Trojan horse Backdoor.Delf.142 i C:\WINDOWS\System32\directx.exe?

Du er blevet hijacket. Dvs der er en udefra, der har overtaget en del af styringen på din computer...

For at løse problemet skal du hente 2 programmer.

Først spybot : http://www.spywarefri.dk/vaerktoj.htm#spybot
direkte link : http://download.com.com/3000-2144-10122137.html?part=104443&subj=dlpage&tag=button

Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, derefter genstarter du

Derefter hijackthis : http://www.spywarefri.dk/vaerktoj.htm#hijackthis
direkte link :          http://www.webattack.com/get/hijackthis.shtml

den udpakker du og kører Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den.


DU MÅ IKKE FIXE NOGET SELV. NÅR VI HAR TJEKKET LOGGEN IGENNEM FORTÆLLER VI DIG HVAD DER SKAL SLETTES...


Manual for installering af hijackthis:
http://www.spywarefri.dk/hijackthis.man.htm

Smid en log herind, så skal jeg nok kigge på den, det bliver nok først i aften jeg kan komme til computeren igen *S*

Det vil jeg gøre, foreløbig tak for hjælpen! :-)

http://www.symantec.com/avcenter/venc/data/backdoor.delf.family.html

Her ligger der information om hvordan du fjerner din trojanske hest Delf

Jeg har nu kørt Spybot, genstartet og skulle så downloade hijackthis, men den kan ikke starte programmet? Gør jeg noget forkert?

Ahh... Havde bare ikke winzip liggende...? :-)

Logfile of HijackThis v1.97.3
Scan saved at 16:13:27, on 30-10-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\AVG6\avgserv.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Creative\ShareDLL\CtNotify.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG6\avgcc32.exe
C:\Programmer\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE
C:\Programmer\Kazaa\kazaa.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Philips ToUcam Camera\CalCheck.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Brian Olsen\Lokale indstillinger\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PE2CKFNT SE] c:\programmer\philips toucam camera\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Outlook.lnk = C:\Programmer\Outlook Express\msimn.exe
O4 - Startup: Internet.lnk = C:\Programmer\Internet Explorer\IEXPLORE.EXE
O4 - Startup: Mpk.lnk = C:\Programmer\MiniPopupKiller\mpk.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmer\Philips ToUcam Camera\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/255a8a4ded7082d2a906/netzip/RdxIE601.cab
O16 - DPF: {6ABC861A-31E7-4D91-B43B-D3C98F22A5C0} - http://secure.goodthinxx.com/(vwj4n1jisrxwntqnxemd4l45)/secureweb/securewebgt.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} - http://fr4-scripts.downloadv3.com/binaries/DialHTML/EGDHTML_pack_XP.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.2309143519
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A078A8F-2E40-4A59-B46D-C33DB5AD6746}: NameServer = 193.162.153.164 194.239.134.83

There you go... Håber du kan hjælpe mig? *S*

Deaktiver systemgendannelse:
http://spywarefri.dk/virus.htm#alle
Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart, ny logfil herind.
Dobbelttjek, så alt kommer med.

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/255a8a4ded7082d2a906/netzip/RdxIE601.cab
O16 - DPF: {6ABC861A-31E7-4D91-B43B-D3C98F22A5C0} - http://secure.goodthinxx.com/(vwj4n1jisrxwntqnxemd4l45)/secureweb/securewebgt.cab
O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} - http://fr4-scripts.downloadv3.com/binaries/DialHTML/EGDHTML_pack_XP.cab

---------------------------------------
Kører du netværk, og er disse to DNS adresser iorden, skal du lade dem være, ellers fixes.

O17 - HKLM\System\CCS\Services\Tcpip\..\{5A078A8F-2E40-4A59-B46D-C33DB5AD6746}: NameServer = 193.162.153.164 194.239.134.83

---------------------------------------
Slettes i fejlsikker.
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE

---------------------------------------
Deaktiveres i MSconfig.
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe

Genstart normalt og kom med en ny logfil, så vi kan se om alt er med.

