tjek min hijack this log

Jeg kigger på den med det samme

Først opretter du en mappe kun til hijackthis og lægger programmet derover.

Du skal nu til at i gang med at fixe. Allerførst skal du slå systemgendannelse fra. Hvis du ikke ved hvordan du gør det så kig her: http://www.arlet.dk/systemgendannelsen.htm derefter skal du åbne hijackthis. Du skal at sætte en vinge ud for disse filer jeg har skrevet nedeunder. Når du har gjort det så lukker du alle andre vinduer ned, det er meget vigtigt at det eneste vindue som er åbent er HijackThis vinduet. Klik på Fix checkede.

Her er de filer, du skal fixe:
O4 - HKLM\..\Run: [Window] explore.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\RunServices: [Window] explore.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

 
Disse programmer skal slettes

Søg efter disse filer:
D:\Programmer\Fælles filer\Real\Update_OB\realsched.exe. Du sletter hele Real mappen
 
Derefter genstarter du og sender en ny log ind til check
Du må ikke slå systemgendannelse til før vi har sagt god for din log.

Jeg skal have dig til at gøre lidt mere...
Vi skal kigge i windows system32 mappen efter en fil, der hedder explore.exe.

Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

---------------------------------------
Slet i fejlsikret. (Genstart og tryk F8 når windows loades)

C:\WINDOWS\System32\explore.exe ->VIGTIGT det skal være explore ikke explorer.

Det er ikke sikkert den er der, men du skal lige checke det.
Du kan eventuelt gå i start->søg->filer eller mapper og skrive explore.exe. Hvis du finder den skal den slettes.

Husk nu at det er den explore uden r til sidst. Den med r er god nok :O)

ny log
Logfile of HijackThis v1.97.7
Scan saved at 09:12:33, on 29-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmer\Sygate\SPF\smc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\Mixer.exe
D:\Programmer\D-Tools\daemon.exe
D:\Programmer\PestPatrol\PPControl.exe
D:\Programmer\PestPatrol\PPMemCheck.exe
D:\Programmer\PestPatrol\CookiePatrol.exe
D:\Programmer\Messenger\msmsgs.exe
D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
D:\Documents and Settings\Administrator\Skrivebord\Ny mappe\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.larashome.com/forums/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: PopUpCop - {DB43E4E6-FF8A-4018-8C8E-F68587A44A73} - D:\PROGRA~1\POPUPCOP\PopUpCop.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SmcService] D:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\Programmer\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] D:\Programmer\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\Programmer\PestPatrol\CookiePatrol.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O8 - Extra context menu item: Download with Star Downloader - D:\Programmer\Star Downloader\sdie.htm
O8 - Extra context menu item: Overfør med Star Downloader - D:\Programmer\Star Downloader\sdie.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38046.3041550926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab

Nydeligt :O)
Din log er fin og ren.
Kunne du finde explore.exe?
Hvis ikke, kan du godt slå din systemgendannelse til igen

nej men jeg har fundet en fil der hedder explore.exe.poly

har også lige lavet en pestpatrol log kan jeg slette alt i denne log
Scan of 04-29-2004 09:19:33
Pests found: 27
Area scanned: C:\, D:\, E:\
User Name: Administrator
MAC Address: 00-30-84-2B-06-BC
Computer Name: VIMMERS
Volume Name:
File System Name: NTFS
Volume Serial No: 678456885
Windows Version: Windows XP
Product Edition: Corporate
PestPatrol version: 12-23-2003 4.3.0.7
PPServer.dll version: 01-26-2003
PPfile.dat version: 12-23-2003
PPInfo.dat version: 12-23-2003
Spyware.dat version: 12-23-2003
PPMemCheck version: 04-19-2003
PestPatrolCL version: 12-17-2003 4.3.0.1
PPUpdater version: 08-04-2003 4.2.0.12

