Har 4 forskellige vira - hjælp ønskes til at fjerne dem

Jeg skulle mene at du umiddelbart bare kan fjerne disse filer, men hvis du vil være helt sikker kan du jo bare putte en backup af dem i en zip fil, slette dem og så genstarte =)

De 3 første er som du selv vist skriver, trojaner, den får du ved ved at downloade og scanne med trojanhunter, men gør dig selv den tjenest lige at læse hvad der står om brugen af det, på arlets hjemmeside!
http://www.arlet.dk/trojanhunter.htm

w32.Bizten som også er en trojaner, hvis trojanhunter ik fjerner den så er der et værktøj her http://securityresponse.symantec.com/avcenter/venc/data/w32.bizten.html

Det var det hele

det lyder som om du sq gøre sådan her http://www.spywarefri.dk/hjtanv.htm og så poste en log her.

Så er jeg ved computeren igen.

cp1: Jeg har valgt at følge dine instruktioner, og her er log-filen fra HijackThis:

Logfile of HijackThis v1.97.7
Scan saved at 15:45:11, on 08-05-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\mgabg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\Program Files\CpuIdlePro\cpuidle.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\jushed32.exe
D:\Program Files\Galtech\WordPoint\WDpoint.exe
D:\Program Files\Div spyware\SpywareGuard\sgmain.exe
D:\Program Files\Div spyware\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\GuruNet Shared\agtserv.exe
D:\Program Files\Div spyware\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.enjoysearch.info/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.enjoysearch.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.enjoysearch.info/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.enjoysearch.info/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.enjoysearch.info/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.enjoysearch.info/search.html
F1 - win.ini: run=C:\WINDOWS\System32\services\wmplayer.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Program Files\Div spyware\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {A114D52B-870C-4F15-8021-B6D7F91A054B} - D:\LADEMANN\iFinger\plugins\IE.ifp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [CpuIdle] C:\Program Files\CpuIdlePro\cpuidle.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype.exe" /nosplash /minimized
O4 - Startup: SpywareGuard.lnk = D:\Program Files\Div spyware\SpywareGuard\sgmain.exe
O4 - Global Startup: WordPoint.lnk = D:\Program Files\Galtech\WordPoint\WDpoint.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: iFinger (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.studiemetro.au.dk
O15 - Trusted Zone: www.dr.dk" target="_blank">http://*.www.dr.dk
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://130.228.229.67/ecwplugins/ncs.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37889.3824652778
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://213.150.57.68/speedtest/SpeedTest_2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1ED0FAE4-4480-494D-B50A-552FE8397352}: NameServer = 212.242.40.3,212.242.40.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{1ED0FAE4-4480-494D-B50A-552FE8397352}: NameServer = 212.242.40.3,212.242.40.51

har spurgt om en af de skrappe HJT eksperter vil kigge indenfor ;)

Tak - venter spændt...

Deaktiver systemgendannelse:
http://www.spywarefri.dk/virusscannere.htm#alle

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret(Tryk <F8> under opstart) og slet filerne listet nederst.
Dobbelttjek, så alt kommer med.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.enjoysearch.info/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.enjoysearch.info/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.enjoysearch.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.enjoysearch.info/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.enjoysearch.info/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.enjoysearch.info/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.enjoysearch.info
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.enjoysearch.info/search.html
F1 - win.ini: run=C:\WINDOWS\System32\services\wmplayer.exe
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

---------------------------------------
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start>Søg.
Klik på "Alle filer og Mapper", klik på "Flere avancerede Indstillinger", sæt flueben i de tre øverste.
---------------------------------------
Slettes i fejlsikret.
C:\WINDOWS\System32\services\wmplayer.exe -> Bemærk placeringen, det er IKKE den rigtige mediaplayer, den ligger i C:\programmer\windows mediaplayer
C:\WINDOWS\jushed32.exe
Har du slettet de filer fra dit første indlæg, ellers gør det.
---------------------------------------
Du skal også lige hente og installere programmet Ad-aware. Opdater det straks efter installationen, og inden du kører en scanning med denne. Fjern alt hvad den finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware

Genstart og kom med en ny logfil, så jeg kan se om alt er med.

fromsej>>måske var det en idé at tilføje Ad-aware til den fine maual ;)

til denne manual selvfølgelig *S* http://www.spywarefri.dk/hjtanv.htm

Cp1>>Det ville nok være en god idé, grunden til at de ikke er med begge to er for at folk ikke skal opgive på halvvejen, men jeg vil lige vende det med Teamet.

fromsej>>ja det ka jeg godt se,alt det internetgummi man ska bruge nu om dage *S*

*GH*

Til fromsej (og andre interesserede):

Så har jeg fulgt dine anvisninger. Jeg ved ikke, om du skal bruge logfilen fra ad-aware, men nu får du den: (logfilen fra HijackThis kommer bagefter)


Lavasoft Ad-aware Personal Build 6.181
Logfile created on  :8. maj 2004 17:23:54
Created with Ad-aware Personal, free for private use.
Using reference-file :01R298 20.04.2004
______________________________________________________

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry


08-05-2004 17:23:54 - Scan started. (Smart mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
    FilePath          : \SystemRoot\System32\
    ThreadCreationTime : 08-05-2004 14:50:34
    BasePriority      : Normal


#:2 [winlogon.exe]
    FilePath          : \??\C:\WINDOWS\system32\
    ThreadCreationTime : 08-05-2004 14:50:47
    BasePriority      : High


#:3 [services.exe]
    FilePath          : C:\WINDOWS\system32\
    ThreadCreationTime : 08-05-2004 14:50:51
    BasePriority      : Normal
    FileSize          : 99 KB
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion    : 5.1.2600.0
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName      : services.exe
    OriginalFilename  : services.exe
    ProductName        : Microsoft
    Created on        : 23-08-2001 12:00:00
    Last accessed      : 08-05-2004 14:50:51
    Last modified      : 23-08-2001 12:00:00

#:4 [lsass.exe]
    FilePath          : C:\WINDOWS\system32\
    ThreadCreationTime : 08-05-2004 14:50:51
    BasePriority      : Normal
    FileSize          : 11 KB
    FileVersion        : 5.1.2600.1106 (xpsp1.020828-1920)
    ProductVersion    : 5.1.2600.1106
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName      : lsass.exe
    OriginalFilename  : lsass.exe
    ProductName        : Microsoft
    Created on        : 29-08-2002 03:41:26
    Last accessed      : 08-05-2004 14:50:51
    Last modified      : 29-08-2002 03:41:26

#:5 [svchost.exe]
    FilePath          : C:\WINDOWS\system32\
    ThreadCreationTime : 08-05-2004 14:50:54
    BasePriority      : Normal
    FileSize          : 12 KB
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion    : 5.1.2600.0
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName      : svchost.exe
    OriginalFilename  : svchost.exe
    ProductName        : Microsoft
    Created on        : 23-08-2001 12:00:00
    Last accessed      : 08-05-2004 14:50:54
    Last modified      : 23-08-2001 12:00:00

#:6 [svchost.exe]
    FilePath          : C:\WINDOWS\system32\
    ThreadCreationTime : 08-05-2004 14:50:54
    BasePriority      : Normal
    FileSize          : 12 KB
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion    : 5.1.2600.0
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName      : svchost.exe
    OriginalFilename  : svchost.exe
    ProductName        : Microsoft
    Created on        : 23-08-2001 12:00:00
    Last accessed      : 08-05-2004 14:50:54
    Last modified      : 23-08-2001 12:00:00

