res ieframe.dll dnserror.htm help

Afinstaller Bearshare i Tilføj/Fjern programmer.
Drop fildeling >> http://spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

Kør Hijackthis, scan, sæt flueben ved følgende, luk alle vinduer undtaget Hijackthis, klik på fix checked, når den er færdig, genstart.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
O4 - HKLM\..\Run: [BearShare] "C:\Programmer\BearShare\BearShare.exe" /pause

---------------------------------------
Hent Combofix, og gem den i en mappe:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Åbn mappen med Combofix, højreklik, vælg Ny->tekstdokument, åbn tekstdokumentet, kopier følgende ind:

Killall::
Snapshot::
Folder::
C:\Programmer\BearShare

klik på Filer->Gem som, navngiv den CFScript, luk tekstdokumentet.

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif
Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Kopier den fremkomne log herind.

Mange tak det virkede :-)

Hvordan giver jeg point til fromsej

Det kan du ikke før jeg har lagt et svar.

Men må vi ikke se Combofixloggen, inden vi afslutter, der kan ligge mere.

Kører fra: c:\programmer\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

(((((((((((((((((((((((((((((  Filer skabt fra 2009-05-10 til 2009-06-10  )))))))))))))))))))))))))))))))))))
.

2009-06-07 17:09 . 2009-02-06 16:08    55152    ----a-w-    c:\windows\system32\drivers\fssfltr_tdi.sys
2009-06-07 16:43 . 2009-06-07 16:43    --------    d-----w-    c:\documents and settings\Mansour\Lokale indstillinger\Application Data\Windows Live Writer
2009-06-07 16:43 . 2009-06-07 16:43    --------    d-----w-    c:\documents and settings\Mansour\Application Data\Windows Live Writer
2009-06-07 16:20 . 2009-06-07 17:09    --------    d-----w-    c:\programmer\Windows Live
2009-06-07 15:47 . 2009-06-10 19:21    3021373    ----a-r-    c:\programmer\ComboFix.exe
2009-06-06 10:05 . 2009-06-06 10:05    --------    d-sh--w-    c:\documents and settings\LocalService\IETldCache
2009-06-05 07:03 . 2009-06-05 07:03    --------    d-sh--w-    c:\documents and settings\Mansour\IECompatCache
2009-06-05 07:03 . 2009-06-05 07:03    --------    d-sh--w-    c:\documents and settings\Mansour\PrivacIE
2009-06-05 07:01 . 2009-06-05 07:01    --------    d-sh--w-    c:\documents and settings\Mansour\IETldCache
2009-06-05 06:56 . 2009-06-05 06:58    --------    dc-h--w-    c:\windows\ie8
2009-05-29 18:00 . 2009-05-29 18:00    --------    d-----w-    c:\programmer\Overnet
2009-05-21 14:57 . 2009-04-06 13:32    15504    ----a-w-    c:\windows\system32\drivers\mbam.sys
2009-05-21 14:57 . 2009-04-06 13:32    38496    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-21 14:57 . 2009-05-21 14:57    --------    d-----w-    c:\programmer\Malwarebytes' Anti-Malware
2009-05-20 18:53 . 2009-05-20 18:53    --------    d-----w-    c:\programmer\CCleaner
2009-05-20 18:45 . 2009-06-07 16:55    --------    d-----w-    c:\documents and settings\Mansour\Application Data\RegTool

