xp pjælke til win98 pjækle

Din PC er blevet inficeret. Især den med udråbstegnet i stedet for start, er jeg næsten 100% sikker på at du er blevet inficeret.

Hent HIJACKTHIS programmet her: http://www.spywarefri.dk/manualer/hijackthis-manual.htm
hvor Anette har skrevet en fin manual hvordan man gør. Post resultatet herinde, så kigger vi på det.

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Her er loggen så:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55, on 2008-09-23
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programmer\Trend Micro\BM\TMBMSRV.exe
C:\programmer\Trend Micro\RUBotted\TMRUBotted.exe
C:\Programmer\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Programmer\Trend Micro\Internet Security\SfCtlCom.exe
C:\Programmer\Trend Micro\Internet Security\TmPfw.exe
C:\Programmer\Trend Micro\Internet Security\TmProxy.exe
C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\Programmer\Trend Micro\Internet Security\UfSeAgnt.exe
C:\programmer\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\windows\system32\wuauclt.exe
C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\Programmer\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\hfjhjfhfh\Skrivebord\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmer\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Programmer\Trend Micro\TrendProtect\MSIE\wrs.dll (file missing)
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Programmer\Trend Micro\TrendProtect\MSIE\wrs.dll (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmer\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [cafw] C:\Programmer\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Programmer\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Programmer\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Programmer\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\programmer\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKCU\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221747908781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Programmer\Trend Micro\TrendProtect\MSIE\wrs.dll (file missing)
O23 - Service: BullGuard LiveUpdate (BgLiveSvc) - Unknown owner - C:\BullGuard Ltd\BullGuard\BullGuardUpdate.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Programmer\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Programmer\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Programmer\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (file missing)
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\programmer\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Programmer\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Programmer\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 6881 bytes

ps ved ikke at i kan men jeg kan ikke se noget på loggen

og har opdaget at min pc bliver næsten normal når jeg afslutter processen "explore.exe"
og kan det også ha' noget at gøre med "microsoft sql server 2008"?

Der har åenbart både været *BullGuard* + *NOD32* sikkerhedsprogram engang...
Lidt generel oprydning ->

------------------------------------------------------------------------

Klik på Start->Kør skriv Services.msc og klik OK.
Find Tjenesten (Hvis den er der)
* BullGuard LiveUpdate (BgLiveSvc)
* Eset HTTP Server (EhttpSrv)
* Eset Service (ekrn)
* SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS)
stop den hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

------------------------------------------------------------------------

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O23 - Service: BullGuard LiveUpdate (BgLiveSvc) - Unknown owner - C:\BullGuard Ltd\BullGuard\BullGuardUpdate.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Programmer\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Programmer\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Programmer\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (file missing)

Genstart normalt...

------------------------------------------------------------------------

Registreringsdatabase ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Register]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.

karise var der først :-)

hej karise larry,
nu har jeg gjort det du skrev og virker også fint nu
men nu tar det bare 5 timer at loade en webside
Har i et forslag til at løse det?

... Ka' vi få en frisk log fra HiJackThis ...

her er den nye log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:31:35, on 25-09-2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programmer\Trend Micro\BM\TMBMSRV.exe
C:\Programmer\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Programmer\Trend Micro\Internet Security\SfCtlCom.exe
C:\Programmer\Trend Micro\Internet Security\TmPfw.exe
C:\Programmer\Trend Micro\Internet Security\TmProxy.exe
C:\windows\system32\SearchIndexer.exe
C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\windows\Explorer.EXE
C:\Programmer\Trend Micro\Internet Security\UfSeAgnt.exe
C:\programmer\TuneUp Utilities 2008\MemOptimizer.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\Programmer\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\windows\system32\kdfmgr.exe
C:\windows\system32\SearchProtocolHost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\jkl\Skrivebord\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Programmer\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\programmer\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\programmer\TuneUp Utilities 2008\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Programmer\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [HijackThis startup scan] C:\Documents and Settings\hfjhjfhfh\Skrivebord\HijackThis.exe /startupscan (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [HijackThis startup scan] C:\Documents and Settings\hfjhjfhfh\Skrivebord\HijackThis.exe /startupscan (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\programmer\Windows Desktop Search\WindowsSearch.exe
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1222260919328
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Programmer\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - (no file)
O23 - Service: Google Updater Service (gusvc) - Google - C:\programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Programmer\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Programmer\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Programmer\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\windows\System32\TuneUpDefragService.exe

--
End of file - 5493 bytes

Der er umiddelbar ikke noget 'snavs' ifølge din log.
Måske lige at du pt. bruger IE8 "Beta" ?

ja jeg bruger IE8 beta men det er det samme med mozilla

ryder op ;)