Kan ikke boote fra CD

Hejsa!

Hent følgene programmer:
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html - Malwarebytes Anti-malware
http://www.filehippo.com/download_ccleaner.html - CCleaner
http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe - HijackThis

Gem dem i en dertiloprettet mappe.

Kør CCleaner, lad den opdatere sig selv. Tryk "Kør Cleaner", og lad den scanne.
Tryk så på "Register" ude til venstre. Tryk "Skan efter problemer". Efter scan tryk "Udbedre valgte problemer" (gem eventuelt en sikkerhedsfil ting). Gør dette et par gange.
- Luk programmet

Installer Malwarebyte Anti-malware og lad den lave en fuld systemscan.
Kopier loggen herind.

Til sidst installer HijackThis. Tryk på den første knap, noget i stil med "Skan og gem logfil". Lad den scanne igennem.
Kopier loggen herind

Skal det forstås som at du slet ikke har noget styresystem på din computer

Jeg tror det skal forståes som at han har prøvet at formatere, men kunne ikke da den ikke gad at boote på cd'en

Ja, supersquirrel har ret. Jeg har prøvet at formatere, men kunne ikke da den ikke ville boote fra CD.

Hvad er det for en computer det drejer sig om

Det er en Fujitsu Siemens AMILO.

Her er logfilen fra Malwarebyte Anti-malware:

Malwarebytes' Anti-Malware 1.23
Database version: 1006
Windows 5.1.2600 Service Pack 2

14:52:46 29-07-2008
mbam-log-7-29-2008 (14-52-46).txt

Skan type: Fuldstændig skanning (C:\|)
Objekter skannet: 77486
Tid tilbagelagt: 59 minute(s), 26 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 4
Inficerede Registeringsdatabase Nøgler: 12
Inficerede Registeringsdatabase Værdier: 3
Inficerede Registeringsdatabase Filer: 2
Inficerede Mapper: 1
Inficerede Filer: 17

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
C:\WINDOWS\system32\ihucfuww.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mlJDsTLc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\depwnl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\xxyabcCs.dll (Backdoor.Agent) -> Delete on reboot.

Inficerede Registeringsdatabase Nøgler:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30999908-1a29-4390-8a25-1585a71cf69f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{30999908-1a29-4390-8a25-1585a71cf69f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a6959c7-5618-4a31-a98e-4170ed537208} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{4a6959c7-5618-4a31-a98e-4170ed537208} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{833ae189-f38c-46b6-b02a-18dbebb50349} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{833ae189-f38c-46b6-b02a-18dbebb50349} (Trojan.BHO) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyabccs (Backdoor.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9023c148 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm9310f2d4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{833ae189-f38c-46b6-b02a-18dbebb50349} (Backdoor.Agent) -> Delete on reboot.

Inficerede Registeringsdatabase Filer:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\mljdstlc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\mljdstlc  -> Delete on reboot.

Inficerede Mapper:
C:\Casino (Adware.Casino) -> Quarantined and deleted successfully.