Pest: Download Accelerator Plus
Pest Info: Category: Browser Helper Object  Author: SpeedBit, Ltd.  Release Date: 8/5/2003 0:00:00  Background Info: Click here
File Info: In File: D:\Documents and Settings\vimmers1\Lokale indstillinger\Temp\cabex.dll  PVT: 1798323946  MD5: 9a31ceffb9c8e337b630d9ba0c6ef94b  Date: 05-26-2002 16:56:28  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: GameSpy Arcade
Pest Info: Category: Adware  Author:  [gamespyarcade.com]  Release Date: 8/1/2000 0:00:00  Background Info: Click here
File Info: In File: C:\Programmer\GameSpy Arcade\pw32.dll  PVT: 848896228  MD5: e6f0ca48298b725c9741c1a0a100b8ab  Date: 12-20-2001 10:46:36  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: GameSpy Arcade
Pest Info: Category: Adware  Author:  [gamespyarcade.com]  Release Date: 8/1/2000 0:00:00  Background Info: Click here
File Info: In File: C:\Programmer\GameSpy Arcade\Profiles\countries.ini  PVT: -1300692924  MD5: aa808cf00f1622687fe9ce82012d6414  Date: 05-24-2002 15:00:00  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: IRC/Flood.ba
Pest Info: Category: Flooder  Release Date: 2/27/2003 0:00:00  Background Info: Click here
File Info: In File: C:\DOWNLOADS\mIRC\script\dlls\stdio.dll  PVT: 21816244  MD5: 0f16f0269367c0032a11bb5402c7825d  Date: 12-15-2001 19:30:28  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Availability, Productivity, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Cracking Tool
Pest Info: Category: Cracking Tool  Author: Various  Release Date: 2/29/2000 0:00:00  Background Info: Click here
File Info: In File: C:\DOWNLOADS\mIRC\download\FireBurner_221_Plus_KeyGen\Fireburner All Versions Keygen.exe  PVT: -1995489353  MD5: cd5ffff60fe6e7721ad49fcc49340e49  Date: 12-04-2003 11:26:56  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected  Threatens:    Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Browser Helper Object  Author: SpeedBit, Ltd.  Release Date: 8/5/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\vimmers1.VIMMERS\Lokale indstillinger\Temp\cabex.dll  PVT: 1798323946  MD5: 9a31ceffb9c8e337b630d9ba0c6ef94b  Date: 05-26-2002 17:56:28  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Browser Helper Object  Author: SpeedBit, Ltd.  Release Date: 8/5/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\vimmers1\Lokale indstillinger\Temp\cabex.dll  PVT: 1798323946  MD5: 9a31ceffb9c8e337b630d9ba0c6ef94b  Date: 05-26-2002 17:56:28  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: WinPWL 3
Pest Info: Category: Password Cracker  Author: Aaron Klotz  Release Date: 2/24/2000 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\winpwl3\WinPWL3.exe  PVT: 2075525414  MD5: ca962d08369746edcd3599eecc905209  Date: 02-24-2000 12:37:52  Company Name: Aaron Klotz  File Description: Windows .PWL File Viewer Version 3  File Version: 3  Internal Name: WinPWL 3  Legal Copyright: Copyright © 1999, 2000 Aaron Klotz. All Rights Reserved.  Original Filename: WinPWL3.exe  Product Name: AKS WinPWL 3  Product Version: 3  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected  Threatens:    Confidentiality, Integrity, Availability, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: NCase
Pest Info: Category: Hijacker  Author:  [180Solutions]  Release Date: 9/14/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\TOMB RAIDER\nCASEAdsUninstaller.exe  PVT: -444345544  MD5: 3a72716da8c5c2fc21788640dec359bc  Date: 02-15-2004 17:12:44  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Passthief
Pest Info: Category: Password Cracker  Author: AD Technologies  Release Date: 10/14/1999 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\passtheif\passtheif.exe  PVT: 1908068746  MD5: b7b25d9efe663a9596b9b53a512fdf36  Date: 11-21-1999 04:42:42  Company Name: AD Technologies  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected  Threatens:    Confidentiality, Integrity, Availability, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Brutus AET 2
