDOWS\System32\z23041138246.exe
C:\WINDOWS\System32\z23041159317.exe

Genstart, kør en ny scanning med hijackthis, og kopier en frisk log herind til tjek.

------------------------------------------------------------------------
Avatar billede djurhuus20 Nybegynder
21. december 2006 - 19:20 #15
Hej igen. Tak fordi du stadig hænger i :) Forstod ikke helt hvad jeg skulle med disse:
C:\WINDOWS\System32\kqv.dll
C:\WINDOWS\chhafwj.exe
C:\Program Files\Imtdt\Fecn.exe
C:\Program Files\Wgaonv\Abpewby.exe
C:\WINDOWS\System32\nordsys.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\WINDOWS\System32\z23041138246.exe
C:\WINDOWS\System32\z23041159317.exe

Her er loggen om ikke andet:

Logfile of HijackThis v1.99.1
Scan saved at 19:17:36, on 21-12-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Virus Dr\security suite\ewidoctrl.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmer\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Virus Dr\halløj\belle.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [staveplade] "C:\Documents and Settings\Ask\Skrivebord\TVGuide\staveplade.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Virus Dr\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: GetRight Mini-Browser - C:\Programmer\GetRightIETools\GRMiniBrowser.htm
O8 - Extra context menu item: Search FileMirrors - C:\Programmer\GetRightIETools\FileMirrors.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/ActiveData.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Virus Dr\SASWINLO.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Virus Dr\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Virus Dr\security suite\ewidoguard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\Programmer\RadLinker\RadClock.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Avatar billede Computer Hjælp (Gratis) Mester
21. december 2006 - 20:42 #16
SLET DISSE - Hvis de stadig findes ->

C:\WINDOWS\System32\kqv.dll
C:\WINDOWS\chhafwj.exe
C:\Program Files\Imtdt\Fecn.exe
C:\Program Files\Wgaonv\Abpewby.exe
C:\WINDOWS\System32\nordsys.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\WINDOWS\System32\z23041138246.exe
C:\WINDOWS\System32\z23041159317.exe
Avatar billede Computer Hjælp (Gratis) Mester
21. december 2006 - 20:44 #17
... har du gennemført proceduren [15/12-2006 20:18:52] - altså "forberedt" ServicePack2 indstalationen ?

Hvordan kører putter nu ?
Avatar billede djurhuus20 Nybegynder
21. december 2006 - 20:51 #18
KÆre Dr1.

Er ved at hente Servicepack 2 nu. Jo altså den kører. Det eneste jeg har bidt mærke i er en masse pop ups og så kan jeg ikke se almindelig billeder på den. Altså f.eks. det billede som er helt oppe i venstre hjørne på denne side, skal jeg trykke højreklik på og så "vis billede" før det kommer frem og det oplever jeg på alle internet sider... Har jeg slettet noget forkert?
Avatar billede ejvindh Ekspert
21. december 2006 - 22:49 #19
Hvis jeg må foreslå noget, så vil jeg anbefale at der bliver kørt et check med Combofix (til at fjerne purityscan) og Sdfix (til at fixe MsaSvc-servicen). Men jeg har nok ikke selv tid til at følge op på logsene, så det er nok bedst at det er dr1, der afgør om de skal køres -- og i givet fald giver vejledningen.
Avatar billede djurhuus20 Nybegynder
23. december 2006 - 14:20 #20
Hm efter jeg har hentet servicepack 2, og prøver at hente alle de nye opdateringer, lukker min computer ned ca 2 min efter jeg har tændt den, og siger at der er sket en alvorlig fejl.
Avatar billede Computer Hjælp (Gratis) Mester
23. december 2006 - 14:23 #21
Lige en hurtig ->

Prøv denne kommando for at rette fejlen:

Indsæt din WindowsXP Cd i drevet
Luk det vindue som popper op.

Gå i start - kør - skriv: sfc /scannow
Tast enter
Windows Cd skal ligge i drevet under denne kommando.
Du vil ikke få en tilbagemelding om noget er rettet.
Det mellemrum mellem sfc / skal være der.
Avatar billede djurhuus20 Nybegynder
23. december 2006 - 14:28 #22
Problemet er at jeg ikke har en Xp cd. En com jeg fik af min ven. GOD jeg er besværlig
Avatar billede ejvindh Ekspert
27. december 2006 - 09:18 #23
Hvis computeren stadig lever, så prøv følgende:

Hent dette værktøj, og gem det på skrivebordet:
http://www.uploads.ejvindh.net/rustbfix.exe

Dobbeltklik på værktøjet. Hvis værktøjet finder en Rustock-infektion, vil du efter kort tid blive bedt om at genstarte computeren. Dette skal du så acceptere. Genstarten vil muligvis tage et godt stykke tid, og måske skal der 2 genstarter til, men dette vil ske helt automatisk. Når genstarten er færdig vil der åbnes 2 logfiler (%root%\avenger.txt & %root%\rustbfix\pelog.txt), som du skal kopiere ind i tråden.
-----------------------

-- Hent Combofix, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/combofix.exe

--  Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.
-----------------------

-- Hent denne fil, og pak den ud til en mappe på skrivebordet:
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Dobbeltklik på filen, og lad den pakke sig ud til en mappe i roden af din harddisk (typisk: c:\SDfix)

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Gå så ind i mappen SDFix, som du fik oprettet tidligere. Dobbeltklik på filen RunThis.bat, for at starte værktøjet. Tryk "y" for at bekræfte, at du kører værktøjet på egen risiko. Så vil værktøjet gå i gang med at fjerne trojanservicen, og lave et par reparationer af registreringsdatabasen. På et tidspunkt vil det bede dig om at trykke en taste for at genstarte computeren. Det skal du gøre, hvorefter computeren vil genstarte efter 15 sekunder.