Se at få opdateret din XP med servicepack1, og din Internet explorer skal også opdateres, samt alle tilgængelige opdateringer, ellers er det spild af tid at rense din PC.

Hermed en ny logfil...

Logfile of HijackThis v1.97.3
Scan saved at 10:50:44, on 31-10-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Creative\ShareDLL\CtNotify.exe
C:\Programmer\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\AVG6\avgcc32.exe
C:\WINDOWS\system32\directx.exe
C:\Programmer\Kazaa\kazaa.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Philips ToUcam Camera\CalCheck.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Outlook Express\msimn.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\AVG6\avgserv.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Brian Olsen\Lokale indstillinger\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] c:\programmer\philips toucam camera\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Outlook.lnk = C:\Programmer\Outlook Express\msimn.exe
O4 - Startup: Internet.lnk = C:\Programmer\Internet Explorer\IEXPLORE.EXE
O4 - Startup: Mpk.lnk = C:\Programmer\MiniPopupKiller\mpk.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmer\Philips ToUcam Camera\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.2309143519
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A078A8F-2E40-4A59-B46D-C33DB5AD6746}: NameServer = 193.162.153.164 194.239.134.83

2 spørgsmål mere...

Hvordan deaktiverer jeg i MSconfig?

Og skal det gøres inden jeg aktiverere systemgendannelse?

På forhånd tak! *S*

Har du ikke deaktiveret systemgendannelsen, så gør det nu og fix det som fromsej har skrevet

gå i kør - skriv "msconfig" uden "" gå i start og fjern flueben ud for den

det er kun denne der skal fixes:

O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART

genstart i fejlsikret(f8) og slet denne:

genstart i fejlsikret(f8) og slet denne:
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE

genstart og ny log. Systemgendannelse skal stadig være deaktiveret

Jo, jeg har deaktiveret. Jeg har bare ikke lavet de sidste justeringer, da jeg ikke vidste hvordan jeg skulle gøre? *S*

det var godt, for ellers kommer det tilbage, hvis du bruger systemgendannelsen...

Der er ikke nogen filer af det navn i MSconfig?

Og hvor genstarter jeg i fejlsikret? (Har prøvet at trykke F8?)

når computer starter op holder du f8 nede indtil der kommer et billed med fejlsikret tilstand.

Det med msconfig venter vi med til bagefter

Logfile of HijackThis v1.97.3
Scan saved at 12:08:43, on 31-10-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Creative\ShareDLL\CtNotify.exe
C:\Programmer\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\AVG6\avgcc32.exe
C:\WINDOWS\system32\directx.exe
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Philips ToUcam Camera\CalCheck.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Outlook Express\msimn.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\AVG6\avgserv.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Messenger\msmsgs.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Brian Olsen\Lokale indstillinger\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] c:\programmer\philips toucam camera\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Internet.lnk = C:\Programmer\Internet Explorer\IEXPLORE.EXE
O4 - Startup: Mpk.lnk = C:\Programmer\MiniPopupKiller\mpk.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmer\Philips ToUcam Camera\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.2309143519
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A078A8F-2E40-4A59-B46D-C33DB5AD6746}: NameServer = 193.162.153.164 194.239.134.83

Her den nye logfil...

Jeg har slettet filen i fejlsikret tilstand og genstartet normalt.

Denne her er kommet efter sidste log og skal væk.
har ikke noget med dit logitech udstyr at gøre.

denne skal fixes :

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

genstart i fejlsikret og slet denne her :

C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

genstart og ny log herind.

Der ligger da meget mere snavs i den log som skal væk nu Arlet.

