log fra scanning trojan horse

Nu skal jeg tjekke den for dig, men så skal du lukke dit andet spørgsmål. Du er kommet til at oprette to ens. Luk det ene og accepter dit eget svar. http://www.eksperten.dk/spm/446034

har jeg lukket det første spørgsmål nu? det kan jeg ikke rigtig finde ud af?

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://t.rack.cc/hp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://awebfind.biz/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst = fuck|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
thehun|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
teen|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
sex|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
hard|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
incest|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
girls|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
porn|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
xxx|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
pics|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
asian|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
amateur|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
adult|http://www.ss-hosting.com/cgi-bin/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst = fuck|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
thehun|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
teen|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
sex|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
hard|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
incest|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
girls|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
porn|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
xxx|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
pics|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
asian|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
amateur|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
adult|http://www.ss-hosting.com/cgi-bin/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{01A9EB7D-69BC-11D2-AB2F-204C4F4F5020} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: clitor - {1E1B2879-88FF-11D2-8D96-123457123457} - c:\windows\explorer.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Internat Conf] \bootconf.exe
O4 - HKLM\..\Run: [sys] regedit -s sys.reg
O4 - HKLM\..\Run: [WinAuth] C:\WINDOWS\winlogon.exe
O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/scandl_cnry.cab
O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp (file missing)
O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM)

--------------------------------------------------
Skal tjekkes efter:
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
Søg virker ikke på denne her møgmaskine.
--------------------------------------------------
Slettes i fejlsikker:
c:\windows\explorer.dll
C:\Programmer\Fælles filer\Real<= Mappen.
C:\WINDOWS\winlogon.exe
Aovergaard kommer med vejledningen, og tjekker den sidste, men jeg er ret sikker på den skal væk.

Denne skal væk:
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg

hvordan er det nu med at køre i fejlsikker tilstand. har windowsxp.

Du skal ikke selv lægge svar her.

Du trykker på f8 tasten uder opstarten.

Her er vejledningen

Du skal nu til at i gang med at fixe. Først skal du slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør det så kig her:  http://spywarefri.dk/virusscannere.htm#alle
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte en vinge ud for alle disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked. Efter fix skal du genstarte din computer.

Ny log herind til tjek.

Og så ser jeg at fromsej har glemt nogle. Du får lige hele min løsning, så du har dem alle samlet. Husk det er vigtigt at du slår den systemgendannelse fra.

Det er disse, som skal fixes:


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://t.rack.cc/hp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://awebfind.biz/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst = fuck|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
thehun|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
teen|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
sex|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
hard|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
incest|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
girls|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
porn|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
xxx|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
pics|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
asian|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
amateur|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
adult|http://www.ss-hosting.com/cgi-bin/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst = fuck|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
thehun|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
teen|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
sex|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
hard|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
incest|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
girls|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
porn|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
xxx|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
pics|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
asian|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
amateur|http://www.ss-hosting.com/cgi-bin/at/out.cgi|http://www.ss-hosting.com
adult|http://www.ss-hosting.com/cgi-bin/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{01A9EB7D-69BC-11D2-AB2F-204C4F4F5020} - (no file)

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe


O2 - BHO: clitor - {1E1B2879-88FF-11D2-8D96-123457123457} - c:\windows\explorer.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Internat Conf] \bootconf.exe
O4 - HKLM\..\Run: [keymgrldr] rundll32 setupapi,InstallHinfSection Oemkeymgr9x 128 keymgr3.inf
O4 - HKLM\..\Run: [sys] regedit -s sys.reg
O4 - HKLM\..\Run: [Mscnt] c:\windows\system32\mscnt.exe /noconnect
O4 - HKLM\..\Run: [WinAuth] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE

O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/scandl_cnry.cab
O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp (file missing)
O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM)

Slettes i fejlsikker:
c:\windows\explorer.dll
C:\Programmer\Fælles filer\Real <= Mappen.
C:\WINDOWS\winlogon.exe

Vigtigt at du får dem med som jeg giver dig her, for der er også en hijacker blandt dem som er blevet overset af de andre.