Genstarten vil tage lidt længere end sædvanligt, idet værktøjet skal have tid til at udføre sit arbejde. Når skrivebordet dukker op, vil værktøjet skrive "Finished". Tryk herefter en taste for at indlæse dine skrivebordsikoner igen.

Åben så SDFix-mappen, find filen Report.txt, og kopier indholdet af denne fil herind, sammen med en ny log fra Hijackthis.
Avatar billede djurhuus20 Nybegynder
30. december 2006 - 22:42 #24
Her er så de forskellige log's som kom ud af ovenstående procedure:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tfdpngfq

*******************

Script file located at: \??\C:\ylgklgwn.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished!  Terminate.

SDFix: Version 1.52
****************

30-12-2006 - 22:23:45,13

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Stage One - Safe Mode

Checking Services...

Service Name:

MsaSvc

File Path:

C:\WINDOWS\System32\msasvc.exe

MsaSvc Deleted...

Starting Registry Repairs...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two - Normal Mode

Checking For Malware:
--------------------

C:\WINDOWS\inet20000\mm.pid
C:\WINDOWS\kb823980.log

Backing Up and Removing any Files Found...

Alternate Stream Check:

C:\WINDOWS\system32
No streams found.
                                Final Check:

Remaining Services:
------------------



Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking for files with Hidden Attributes:

C:\Programmer\F‘lles filer\Yazzle1122OinUninstaller.exe
C:\Programmer\??crosoft\?xplorer.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\Documents and Settings\All Users\Application Data\Microsoft\VisualStudio\7.0\vs000223.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\311572e23998f0c88309d2102f4ec535\BIT50.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\47166c10766b8926732cc43153016eb4\BIT13.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5d5232a490c1e16d49f66dffd6116645\BIT39.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5eedc3c82662693f38dd584f932988b9\BIT26.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\7643016addc12a6f2319761a7c5d3aa0\BIT1F.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\925276073c26d30a857dd139f67183de\BIT37.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\c3261f188b57b29caecff194e555d8fa\BIT2B.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\c93e4ef92615684fc9330ccae386107f\BIT20.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\d28c1d30e8da3fd5ef4bf9a30543b04e\BIT36.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\d83182c91767c8becb1ace9ca228d7f6\BIT33.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\fdde90d2faadf95ee4730649a3e57e6e\BIT3B.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\fe7d662a2cae45c8324960f8fa3f9a05\BIT2E.tmp

                                FINISHED!

Logfile of HijackThis v1.99.1
Scan saved at 22:40:21, on 30-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\dumprep.exe
C:\Programmer\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\dwwin.exe
C:\Virus Dr\halløj\belle.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [staveplade] "C:\Documents and Settings\Ask\Skrivebord\TVGuide\staveplade.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Virus Dr\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Programmer\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: GetRight Mini-Browser - C:\Programmer\GetRightIETools\GRMiniBrowser.htm
O8 - Extra context menu item: Search FileMirrors - C:\Programmer\GetRightIETools\FileMirrors.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/ActiveData.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Virus Dr\SASWINLO.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: RadClock - Unknown owner - C:\Programmer\RadLinker\RadClock.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Avatar billede ejvindh Ekspert
31. december 2006 - 13:19 #25
Det ser godt ud. Prøv også lige at køre Combofix, som jeg skrev i min anvisning. Derudover bør du også overveje at afinstallere enten Antivir eller AVG antivirus, idet det godt kan give konflikter at have 2 antivirus-programmer kørende samtidig.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel Indlæg Oprettet Seneste aktivitet
Vil skrifte antivirusprogram. Af ErikHg i Virus 22 26/11/202510:42 23/12/202514:29
Er gratis Bitdefender værd at installere ? Af Ikke-ekspert i Virus 8 31/08/202519:08 01/09/202514:18
Ukendte filer på min Pc Af jonpet i Virus 10 03/02/202514:20 04/02/202511:05
mulig ukendt virus Af jackie18 i Virus 3 18/01/202514:07 18/01/202516:39
virus popper op med jævne mellemrum Af Malm i Virus 13 18/01/202511:40 20/01/202517:53
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I går 19:53 installer mange programmer på en gang Af Overgaard1654 i Andet software
I går 17:48 Min hp Officejet pro 7740 skærer det nederste af billedet i word Af rosmarin i Printere
I går 13:13 Batch OCR Af KurtG i Billedbehandling
I går 10:42 AI integreret i Access Af per2edb i Access
04/0409:43 AI google.com Af Peter Olsen i Andre onlineløsninger
White papers
Flere white papers »