#:7 [explorer.exe]
    FilePath          : C:\WINDOWS\
    ThreadCreationTime : 08-05-2004 14:51:17
    BasePriority      : Normal
    FileSize          : 973 KB
    FileVersion        : 6.00.2800.1221 (xpsp2.030511-1403)
    ProductVersion    : 6.00.2800.1221
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName      : explorer
    OriginalFilename  : EXPLORER.EXE
    ProductName        : Microsoft
    Created on        : 11-05-2003 19:12:10
    Last accessed      : 08-05-2004 14:51:18
    Last modified      : 11-05-2003 19:12:10

#:8 [ad-aware.exe]
    FilePath          : D:\PROGRA~1\DIVSPY~1\AD-AWA~1\
    ThreadCreationTime : 08-05-2004 15:23:02
    BasePriority      : Normal
    FileSize          : 668 KB
    FileVersion        : 6.0.1.181
    ProductVersion    : 6.0.0.0
    Copyright          : Copyright 
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-aware 6 core application
    InternalName      : Ad-aware.exe
    OriginalFilename  : Ad-aware.exe
    ProductName        : Lavasoft Ad-aware Plus
    Created on        : 08-05-2004 15:22:46
    Last accessed      : 08-05-2004 15:23:02
    Last modified      : 12-07-2003 19:00:20

Memory scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 0


Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Alexa Object recognized!
    Type              : RegKey
    Data              :
    Rootkey            : HKEY_LOCAL_MACHINE
    Object            : SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 1


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 1


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 1


17:26:09 Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:02:15:500
Objects scanned :43658
Objects identified :1
Objects ignored :0
New objects :1


Og her er den nye log-fil fra HijackThis:

Logfile of HijackThis v1.97.7
Scan saved at 17:46:32, on 08-05-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\mgabg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\Program Files\CpuIdlePro\cpuidle.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
D:\Program Files\Skype.exe
D:\Program Files\Galtech\WordPoint\WDpoint.exe
D:\Program Files\Div spyware\SpywareGuard\sgmain.exe
D:\Program Files\Div spyware\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\GuruNet Shared\agtserv.exe
D:\Program Files\Div spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Program Files\Div spyware\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {A114D52B-870C-4F15-8021-B6D7F91A054B} - D:\LADEMANN\iFinger\plugins\IE.ifp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [CpuIdle] C:\Program Files\CpuIdlePro\cpuidle.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [jushed32] C:\WINDOWS\jushed32.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype.exe" /nosplash /minimized
O4 - Startup: SpywareGuard.lnk = D:\Program Files\Div spyware\SpywareGuard\sgmain.exe
O4 - Global Startup: WordPoint.lnk = D:\Program Files\Galtech\WordPoint\WDpoint.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: iFinger (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.studiemetro.au.dk
O15 - Trusted Zone: www.dr.dk" target="_blank">http://*.www.dr.dk
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://130.228.229.67/ecwplugins/ncs.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37889.3824652778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://213.150.57.68/speedtest/SpeedTest_2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1ED0FAE4-4480-494D-B50A-552FE8397352}: NameServer = 212.242.40.3,212.242.40.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{1ED0FAE4-4480-494D-B50A-552FE8397352}: NameServer = 212.242.40.3,212.242.40.51

Lige en tilføjelse: Jeg kunne ikke finde C:\WINDOWS\System32\services\wmplayer.exe - så den er vel blevet fjernet???
Og C:\WINDOWS\jushed32.exe har jeg kun overført til papirkurven - kan jeg slette den helt, uden nogle programmer tager skade?

Fix den her linie:
O4 - HKLM\..\Run: [jushed32] C:\WINDOWS\jushed32.exe

Tøm papirkurven, så er din log ren.

For at holde den ren kan du læse i vores artikler om emnet her:
http://www.eksperten.dk/artikler/144
http://www.eksperten.dk/artikler/284
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Mvh:
Fromsej/Team Spywarefri.

Jeg takker ydmygst og deler nogle point ud.

Om få minutter åbner jeg en ny tråd - min lillebrors computer er også inficeret - men en anden form for virus. Læs mere i den nye tråd...

Velbekomme, tak for point.