Jeg tror problemet er løst nu, men vil du lige tjekke min log fra scanningen en gang mere for at være sikker. Tusind tak for hjælpen og godt nytår.
log:
Logfile of HijackThis v1.97.7
Scan saved at 14:00:36, on 02-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 11 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/hp.php
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37787.1449768519
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Her er endnu en kopi af min log. De 2 sidste filer: 09 kan jeg ikke fjerne.
VH
Emmy

Logfile of HijackThis v1.97.7
Scan saved at 15:18:19, on 02-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 13 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/hp.php
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

Hov, nu går det helt galt her!!!!

Vent lige med at foretage dig mere.

2 min.

Du er nødt til at hente det du har fixet igen ved hjælp af backup.

Kør Hijackthis igen, i stedet for at trykke scan trykker du på config, og så på backups, der markerer du en linie og trykker på Restore, det gør du
til der ikke er flere linier.
Det er disse filer, der skal tilbage:

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000


Så genstarter du og laver en ny logfil.
Scan, save log, kopier logfilen herind

Du har fixet alt for meget, derfor skal de tilbage igen

når jeg trykker på config. og backups kan jeg ikke finde ud af hvordan jeg markerer en linje. Jeg trykker på restore, der kommer 1 blank linje frem når jeg trykker på den blanke flade og ikke nogle filer.

Du klikker bare på linjen, så bliver den markeret

der sker ikke noget hverken når jeg højre eller venstreklikker på linjen?

jeg er tilbage igen. hvordan ser det ud nu. Prøv lige at give mig din log igen, så ser jeg hvordan den ser ud lige nu.

Logfile of HijackThis v1.97.7
Scan saved at 22:24:25, on 02-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Programmer\Grisoft\AVG6\AVGW.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 13 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/hp.php
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

Sådan ser min log ud lige nu.
Jeg har stadig ikke kunnet gendanne de for meget slettede filer i scanningsprogrammet.
Under foretrukne internetsteder er der et (tomt?) progeam der hedder MyRealPics, som jeg ikke kan slette. Jeg har en mistanke til dette er en infection.
Jeg kører spybot med melllemrum, cirka hver anden time er der en infektion, som kan fjernes men kommer igen noget tid efter: MediaPlex:Tracking cookie or cookie of tracking site (Filer nothing done)C:\documents and settings\Hans\Cookies\Hans@mediaplex (1).txt

Nu har jeg scannet med spybot igen og har fundet virussen igen: se log fra spybot:

--- Search result list ---
MediaPlex: Tracking cookie or cookie of tracking site (Filer, fixed)
  C:\Documents and Settings\Hans\Cookies\hans@mediaplex[1].txt


--- Spybot-S&D version: 1.2  ---
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi


--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Security update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix [Yderligere oplysninger finder du i wm828026]
/ Windows Media Player: Windows Media Update 819639
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1a
/ Windows XP / SP2: Windows XP Hotfix - KB821557
/ Windows XP / SP2: Windows XP Hotfix - KB823182
/ Windows XP / SP2: Windows XP Hotfix - KB823559
/ Windows XP / SP2: Windows XP Hotfix - KB824105
/ Windows XP / SP2: Windows XP Hotfix - KB824141
/ Windows XP / SP2: Windows XP Hotfix - KB824146
/ Windows XP / SP2: Windows XP Hotfix - KB825119
/ Windows XP / SP2: Windows XP Hotfix - KB828035
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q323255 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329048 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329115 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329390 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329834 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696


--- Startup entries list ---
Spybot-S&D Startup list report, 02-01-2004 23:07:23

Located: HK_CU:Run, CTFMON.EXE
  file: C:\WINDOWS\System32\ctfmon.exe
  MD5: 05E2CDB73918E630B97680A68A3E8779

Located: HK_LM:Run, THGuard
  file: "C:\Programmer\TrojanHunter 3.7\THGuard.exe"

Located: HK_LM:Run, AVG_CC
  file: C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup



--- Browser helper object list ---
Spybot-S&D Browser helper object report, 02-01-2004 23:07:23

{53707962-6F74-2D53-2644-206D7942484F}
  Class file: SDHelper.dll
    Attributes: archive
    Date: 16-03-2003 01:02:00
    MD5: 423CBD3CFAEEB62C5C97A9449567B474
    Path: C:\PROGRA~1\SPYBOT~1\
    Short name:
    Size: 711168 bytes
    Version: 255.255.255.255
  CLSID database: legitimate software
    Description: Spybot-S&D IE Browser plugin
    Filename: SDHelper.dll


