ntst.exe?

undskyld filen hedder ctst.exe

prøv at kør en online scan på www.kriminitet.dk - under antivirus. Den er rigtig god.

dødt link hos mig

Der står noget om den her:

http://www.sophos.com/virusinfo/analyses/w32forbotdj.html

også her

... og det er www.kriminalitet.dk ;)

Følg vejledningen her:
Gå ind her og hent Spybot og Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer, genstart.
Derefter udpakker du Hijackthis og smider filen i en mappe, oprettet kun til den. Kør filen, scan, save log og kopier logfilen herind, så kigger vi på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

afhjælp valgte problemer??? tusind tak for det men er lidt i tvivl om dette punkt?

aha har fundet ud af hvad du mente nu... ok fortsætter

Logfile of HijackThis v1.99.0
Scan saved at 21:54:18, on 23-01-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\ctst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\System32\csdata32.exe
C:\WINDOWS\Mixer.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Documents and Settings\Spliff0\Skrivebord\downloads\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pcgtvszgiapebgq.com/yN8lqKQdXf2A2Oc1GR4Scst/fYKolr2h1UyFRKC4BK0_5DbLb1d1_2lMz7cf6bh5.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://iodzfdhugjabrwfuan.net/yN8lqKQdXf0L8znIfqv/CszSwhhgEObXWyHgAFG/t5g.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: C:\WINDOWS\lbbho.dll - {06A664B0-CFAC-4B4D-8D84-9F3CD3578E93} - C:\WINDOWS\lbbho.dll (file missing)
O2 - BHO: (no name) - {61BA4E32-3314-B216-B707-D538802BE84D} - C:\DOCUME~1\Spliff0\APPLIC~1\GLUESA~1\License Bone.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [AbsoluteControl] C:\Programmer\AbsoluteControl\AbsoluteControl.exe
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Programmer\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [LOGOCHICROADSTUPID] C:\Documents and Settings\All Users\Application Data\Cast dog logo chic\First vc.exe
O4 - HKLM\..\Run: [Microsoft Data Machine] csdata32.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Data Machine] csdata32.exe
O4 - HKLM\..\RunOnce: [Microsoft Data Machine] csdata32.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AbsoluteControl] C:\Programmer\AbsoluteControl\AbsoluteControl.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Ref 4] C:\DOCUME~1\Spliff0\APPLIC~1\HOPEME~1\surfmagspop.exe
O4 - HKCU\..\Run: [Microsoft Data Machine] csdata32.exe
O4 - HKCU\..\RunOnce: [Microsoft Data Machine] csdata32.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1E5592CB-8F5B-46F8-9EA6-65C01213808A} (InstaladorBetyByte Control) - http://www2.redzone.dk/uploads/cab/instaladorbetybyte.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1104628290515
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/da/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {7099D57A-2CF3-4919-9874-A035F8193AA0} (InstaladorCharisma Control) - http://www2.redzone.dk/download/charisma/instaladorcharisma.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://195.41.18.51/activex/AxisCamControl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://sc.communities.msn.com/controls/chat/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O23 - Service: Adobe LM Service - Unknown - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programmer\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programmer\AVPersonal\AVWUPSRV.EXE
O23 - Service: CPUCooLServer Service - Unknown - C:\Programmer\CPUCooL\CooLSrv.exe (file missing)
O23 - Service: Event Locator - Unknown - C:\WINDOWS\System32\ctst.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\Spliff0\LOKALE~1\Temp\hpdj.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Languard  - Unknown - C:\Programmer\LANguard\ndismodule.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

det skal lige siges at jeg bruger firefox

Ok, men der er virus i den, så vi renser den alligevel, som om du brugte IE. Du får en procedure om nogle minutter ...

Hent denne Kaspersky scanner, den skal du bruge senere.
http://www.spywareinfo.dk/download/mwav.exe - Virusscanner.


Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pcgtvszgiapebgq.com/yN8lqKQdXf2A2Oc1GR4Scst/fYKolr2h1UyFRKC4BK0_5DbLb1d1_2lMz7cf6bh5.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://iodzfdhugjabrwfuan.net/yN8lqKQdXf0L8znIfqv/CszSwhhgEObXWyHgAFG/t5g.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: C:\WINDOWS\lbbho.dll - {06A664B0-CFAC-4B4D-8D84-9F3CD3578E93} - C:\WINDOWS\lbbho.dll (file missing)
O2 - BHO: (no name) - {61BA4E32-3314-B216-B707-D538802BE84D} - C:\DOCUME~1\Spliff0\APPLIC~1\GLUESA~1\License Bone.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LOGOCHICROADSTUPID] C:\Documents and Settings\All Users\Application Data\Cast dog logo chic\First vc.exe
O4 - HKLM\..\Run: [Microsoft Data Machine] csdata32.exe
O4 - HKLM\..\RunServices: [Microsoft Data Machine] csdata32.exe
O4 - HKLM\..\RunOnce: [Microsoft Data Machine] csdata32.exe
O4 - HKCU\..\Run: [Ref 4] C:\DOCUME~1\Spliff0\APPLIC~1\HOPEME~1\surfmagspop.exe
O4 - HKCU\..\Run: [Microsoft Data Machine] csdata32.exe
O4 - HKCU\..\RunOnce: [Microsoft Data Machine] csdata32.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O23 - Service: Event Locator - Unknown - C:\WINDOWS\System32\ctst.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\Spliff0\LOKALE~1\Temp\hpdj.exe

Kender du dette program ? Hvis ikek skal disse linier også fixes:
O4 - HKLM\..\Run: [AbsoluteControl] C:\Programmer\AbsoluteControl\AbsoluteControl.exe
O4 - HKCU\..\Run: [AbsoluteControl] C:\Programmer\AbsoluteControl\AbsoluteControl.exe

Det samme med denne linie. Det er kun lykkes mig at finde en italiensk side der omhandler modulet og det forstår jeg ikke noget af. Men det at man kun kan finde en enkelt side, gør at jeg tror det er snavs. Du bør fjerne den, men være opmærksom, når du starter op, og hvis du får fejl, kan du gendanne linien ved at trykke config | backups, markere linien og trykke restore.
O23 - Service: Languard  - Unknown - C:\Programmer\LANguard\ndismodule.exe

Så skal du genstarte pc'en i fejlsikret tilstand. Klik F8 under opstart.

---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Alle filer og mapper"
Klik på "Avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Slet disse Mapper:
C:\Documents and Settings\Spliff0\Application Data\GLUESA???
C:\Documents and Settings\Spliff0\Application Data\HOPEME??
C:\Documents and Settings\All Users\Application Data\Cast dog logo chic

Tøm indholdet af denne mappe:
C:\Documents and Settings\Spliff0\Local settings\temp\

slet disse Filer:
C:\WINDOWS\lbbho.dll
C:\WINDOWS\nsdb\hosts
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
csdata32.exe
C:\WINDOWS\System32\ctst.exe


---------------------------------------
Så kører du engangsskanneren fra Kaspersky - Aktiver det hele i opsætningen derinde, så den kan skanne alt igennem.
---------------------------------------

Genstart normalt og kom med en ny log til kontrol

Mht denne linie:
O23 - Service: Languard  - Unknown - C:\Programmer\LANguard\ndismodule.exe

Er jeg nu sikker på at den skal væk. Se denne side:
http://www.pestpatrol.com/PestInfo/l/languard_network_scanner.asp

Takker for point, men jeg synes nu du skulle lægge en ny HiJackThis log til kontrol.
Det er ret normalt at man misser et par linier, når der er så mange.