jeg har spyware, hvad gør jeg?

Følg vejledningen her:
Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker du Hijackthis og smider filen i en mappe, oprettet kun til den. Kør filen, scan, save log og kopier logfilen herind, så kigger vi på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Ok, spring i så fald spybot over og kom blot med HiJacjkThis loggen.

(Havde ikke lige lagt mærke til at du havde kørt spybot)

Det efterfølgende er opskriften på afinstallering fra producenten selv.
På trods af dette har flere rapporteret at det skulle virke efter hensigten.
Min anbefaling må være at afinstallere efter nedenstående opskrift, genstarte computeren og derefter køre Spybot og Hijackthis for at være helt sikker.


PROCEDURE 1 (Add/Remove Programs):
1.    Click on Start.
2.    Click on Settings.
3.    Click on Control Panel.
4.    From the Control Panel, double-click on Add/Remove Programs.
5.    Click on the Install/Uninstall tab in the Add/Remove Programs Properties window.
6.    Locate either New.net Application or New.net Domains and select it.
7.    Click on the Add/Remove button.
8.    After removal of our software, you may be prompted to reboot. Please reboot after removing our software.
9.    If this does not fully remove our software, please proceed to PROCEDURE 2.

PROCEDURE 2 (Uninstall from Hard Drive):
1.    Double-click on My Computer.
2.    Double-click on the C: drive.
3.    Double-click on the Program Files folder.
4.    Locate and double-click on the NewDotNet folder. If there is no folder, please proceed to PROCEDURE 3.
5.    Locate and double-click on the uninstall executable; it will be labeled uninstallX_XX.exe. (“X” represents the version number of the uninstaller and you should always use the latest version)
6.    After removal of our software, you may be prompted to reboot. Please reboot after removing our software.
7.    If this does not fully remove our software, please proceed to PROCEDURE 3.

PROCEDURE 3 (Locate Backup Copy of Uninstaller and Uninstall from Hard Drive):
1.    Double-click on My Computer.
2.    Double-click on the C: drive.
3.    Double-click on the Windows or Winnt folder.
4.    Locate and double-click on the uninstall executable; it will be labeled NDNuninstallX_XX.exe. ("X" represents the version number of the uninstaller)
5.    After removal of our software, you may be prompted to reboot. Please reboot after removing our software.
6.    If this does not fully remove our software, please proceed to PROCEDURE 4.

PROCEDURE 4 (Download Uninstall from New.net):
1.    From a computer that has Internet access, click on the following link:
http://www.new.net/support/uninstall6_38.exe.
2.    Download and save uninstall6_38.exe to a 3-½ floppy disk.
3.    Insert the floppy disk into the floppy drive of the computer that needs to have our software uninstalled from.
4.    Click on Start.
5.    Click on Run.
6.    In the Open window type, A:\uninstall6_38.exe.
7.    Click on the OK button.
8.    After removal of our software, you may be prompted to reboot. Please reboot after removing our software.

In addition, some versions appear to come with an additional file that appears under MSIE: the Tldctl2c Class. To remove this...

In Internet Explorer, click on Tools > Internet Options. Select the General tab. Click Settings > View Objects. In the Downloaded Program Files window, find Tldctl2c Class and delete it. Rebooting the computer will complete the removal.

Logfile of HijackThis v1.98.2
Scan saved at 14:09:10, on 21-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~2\NORTON~1\navapw32.exe
D:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
D:\Programmer\Messenger Plus! 3\MsgPlus.exe
D:\Programmer\Internet Explorer\iexplore.exe
D:\Programmer\Norton AntiVirus\navapsvc.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\snmp.exe
d:\progra~2\intern~1\iexplore.exe
D:\Programmer\Internet Explorer\iexplore.exe
D:\Documents and Settings\Jonas\Skrivebord\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.zxywjgvdgutvalrkk.com/H8V2li7sq3SJuzWOe_PRptaCfA6qbMYyu4wD6lHCId6Xiq1Omp4uY8NnAnx_XR6q.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {563F4885-43AA-A364-2E44-B7836DD720E7} - D:\DOCUME~1\Jonas\APPLIC~1\MEOWEX~1\Third 2.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~2\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programmer\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [poll pure flap dale] D:\Documents and Settings\All Users\Application Data\Idol Plan Poll Pure\elsewave.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~2\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programmer\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [rdr nurb] D:\DOCUME~1\Jonas\APPLIC~1\BLAH16~1\Bits city ooze.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmer\Messenger\msmsgs.exe

Jeg kigger lige på den ..

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.zxywjgvdgutvalrkk.com/H8V2li7sq3SJuzWOe_PRptaCfA6qbMYyu4wD6lHCId6Xiq1Omp4uY8NnAnx_XR6q.jpg
O2 - BHO: (no name) - {563F4885-43AA-A364-2E44-B7836DD720E7} - D:\DOCUME~1\Jonas\APPLIC~1\MEOWEX~1\Third 2.exe
O4 - HKLM\..\Run: [poll pure flap dale] D:\Documents and Settings\All Users\Application Data\Idol Plan Poll Pure\elsewave.exe
O4 - HKCU\..\Run: [rdr nurb] D:\DOCUME~1\Jonas\APPLIC~1\BLAH16~1\Bits city ooze.exe


Genstart i Fejlsikret tilstand. (Klik F8 under opstarten)

---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Alle filer og mapper"
Klik på "Avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
D:\DOCUME~1\Jonas\APPLIC~1\MEOWEX~1
D:\Documents and Settings\All Users\Application Data\Idol Plan Poll Pure
D:\DOCUME~1\Jonas\APPLIC~1\BLAH16~1

Filer:
<ingen>

Genstart normalt og kom med en ny log til kontrol

Logfile of HijackThis v1.98.2
Scan saved at 16:17:37, on 21-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~2\NORTON~1\navapw32.exe
D:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
D:\Programmer\Messenger Plus! 3\MsgPlus.exe
D:\Programmer\Norton AntiVirus\navapsvc.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\snmp.exe
D:\Documents and Settings\Jonas\Skrivebord\hijackthis.exe
D:\Programmer\Winamp\winamp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~2\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Programmer\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~2\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "D:\Programmer\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "D:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmer\Messenger\msmsgs.exe

de forskellige toolbars er forsvundet, mange tak for hjælpen. Tonny smid lige et svar så du kan få dine point.

mvh jonas

Den er også fin og flot nu.

Du kan evt installere nogle af programmerne i spywarefri pakken..de er alle små, konflikter ikke og er meget effektive mod snavs af den slags du lige har været angrebet af.

Specielt anbefaler vi Spybot,spywareblaster, IE-Spyad og spywareguard.
Se mere i "pakken" her
http://www.spywarefri.dk/pakken.htm

Kan spørgsmålet lukkes ?

Takker for point :)