--- ActiveX list ---
Spybot-S&D ActiveX report, 02-01-2004 23:07:23

Microsoft XML Parser for Java
  Download location: file://C:\WINDOWS\Java\classes\xmldso.cab
  Name: Microsoft XML Parser for Java
  Version: 1,0,9,2


--- Process list ---
Spybot-S&D process list report, 02-01-2004 23:07:23

PID:    0 (  0) [System]
PID:    4 (  0) System
PID:  524 (  4) \SystemRoot\System32\smss.exe
PID:  588 ( 524) \??\C:\WINDOWS\system32\csrss.exe
PID:  612 ( 524) \??\C:\WINDOWS\system32\winlogon.exe
PID:  664 ( 612) C:\WINDOWS\system32\services.exe
PID:  676 ( 612) C:\WINDOWS\system32\lsass.exe
PID:  844 ( 664) C:\WINDOWS\system32\svchost.exe
PID:  900 (1616) C:\Programmer\Internet Explorer\iexplore.exe
PID:  944 ( 664) C:\WINDOWS\System32\svchost.exe
PID:  992 (1616) C:\Programmer\Grisoft\AVG6\AVGW.EXE
PID: 1052 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1136 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1312 ( 664) C:\WINDOWS\system32\spoolsv.exe
PID: 1472 (1616) C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
PID: 1616 (1500) C:\WINDOWS\Explorer.EXE
PID: 1776 (1616) THGuard.exe
PID: 1784 (1616) C:\Programmer\Grisoft\AVG6\avgcc32.exe
PID: 1792 (1616) C:\WINDOWS\System32\ctfmon.exe
PID: 1900 ( 664) C:\PROGRA~1\Grisoft\AVG6\avgserv.exe


--- Browser start & search pages list ---
Spybot-S&D browser pages report, 02-01-2004 23:07:23

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
  http://t.rack.cc/sp.php
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
  http://t.rack.cc/sp.php
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  http://tdc.dk/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://t.rack.cc/sp.php
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
  http://t.rack.cc/sp.php
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
  http://t.rack.cc/sp.php
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.searchv.com/1/search.php?qq=%s


--- Winsock Layered Service Provider list ---
Spybot-S&D winsock LSP report, 02-01-2004 23:07:23

NS Provider ( 1) Tcpip ({22059D40-7E9E-11CF-AE5A-00AA00A7112B})
NS Provider ( 2) NTDS ({3B2637EE-E580-11CF-A555-00C04FD8D4AC})
NS Provider ( 3) NLA-navneområde (Network Location Awareness) ({6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83})
Protocol ( 1) MSAFD Tcpip [TCP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 2) MSAFD Tcpip [UDP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 3) MSAFD Tcpip [RAW/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 4) RSVP UDP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 5) RSVP TCP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 6) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] SEQPACKET 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 7) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] DATAGRAM 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 8) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] SEQPACKET 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 9) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] DATAGRAM 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (10) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] SEQPACKET 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (11) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] DATAGRAM 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})

Prøv lige at start din computer op i fejlsikret tilstand. Fix disse:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://t.rack.cc/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/hp.php

Ny log.

ny log fra hijacthis:
Logfile of HijackThis v1.97.7
Scan saved at 11:21:59, on 03-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 13 for hijackthis.zip\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

ny log fra spybot:

--- Search result list ---

--- Spybot-S&D version: 1.2  ---
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi


--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Security update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix [Yderligere oplysninger finder du i wm828026]
/ Windows Media Player: Windows Media Update 819639
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1a
/ Windows XP / SP2: Windows XP Hotfix - KB821557
/ Windows XP / SP2: Windows XP Hotfix - KB823182
/ Windows XP / SP2: Windows XP Hotfix - KB823559
/ Windows XP / SP2: Windows XP Hotfix - KB824105
/ Windows XP / SP2: Windows XP Hotfix - KB824141
/ Windows XP / SP2: Windows XP Hotfix - KB824146
/ Windows XP / SP2: Windows XP Hotfix - KB825119
/ Windows XP / SP2: Windows XP Hotfix - KB828035
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q323255 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329048 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329115 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329390 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329834 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696


--- Startup entries list ---
Spybot-S&D Startup list report, 03-01-2004 11:40:21

Located: HK_CU:Run, CTFMON.EXE
  file: C:\WINDOWS\System32\ctfmon.exe
  MD5: 05E2CDB73918E630B97680A68A3E8779