Inficerede Filer:
C:\WINDOWS\system32\depwnl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mlJDsTLc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cLTsDJlm.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cLTsDJlm.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ihucfuww.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wwufcuhi.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kxlucmuj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jumculxk.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyabcCs.dll (Trojan.BHO) -> Delete on reboot.
C:\Documents and Settings\Leslie-Ann Davis\Lokale indstillinger\Temporary Internet Files\Content.IE5\4OJVKM1Z\kb456456[1] (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Leslie-Ann Davis\Lokale indstillinger\Temporary Internet Files\Content.IE5\4ZMZ389V\kb767887[1] (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cbkxoqvy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xwmeflvc.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\BM9310f2d4.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM9310f2d4.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcccabAr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Og Her er Hijack this loggen:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14:41, on 29-07-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Norman\Npm\bin\ELOGSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Norman\Npm\Bin\Zanda.exe
C:\Norman\npm\bin\nvoy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\Npm\Bin\ZLH.EXE
C:\Programmer\iTunes\iTunesHelper.exe
C:\Norman\Npm\Bin\Nvcsched.exe
C:\Norman\Npm\Bin\Njeeves.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Norman\nse\bin\NSESVC.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\Bin\Nip.exe
C:\Norman\Nvc\Bin\cclaw.exe
C:\Programmer\MSN Messenger\usnsvc.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Spyware tools\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.dk/0SEDADK/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/config/mail?.intl=us&rand=1891836109&i=IWZkZHNKIXRzZnNydEpidXV4dSF0ZEqOZHh4fH5iU356YmNYcnM%3d&.src=ym
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {0A3D9815-0BA6-4131-804D-EAE96AD42CC4} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\da\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Programmer\poker\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Programmer\poker\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\poker\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programmer\poker\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - www.baser.dk/lib/aarhushh/support/plugins/ebraryRdr.cab" target="_blank">http://site.ebrary.com.www.baser.dk/lib/aarhushh/support/plugins/ebraryRdr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{ABFA0ED8-D331-4AB3-A6FF-3F0DCC88B538}: NameServer = 212.242.40.3,212.242.40.51
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Programmer\Ares\chatServer.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Norman\Npm\Bin\Njeeves.exe
O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Npm\Bin\Nvcsched.exe
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Norman\npm\bin\nvoy.exe

--
End of file - 7876 bytes

Har du forsøgt med F12 for at komme i bootmenu

Jep. Det har jeg prøvet.

[Malwarebyte Anti-malware] har nappet en hel del !!!
Hvordan kører PC'en så nu ?

Jeg kan se at du - måske mere eller mindre mod din vilje - har installeret [Yahoo Toolbar] ?
Den er dog ikke 'farlig', men bare et irriterende program/toolbar som bare fylder op .
Hvis du vil slippe af med den kan du følge guiden herfra ->
http://support.microsoft.com/kb/303047

PC'en kører en del bedre, men den kan stadig ikke aflæse CD'er.

Med at du har prøvet at komme ind i bootmenu, mener du så at du ikke kunne?

Hvis ikke du kunne med F12, så prøv med F8 <- det skal jeg på min acer bærbar :))

"PC'en kører en del bedre, men den kan stadig ikke aflæse CD'er" Jeg tvivler nu stærkt på at det er virusrelateret i såfald skulle du jo ha virus i BIOS
Jeg tror nærmere det er dit drev eller cd der er problemet

Problemet opstod bare på samme tid, men det kan jo være et tilfælde.
Kender du til et virusprogram, som jeg kan anvende til at skanne min bios?

Nej det gør jeg ikke jeg mener at vide, at det er meget få fanatikerer der overhovedet tror på at BIOS er modtagelig for virus, men sikker er jeg ikke. Du kunne evt. downloade og brænde www.helgec.dk/unik.iso (brændes som bootimages, se hvordan på www.helgec.dk/livecd.html) og prøv så om computeren ikke vil boote med den skive

Jeg har netop testet mit cd-rom drev og fundet, at den godt vil aflæse audio-cd'er men ikke data-cd'er/cd-rom'er, hvorfor jeg er tilbøjelig til at give dig ret i, at problemet nok skyldes drevet eller drevets opsætning.

De simpleste løsninger er som regel de bedste. Efter at have renset laser-hovedet med en vat-pind, så virker drevet nu igen.

Computeren kører perfekt!
Takker!

Lige et sidste spørgsmål, da licensen er udløbet på min Norman-antivirus, findes der da et godt freeware virusprogram, som også kan fungere som "virushund"?

AVG8 -> http://www.grisoft.cz/filedir/inst/avg_free_stf_en_8_138a1332.exe

NB:
Afinstall Norman helt først + Registreringsdatabase oprydning kan anbefales ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Register]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.

------

Husk M$ ServicePack3 til XP -> http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=da + efterfølgende WindowsUpdate ...

Jeg lægger et svar da jeg er af den opfattelse at jeg ramte plet, afvis hvis du er uenig

Ping...
(Vi ka' da dele *S*...)

Takker for P.