Pest Info: Category: Password Cracker  Author: Brutus  Release Date: 4/15/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\brutus-aet2\readme.doc  PVT: 912294433  MD5: b39751c0e43df8ca438efd616b7f9075  Date: 01-28-2000 18:15:54  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Confidentiality, Integrity, Availability, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Brutus AET 2
Pest Info: Category: Password Cracker  Author: Brutus  Release Date: 4/15/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\brutus-aet2\Overview.doc  PVT: -1461655936  MD5: 80e3161b23d2308c45c2f4ca1c30e1df  Date: 01-28-2000 17:18:30  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Confidentiality, Integrity, Availability, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Brutus AET 2
Pest Info: Category: Password Cracker  Author: Brutus  Release Date: 4/15/2003 0:00:00  Background Info: Click here
File Info: In File: C:\Documents and Settings\Administrator.VIMMERS\Dokumenter\brutus-aet2\BrutusA2.exe  PVT: -1005296269  MD5: d6066d187be09b56d917ad3aa63e4874  Date: 01-28-2000 18:13:34  Company Name: HooBie Inc.  File Description: Brutus AET 2  File Version: 1.0.0.0  Legal Copyright: 1998,1999,2000 Hoobie Inc  Product Name: Brutus - AET2  Product Version: 1.0.0.0  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Confidentiality, Integrity, Availability, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: VX2/SiteHelper
Pest Info: Category: Browser Helper Object  Author:  [Mindset Interactive]  Release Date: 3/13/2003 0:00:00  Background Info: Click here
File Info: In File: C:\bc777.html  PVT: 1864766759  MD5: a1e2d71c6df59b20e5bffe36458a69b5  Date: 03-13-2003 11:05:56  File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Confirmed  Threatens:    Liability  Risk: Low.  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus Directory
Pest Info: Category: Adware  Background Info: Click here
File Info: In Directory: D:\Programmer\dap  Date: 03-01-2004 07:40:04
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete when empty
Action: Ignored
                                                ~~~
Pest: IRC BDoor
Pest Info: Category: Adware  Background Info: Click here
File Info: In File: D:\WINDOWS\update.exe  Date: 03-17-2004 20:51:24
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Moderate - this file can be executed!  Advice: Delete or quarantine
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\speedbit
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\typelib\{82351433-9094-11d1-a24b-00a0c932c7df}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\protocols\name-space handler\https\zda|pattern1
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\interface\{f32c7705-1dad-4b09-b60a-40f1d9b3dbc9}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\interface\{82351440-9094-11d1-a24b-00a0c932c7df}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\interface\{5b985d95-d4ee-44e5-ae57-b88659b9dee4}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\interface\{5252ac41-94bb-11d1-b2e7-444553540000}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\interface\{03d365cb-878a-4495-9350-7c67743335d9}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\clsid\{f852086b-10e6-4743-9a3f-d8257a0a59e3}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Download Accelerator Plus
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\classes\clsid\{82351441-9094-11d1-a24b-00a0c932c7df}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~
Pest: Alexa
Pest Info: Category: Adware  Background Info: Click here
File Info: In Registry: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Certainty: Confirmed  Threatens:    Confidentiality, Liability  Risk: Low.  Advice: Delete or ignore
Action: Ignored
                                                ~~~

Du sletter explore.exe.poly i fejlsikret tilstand.
Alt det petspatrol har fundet kan du slette.

flot jeg bukker og takker

Jamen det var da så lidt :O)

Jeg kan se at du er forholdsvis ny her :O)
Hvis du ikke ved hvordan du lukker et spørgsmål, gør du det ved at markere en svarer ude i boxen til venstre. Derefter accepterer du bare. Så er spørgsmålet lukket ;O)