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 19:20 . 2006-10-19 20:56    --------    d-----w-    c:\programmer\Symantec AntiVirus
2009-06-10 16:00 . 2008-03-27 12:16    --------    d-----w-    c:\programmer\Norton Security Scan
2009-06-10 15:07 . 2001-10-09 12:00    77886    ----a-w-    c:\windows\system32\perfc006.dat
2009-06-10 15:07 . 2001-10-09 12:00    428434    ----a-w-    c:\windows\system32\perfh006.dat
2009-06-07 17:29 . 2006-10-23 14:47    --------    d-----w-    c:\programmer\Fælles filer\Adobe
2009-06-07 16:03 . 2006-10-20 15:27    --------    d-----w-    c:\programmer\Google
2009-05-25 17:29 . 2006-10-19 17:12    43832    ----a-w-    c:\documents and settings\Mansour\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-05-10 14:47 . 2006-10-20 18:03    --------    d-----w-    c:\programmer\DivX
2009-05-10 12:16 . 2009-05-10 12:16    --------    d-----w-    c:\programmer\Microsoft Sync Framework
2009-05-10 12:15 . 2009-05-10 12:15    --------    d-----w-    c:\programmer\Microsoft SQL Server Compact Edition
2009-05-10 12:13 . 2009-05-10 12:13    --------    d-----w-    c:\programmer\Microsoft
2009-05-10 12:09 . 2009-05-10 12:09    --------    d-----w-    c:\programmer\Fælles filer\Windows Live
2009-05-10 11:48 . 2009-05-10 11:48    146    ----a-w-    C:\43214354.bat
2009-04-21 16:30 . 2009-01-29 20:52    0    ----a-w-    c:\documents and settings\Mansour\temp.dat
2009-04-02 14:43 . 2009-04-02 14:43    152576    ----a-w-    c:\documents and settings\Mansour\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-12 68856]
"Steam"="e:\spil\steam\steam.exe" [2009-05-19 1217784]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RegTool"="c:\programmer\RegTool\RegTool.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-04-17 85184]
"SunJavaUpdateSched"="c:\programmer\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Sony Ericsson PC Suite"="c:\programmer\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"RemoteControl"="c:\programmer\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"razer"="c:\programmer\Razer\razerhid.exe" [2005-05-17 147456]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2008-09-06 413696]
"PowerStrip"="c:\programmer\powerstrip\pstrip.exe" [2008-11-19 737312]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-10-22 7700480]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LanguageShortcut"="c:\programmer\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 49152]
"iTunesHelper"="c:\programmer\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ccApp"="c:\programmer\Fælles filer\Symantec Shared\ccApp.exe" [2005-04-08 48752]
"Google Quick Search Box"="c:\programmer\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-07 68592]
"Acrobat Assistant 7.0"="e:\programer\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-09-22 14854144]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2006-10-22 86016]
"Genvej til egenskabsside for High Definition Audio"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2009-6-7 25214]
Adobe Gamma.lnk - c:\programmer\F‘lles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Microsoft Office.lnk - e:\programer\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Spil\\Steam\\steamapps\\mr_mansour81@hotmail.com\\counter-strike\\hl.exe"=

R1 PStrip;PStrip;c:\windows\system32\drivers\pstrip.sys [15-07-2007 04:37 27992]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [07-06-2009 19:09 55152]
S3 axvbusx;axvbusx;c:\windows\system32\drivers\axvbusx.sys [27-12-2002 20:14 8384]
S3 axvscsi;axvscsi;c:\windows\system32\drivers\axvscsi.sys [27-12-2002 20:14 98560]
S3 fsssvc;Windows Live Family Safety;c:\programmer\Windows Live\Family Safety\fsssvc.exe [06-02-2009 18:08 533360]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [20-10-2006 17:35 13225]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [29-09-2007 16:33 167808]
S3 SavRoam;SAVRoam;c:\programmer\Symantec AntiVirus\SavRoam.exe [17-04-2005 12:30 124608]

--- Andre Services/Drivers i Hukommelsen ---

*Deregistered* - EraserUtilDrv10910

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Indhold af mappen 'Planlagte Opgaver'

2008-10-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-06-10 c:\windows\Tasks\Norton Security Scan for Mansour.job
- c:\programmer\Norton Security Scan\Nss.exe [2008-09-19 03:18]
.
.
------- Yderligere scanning -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.dk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Convert link target to Adobe PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - e:\programer\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{D5E1CDC8-64B9-4f8c-8155-FC3B6D6749F7} - http://tmss.trendmicro.com/dashboard/dashboard.aspx?HADBAEHJJJJHBGAJCICDECIIDBAIGJDFJFJFD
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\programmer\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://dkbn.dk/imageuploader/ImageUploader5.cab
DPF: {D216644A-C6DB-49D9-BBCF-D38FE7991BF2} - hxxps://danid.dk/csp/authenticode/digitalsignatur-csp.exe
DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} - hxxps://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp10.photoprintit.de/microsite/10021/defaults/activex/IPSUploader.cab
FF - ProfilePath - c:\documents and settings\Mansour\Application Data\Mozilla\Firefox\Profiles\tbnladya.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.dk
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 2
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 21:25
Windows 5.1.2600 Service Pack 3 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'explorer.exe'(2348)
c:\windows\system32\nview.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Gennemført tid: 2009-06-10 21:27
ComboFix-quarantined-files.txt  2009-06-10 19:27
ComboFix2.txt  2009-06-07 15:46

Pre-Kørsel: 6.486.802.432 byte ledig
Post-Kørsel: 6.503.235.584 byte ledig

Current=1 Default=1 Failed=0 LastKnownGood=2 Sets=,1,2,3
157    --- E O F ---    2009-06-05 06:58

Der er ikke mere at komme efter.

Tak for point. :-)