Located: HK_LM:Run, THGuard
  file: "C:\Programmer\TrojanHunter 3.7\THGuard.exe"

Located: HK_LM:Run, AVG_CC
  file: C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup



--- Browser helper object list ---
Spybot-S&D Browser helper object report, 03-01-2004 11:40:21

{53707962-6F74-2D53-2644-206D7942484F}
  Class file: SDHelper.dll
    Attributes: archive
    Date: 16-03-2003 01:02:00
    MD5: 423CBD3CFAEEB62C5C97A9449567B474
    Path: C:\PROGRA~1\SPYBOT~1\
    Short name:
    Size: 711168 bytes
    Version: 255.255.255.255
  CLSID database: legitimate software
    Description: Spybot-S&D IE Browser plugin
    Filename: SDHelper.dll


--- ActiveX list ---
Spybot-S&D ActiveX report, 03-01-2004 11:40:21

Microsoft XML Parser for Java
  Download location: file://C:\WINDOWS\Java\classes\xmldso.cab
  Name: Microsoft XML Parser for Java
  Version: 1,0,9,2


--- Process list ---
Spybot-S&D process list report, 03-01-2004 11:40:21

PID:    0 (  0) [System]
PID:    4 (  0) System
PID:  524 (  4) \SystemRoot\System32\smss.exe
PID:  588 ( 524) \??\C:\WINDOWS\system32\csrss.exe
PID:  612 ( 524) \??\C:\WINDOWS\system32\winlogon.exe
PID:  664 ( 612) C:\WINDOWS\system32\services.exe
PID:  676 ( 612) C:\WINDOWS\system32\lsass.exe
PID:  844 ( 664) C:\WINDOWS\system32\svchost.exe
PID:  928 (1580) C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
PID:  944 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1024 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1036 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1336 ( 664) C:\WINDOWS\system32\spoolsv.exe
PID: 1580 (1476) C:\WINDOWS\Explorer.EXE
PID: 1588 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1752 (1580) C:\Programmer\Internet Explorer\iexplore.exe
PID: 1760 (1580) THGuard.exe
PID: 1780 (1580) C:\Programmer\Grisoft\AVG6\avgcc32.exe
PID: 1788 (1580) C:\WINDOWS\System32\ctfmon.exe
PID: 1888 ( 664) C:\PROGRA~1\Grisoft\AVG6\avgserv.exe


--- Browser start & search pages list ---
Spybot-S&D browser pages report, 03-01-2004 11:40:21

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  http://tdc.dk/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.searchv.com/1/search.php?qq=%s


--- Winsock Layered Service Provider list ---
Spybot-S&D winsock LSP report, 03-01-2004 11:40:21

NS Provider ( 1) Tcpip ({22059D40-7E9E-11CF-AE5A-00AA00A7112B})
NS Provider ( 2) NTDS ({3B2637EE-E580-11CF-A555-00C04FD8D4AC})
NS Provider ( 3) NLA-navneområde (Network Location Awareness) ({6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83})
Protocol ( 1) MSAFD Tcpip [TCP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 2) MSAFD Tcpip [UDP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 3) MSAFD Tcpip [RAW/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 4) RSVP UDP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 5) RSVP TCP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 6) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] SEQPACKET 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 7) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] DATAGRAM 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 8) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] SEQPACKET 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 9) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] DATAGRAM 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (10) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] SEQPACKET 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (11) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] DATAGRAM 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})

Efter at have fjernet de filer du skrev i aftes scannede jeg med spybot: der er en infektion: MediaPlex, jeg trykker på afhjælpe problemet og den bliver grøn, fra at have været rød. Det er den samme fil der genopstår igen og igen.

Jeg har søgt efter Mediaplex og har fundet flg.EFTER SCANNINGEN OG EFTER AT HAVE AFHJULPET PROBLEMET MED SPYBOT. HVAD ER DETTE:6 zipfiler der hedder mediaplex og en hel del txt. Jeg kan ikke slette dem, kan ikke åbne dem, de siger der skal adgangskode til?
VH
Emmy

Prøv lige at genstarte din computer og ligge en ny log, for det skulle faktisk være væk nu. de ispai skulle forsvinde ved en genstart. Men vi tjekker det lige.

log fra Hij..:
Logfile of HijackThis v1.97.7
Scan saved at 12:38:58, on 03-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 14 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

og log fra spybot:

--- Search result list ---

--- Spybot-S&D version: 1.2  ---
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi


--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Security update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix [Yderligere oplysninger finder du i wm828026]
/ Windows Media Player: Windows Media Update 819639
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1a
/ Windows XP / SP2: Windows XP Hotfix - KB821557
/ Windows XP / SP2: Windows XP Hotfix - KB823182
/ Windows XP / SP2: Windows XP Hotfix - KB823559
/ Windows XP / SP2: Windows XP Hotfix - KB824105
/ Windows XP / SP2: Windows XP Hotfix - KB824141
/ Windows XP / SP2: Windows XP Hotfix - KB824146
/ Windows XP / SP2: Windows XP Hotfix - KB825119
/ Windows XP / SP2: Windows XP Hotfix - KB828035
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q323255 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329048 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329115 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329390 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329834 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696


--- Startup entries list ---
Spybot-S&D Startup list report, 03-01-2004 12:40:08

Located: HK_CU:Run, CTFMON.EXE
  file: C:\WINDOWS\System32\ctfmon.exe
  MD5: 05E2CDB73918E630B97680A68A3E8779

Located: HK_LM:Run, THGuard
  file: "C:\Programmer\TrojanHunter 3.7\THGuard.exe"

Located: HK_LM:Run, AVG_CC
  file: C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup



--- Browser helper object list ---
Spybot-S&D Browser helper object report, 03-01-2004 12:40:08

{53707962-6F74-2D53-2644-206D7942484F}
  Class file: SDHelper.dll
    Attributes: archive
    Date: 16-03-2003 01:02:00
    MD5: 423CBD3CFAEEB62C5C97A9449567B474
    Path: C:\PROGRA~1\SPYBOT~1\
    Short name:
    Size: 711168 bytes
    Version: 255.255.255.255
  CLSID database: legitimate software
    Description: Spybot-S&D IE Browser plugin
    Filename: SDHelper.dll


--- ActiveX list ---
Spybot-S&D ActiveX report, 03-01-2004 12:40:08

Microsoft XML Parser for Java
  Download location: file://C:\WINDOWS\Java\classes\xmldso.cab
  Name: Microsoft XML Parser for Java
  Version: 1,0,9,2


--- Process list ---
Spybot-S&D process list report, 03-01-2004 12:40:08

PID:    0 (  0) [System]
PID:    4 (  0) System
PID:  524 (  4) \SystemRoot\System32\smss.exe
PID:  588 ( 524) \??\C:\WINDOWS\system32\csrss.exe
PID:  612 ( 524) \??\C:\WINDOWS\system32\winlogon.exe
PID:  664 ( 612) C:\WINDOWS\system32\services.exe
PID:  676 ( 612) C:\WINDOWS\system32\lsass.exe
PID:  844 ( 664) C:\WINDOWS\system32\svchost.exe
PID:  944 ( 664) C:\WINDOWS\System32\svchost.exe
PID:  964 (1444) C:\Programmer\Internet Explorer\iexplore.exe
PID: 1020 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1040 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1072 (1444) C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
PID: 1444 (1388) C:\WINDOWS\Explorer.EXE
PID: 1504 ( 664) C:\WINDOWS\system32\spoolsv.exe
PID: 1596 (1444) THGuard.exe
PID: 1644 (1444) C:\Programmer\Grisoft\AVG6\avgcc32.exe
PID: 1672 (1444) C:\WINDOWS\System32\ctfmon.exe
PID: 1700 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1800 ( 664) C:\PROGRA~1\Grisoft\AVG6\avgserv.exe


--- Browser start & search pages list ---
Spybot-S&D browser pages report, 03-01-2004 12:40:08

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  http://tdc.dk/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.searchv.com/1/search.php?qq=%s


--- Winsock Layered Service Provider list ---
Spybot-S&D winsock LSP report, 03-01-2004 12:40:08

NS Provider ( 1) Tcpip ({22059D40-7E9E-11CF-AE5A-00AA00A7112B})
NS Provider ( 2) NTDS ({3B2637EE-E580-11CF-A555-00C04FD8D4AC})
NS Provider ( 3) NLA-navneområde (Network Location Awareness) ({6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83})
Protocol ( 1) MSAFD Tcpip [TCP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 2) MSAFD Tcpip [UDP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 3) MSAFD Tcpip [RAW/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 4) RSVP UDP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 5) RSVP TCP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 6) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] SEQPACKET 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 7) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] DATAGRAM 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 8) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] SEQPACKET 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 9) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] DATAGRAM 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (10) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] SEQPACKET 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (11) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] DATAGRAM 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})

Jeg har kunnet fjerne MediaPlex zipfilerne i fejlsikret tilstand, og nu siger den nul virus. Så måske er problemet løst nu.
Håber det.

