Tjek af Hijackthis log

Øjeblik, så ser jeg på det.

Læs alle punkterne inden du gør noget.
Gem evt. denne vejledning som en tekstfil på skrivebordet vha. Notepad.

(1)
Hent AVG Anti-Spyware her: http://free.grisoft.com/doc/downloads-products/us/frt/0?prd=asf
Installer programmer og opdater det, men vent med at scanne.

Hent: http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Dobbeltklik på SmitfraudFix.zip, hvorefter programmet pakker sig ud til mappen smitRem.

(2)
Hent AFT-cleaner her: http://www.geekstogo.com/forum/index.php?autocom=downloads&showfile=21
Start programmet og vælg "select all" og derefter "empty all".
Hvis du har Firefox skal du først vælge det i menuen og derefter "select all" og "empty all".

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op) og Fix følgende linjer med HijackThis:
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - C:\Programmer\Helper\1205167817.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Programmer\NetProject\sbmdl.dll
O4 - HKLM\..\RunServices: [win32 security updates downloader] tskmngr.exe
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.safeiegate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.safeiegate.com/redirect.php (file missing)
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} - http://www.streamplug.com/StreamPlug/SP.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

(4)
Start AVG Anti-Spyware, vælg fanebladet "scanner" og klik på "complete system scan".
Bagefter klik "apply all actions", "save report", "save report as" og gem logfil, f.eks. på skrivebordet.

(5)
Åbn "denne computer", i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper", sæt prik i "Vis skjulte filer og mapper". Husk at trykke på knappen "Anvend på alle mapper" i stedet for "ok".

søg efter og slet følgende fil(er):
C:\Programmer\Helper\1205167817.dll
tskmngr.exe
... og følgende mappe(r):
C:\Programmer\NetProject\

(6)
Åbn mappen smitfraudfix mappen, dobbeltklik på smitfraudfix.cmd, vælg option #2, svar yes (=y) til at rense inficerede filer.
Hvis du bliver bedt om at erstatte  filen wininet.dll med en anden, skal du svare yes (=y).
Hvis du bliver bedt om at genstarte computer, skal du genstarte den i normal tilstand.

(7)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind sammen med loggen fra AVG Anti-Spyware.

Hej levich.

Jeg har nu kørt det hele igennem og det ser ud som om at det virker!

Her er rapporten fra AVG:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:    21:03:29 11-03-2008

+ Scan result:   



D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\~vis0000\fsg_4104.#xe -> Adware.Gator : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\~vis0001\fsg_4104.#xe -> Adware.Gator : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\~vis0002\fsg_4104.#xe -> Adware.Gator : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\4PANS1YV\installer[1].#xe -> Adware.Look2Me : Cleaned with backup (quarantined).
D:\Programmer\Nye Programmer\Windows Xp Theme 2.0.exe -> Adware.ShowBehind : Cleaned with backup (quarantined).
C:\Programmer\Fælles filer\fuof\fuofd\fuofc.#ll -> Adware.TargetServer : Cleaned with backup (quarantined).
C:\WINDOWS\cmeilandt.exe.zip/cmeilandt.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\den_lille_gardner.exe.zip/den_lille_gardner.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\hophans_7.exe.zip/hophans_7.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\jan_t_p.exe.zip/jan_t_p.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\k_lomholt.exe.zip/k_lomholt.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\karen_lassen.exe.zip/karen_lassen.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\kenn1206.exe.zip/kenn1206.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\maria_h_moeller.exe.zip/maria_h_moeller.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\niels__knudsen.exe.zip/niels__knudsen.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\pic0382.zip/hophans_7.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
C:\WINDOWS\s-i-g-g-a-a-r-d.exe.zip/s-i-g-g-a-a-r-d.exe -> Backdoor.Rbot.esf : Cleaned with backup (quarantined).
D:\Programmer\Best performes\s2k.serials2k7.1.zip/s2k.hacking.exe -> Dialer.Generic : Cleaned with backup (quarantined).
D:\Programmer\Best performes\s2k.serials2k7.1\s2k.hacking.#xe -> Dialer.Generic : Cleaned with backup (quarantined).
D:\Programmer\Best performes\Messenger Plus! - Setup.exe/sponsor2.exe -> Downloader.Swizzor.ag : Cleaned with backup (quarantined).
C:\Programmer\Fælles filer\fuof\fuofp.#xe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
C:\Programmer\Fælles filer\fuof\fuofd\vocabulary -> Downloader.TSUpdate.j : Cleaned with backup (quarantined).
C:\Programmer\Fælles filer\fuof\fuofm.#xe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\0L2F0T6V\stub_113_4_0_4_0[1].#xe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined).
C:\Programmer\Fælles filer\fuof\fuofl.#xe -> Downloader.TSUpdate.p : Cleaned with backup (quarantined).
D:\Programmer\Installations koder og Key Generator\NERO 6316 KEygen.exe -> Hijacker.Befins.b : Cleaned with backup (quarantined).
C:\Documents and Settings\Mads Hash Pash\Lokale indstillinger\Temporary Internet Files\Content.IE5\14JIYUU9\install_en[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : Ignored.
D:\BACKUP_Documents and settings-Mads fyhn\Cookies\mads fyhn@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\1310994_5456_1256_5516_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\197128_1532_880_368_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\197128_1532_880_472_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\524890_5456_1256_5520_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\590274_3328_492_1780_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\590408_1868_840_3520_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\65860_1532_880_2192_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\65860_1532_880_2196_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\66084_1532_880_480_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
D:\BACKUP_Documents and settings-Mads fyhn\Lokale indstillinger\Temp\66084_1532_880_488_75.41.#mp1 -> Trojan.EliteBar.d : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\0L2F0T6V\teller2[1].htm -> Trojan.Small : Cleaned with backup (quarantined).


::Report end





Her er rapporten fra hijackthis efter alt er lavet:

Logfile of HijackThis v1.99.1
Scan saved at 21:14:15, on 11-03-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programmer\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Fælles filer\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Fælles filer\Teleca Shared\Generic.exe
C:\Programmer\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Programmer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Programmer\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /Minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe (file missing)
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WB - C:\Programmer\AlienGUIse\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe




Ser det fint ud?

Læg et svar.

Med venlig hilsen
Kristian Iversen

Det ser også fint ud.

Jeg siger mange tak for hjælpen. Det var jo bare helt perfekt :)