Så? :-)

Logfile of HijackThis v1.97.3
Scan saved at 12:30:11, on 31-10-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\AVG6\avgcc32.exe
C:\WINDOWS\system32\directx.exe
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Philips ToUcam Camera\CalCheck.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\AVG6\avgserv.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Brian Olsen\Lokale indstillinger\Temp\HijackThis.exe
C:\Programmer\Kazaa\kazaa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] c:\programmer\philips toucam camera\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Internet.lnk = C:\Programmer\Internet Explorer\IEXPLORE.EXE
O4 - Startup: Mpk.lnk = C:\Programmer\MiniPopupKiller\mpk.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmer\Philips ToUcam Camera\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.2309143519
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A078A8F-2E40-4A59-B46D-C33DB5AD6746}: NameServer = 193.162.153.164 194.239.134.83

Disse to skal du prøve igen at slette i fejlsikret:

C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE

Fixes med hijackthis :

O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART

Denne kommer sammen med din kazaa :

C:\WINDOWS\system32\directx.exe
og skal også slettes i fejlsikret


og denne skal fixes i hijackthis :
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe

Jeg tjekker, og kommer med samlet ny fix

Logfile of HijackThis v1.97.3
Scan saved at 12:50:31, on 31-10-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\AVG6\avgcc32.exe
C:\WINDOWS\system32\directx.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Philips ToUcam Camera\CalCheck.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\AVG6\avgserv.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Brian Olsen\Lokale indstillinger\Temp\HijackThis.exe
C:\Programmer\Kazaa\kazaa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] c:\programmer\philips toucam camera\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmer\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Internet.lnk = C:\Programmer\Internet Explorer\IEXPLORE.EXE
O4 - Startup: Mpk.lnk = C:\Programmer\MiniPopupKiller\mpk.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmer\Philips ToUcam Camera\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.2309143519
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Jeg er efterhånden nået dertil, hvor det vil være nemmere at formaterer min harddisk? Vi kan jo blive ved??? Hvad siger I?

Hent og installer servicepack 1 til XP, hent samtlige tilgængelige opdateringer, fjern ALLE P2P programmer, både KaZaa og Edonkey, genstart så og kom med en ny log.
Nu har du fået en Proxy override siden sidste log også, smid det l... af H til.

Fromsej og aovergaard ->>I mens han henter det der, skal vi så afregne. http://www.eksperten.dk/spm/421324

Ok som det første skal du virkelig gå ud og få opdateret WindowsXp samt IE. Gør du ikke det, så bliver du ved med at få alt dette virus.

Og så har du deaktiveret din systemgendannelse ikke? Ellers skal du gøre det nu. Du skal fixe disse filer herunder. Når du skal fixe, så husk at du ikke må have andre vinduer åbne.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [eDonkey2000] C:\Programmer\eDonkey2000\eDonkey2000.exe -t
O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [directx.exe] C:\WINDOWS\system32\directx.exe
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM32\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab

Disse skal slettes i fejlsikret tilstand. Tryk f8 under opstarten
C:\Programmer\Kazaa\kazaa.exe
C:\WINDOWS\system32\directx.exe

Genstart alm. Ny log herind. Så kan jeg også se at du har fået opdateret dit Windows, som er meget vigtigt.

Når jeg prøver at indstallerer Service pack 1, skriver den at den ikke kan bekræfte gyldigheden af filen update.inf, og at jeg skal kontrollerer om de Kryptografiske tjenester kører på computeren????? Hvad dælen betyder det?

Er det en registreret winXP du kører med?

Tror jeg ikke...? Hvad hvis det ikke er?

Så kan du ikke installer sp1

og uden sp1 bliver det umuligt for dig at holde snavset ude...

Hmm... Sletter XP og ligger den oprindelige Windows ind igen, tror jeg? Det her vil ikke rigtigt tage nogen ende? Jeg er ked af at have brugt jeres tid! Men tak for hjælpen alligevel! ;-)

Det er nok klogere, men du får lige "Paranoia-pakken" alligevel.*S*

For at holde skidtet ude af din PC, kan du hente flg. programmer:
Spywareblaster, Spywareguard, IE-Spyad og Empty Temp Folders, dem finder du, sammen med danske vejledninger her:
http://www.spywarefri.dk/vaerktoj.htm
Læs især om IE-Spyad, så du får det fulde udbytte af dette lille geniale program.
Mvh:
Fromsej/Team Spywarefri.

Ja det er uden tvivl det bedste du kan gøre, for kan du ikke opdatere, så går der måske kun 5 min. så har du lige så meget snavs igen.