Ja det ser faktisk godt ud nu, og jeg tør godt sige til dig at du kan aktivere din systemgendannelse igen.

Og så lidt råd med på vejen for fremtiden: http://www.spywarefri.dk/pakken.htm

Du skal selvfølgelig ikke skifte dit AV prg. ud, men kig lige på disse andre prg. de er virkelig med til at sikre dig optimalt.

Mvh. Aovergaard/Team Spywarefri

Hej
Nu har jeg scannet med spybot igen og fundet den samme virus igen!! Den afhjælper jeg, og så er maskinen virusfri - indtil om et par timer.
Her er loggen efter scanning fra spybot:

--- Search result list ---
MediaPlex: Tracking cookie or cookie of tracking site (Filer, fixed)
  C:\Documents and Settings\Hans\Cookies\hans@mediaplex[1].txt


--- Spybot-S&D version: 1.2  ---
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi


--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Security update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix [Yderligere oplysninger finder du i wm828026]
/ Windows Media Player: Windows Media Update 819639
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1a
/ Windows XP / SP2: Windows XP Hotfix - KB821557
/ Windows XP / SP2: Windows XP Hotfix - KB823182
/ Windows XP / SP2: Windows XP Hotfix - KB823559
/ Windows XP / SP2: Windows XP Hotfix - KB824105
/ Windows XP / SP2: Windows XP Hotfix - KB824141
/ Windows XP / SP2: Windows XP Hotfix - KB824146
/ Windows XP / SP2: Windows XP Hotfix - KB825119
/ Windows XP / SP2: Windows XP Hotfix - KB828035
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q323255 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329048 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329115 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329390 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix-pakke [se Q329834 for at få flere oplysninger]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696


--- Startup entries list ---
Spybot-S&D Startup list report, 03-01-2004 16:13:40

Located: HK_CU:Run, CTFMON.EXE
  file: C:\WINDOWS\System32\ctfmon.exe
  MD5: 05E2CDB73918E630B97680A68A3E8779

Located: HK_LM:Run, THGuard
  file: "C:\Programmer\TrojanHunter 3.7\THGuard.exe"

Located: HK_LM:Run, AVG_CC
  file: C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup



--- Browser helper object list ---
Spybot-S&D Browser helper object report, 03-01-2004 16:13:40


--- ActiveX list ---
Spybot-S&D ActiveX report, 03-01-2004 16:13:40

Microsoft XML Parser for Java
  Download location: file://C:\WINDOWS\Java\classes\xmldso.cab
  Name: Microsoft XML Parser for Java
  Version: 1,0,9,2


--- Process list ---
Spybot-S&D process list report, 03-01-2004 16:13:40

PID:    0 (  0) [System]
PID:    4 (  0) System
PID:  428 (1444) C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
PID:  524 (  4) \SystemRoot\System32\smss.exe
PID:  576 (1444) C:\Programmer\Internet Explorer\iexplore.exe
PID:  588 ( 524) \??\C:\WINDOWS\system32\csrss.exe
PID:  612 ( 524) \??\C:\WINDOWS\system32\winlogon.exe
PID:  664 ( 612) C:\WINDOWS\system32\services.exe
PID:  676 ( 612) C:\WINDOWS\system32\lsass.exe
PID:  844 ( 664) C:\WINDOWS\system32\svchost.exe
PID:  944 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1020 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1040 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1444 (1388) C:\WINDOWS\Explorer.EXE
PID: 1504 ( 664) C:\WINDOWS\system32\spoolsv.exe
PID: 1568 (1444) C:\Programmer\Grisoft\AVG6\AVGW.EXE
PID: 1596 (1444) THGuard.exe
PID: 1644 (1444) C:\Programmer\Grisoft\AVG6\avgcc32.exe
PID: 1672 (1444) C:\WINDOWS\System32\ctfmon.exe
PID: 1700 ( 664) C:\WINDOWS\System32\svchost.exe
PID: 1800 ( 664) C:\PROGRA~1\Grisoft\AVG6\avgserv.exe


--- Browser start & search pages list ---
Spybot-S&D browser pages report, 03-01-2004 16:13:41

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  http://tdc.dk/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  about:blank
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.searchv.com/1/search.php?qq=%s


--- Winsock Layered Service Provider list ---
Spybot-S&D winsock LSP report, 03-01-2004 16:13:41

NS Provider ( 1) Tcpip ({22059D40-7E9E-11CF-AE5A-00AA00A7112B})
NS Provider ( 2) NTDS ({3B2637EE-E580-11CF-A555-00C04FD8D4AC})
NS Provider ( 3) NLA-navneområde (Network Location Awareness) ({6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83})
Protocol ( 1) MSAFD Tcpip [TCP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 2) MSAFD Tcpip [UDP/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 3) MSAFD Tcpip [RAW/IP] ({E70F1AA0-AB8B-11CF-8CA3-00805F48A192})
Protocol ( 4) RSVP UDP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 5) RSVP TCP Service Provider ({9D60A9E0-337A-11D0-BD88-0000C082E69A})
Protocol ( 6) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] SEQPACKET 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 7) MSAFD NetBIOS [\Device\NetBT_Tcpip_{355DD429-A9E9-4682-97DF-38317F498CDF}] DATAGRAM 0 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 8) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] SEQPACKET 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol ( 9) MSAFD NetBIOS [\Device\NetBT_Tcpip_{D635D895-22A7-4769-A962-0D997CF25E41}] DATAGRAM 1 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (10) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] SEQPACKET 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})
Protocol (11) MSAFD NetBIOS [\Device\NetBT_Tcpip_{56DDFC12-BCA0-40C3-B5DB-4F85011AEA2F}] DATAGRAM 2 ({8D5F1830-C273-11CF-95C8-00805F48A192})

Og log fra Hij:
Logfile of HijackThis v1.97.7
Scan saved at 16:23:14, on 03-01-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Hans\Lokale indstillinger\Temp\Midlertidig mappe 14 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdc.dk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [THGuard] "C:\Programmer\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\Programmer\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

Hvorfor sker dette?

Den sidste fil du ser her ovenfor ligner den inficerede fil: Extra 'tools'
Denne og filen ovenover var 2 filer jeg ikke kunne slette igår, som du ellers angav.

http://www.spywarefri.dk/pakken.htm

Hent det prg. EmtyTemp og så få lige slette alt i cookies temp history og det hele så du kan få renset ud. Der ligger også en manual til Emtytemp der hvor du henter programmet. Læs den, så du kan få det fulde udbytte.

har hentet ovenstående program, det kører på pc-eren nu.
Jeg fandt en cookie fra noget vi ikke har været inde på: hans@mediaplex.com?
Det er noget sludder jeg skrev at jeg skulle slette de 2 filer 09.
Men jeg skulle slette 3 filer i fejlsikker, men kan ikke slette C:\windows\logon.exe. Den eksisterer 3 steder: 1 under windows\system32 og 2 under windows\servicepakke. Dette er vores ene computer. På den anden computer som ikke er inficeret eksisterer filen 2 steder 1 under windows\system og 1 under servicepakke.

Ja og det er også normalt en legal fil, som dog kan blive inficeret. Kør denne linje på den computer hvor du har fixet den.

start
kør
skriv: sfc /scannow
Mellemrummet skal være der, og din cd skal sidde i drevet mens du gør det. Hvis der mangler systemfiler, så genoprettes de.

Godt du så fik hentet det prg. så du kunne få det skidt væk fra dine cookies.

der opstår en adresse på en hjemmeside, som jeg ikke har besøgt, i ovenstående program:
http://img-cdn.mediaplex.com/ads/2408/9553/DK_DK_promo_diminsp_...

Bare slet alt rub og stub hvad den kan finde. Så er du garderet. Det er da noget skrammel, men en eller anden må have været på den side, ellers kunne den ikke ligge på din computer.

Programmet fanger cookies og hjemmesider og sletter. Men der kommer altså de to ting ind uden vi går på den hjemmeside. Jeg vender tilbage med et nyt spørgsmål hvis der opstår problemer igen.
Men pceren fungerer fint nu, mange tak for hjælpen, du har fortjent dine 200 point. VH
Emmy

Velbekommen, takker for point;)

Puh ha endelig.