win2000 kan ikke finde P2esoscks_1018.dll

Udfra hvad jeg har fundet på google har du fået noget snavs på pcén

Vi skal bruge hijackthis For at se hvilke filer som skal fjernes
Er du ny i hijackthis er her en introvideo : ”Gennemgang af hijackthis”
http://www.riversen.dk/?side=instruktion.php


Download og installer nyeste hijackthis – Vælg scan- save log og smid den herind- men du må IKKE fixe noget selv http://www.spywarefri.dk/hjtanv.htm
direkte link :        http://danborg.org/spy/HJT/hijackthis.exe

Hej Danny
Det er faktisk efter et virusscan(McAfee), som jeg kom til at slette filen, så
der lyder lidt mærkeligt i mine øre at der skulle være snavs på min pc som
er oversagen

nå men det var som sagt bare mit resultat efter søgning på google hvor jeg fandt noget på hardwareonline,
Desuden tager antivirus kun meget lidt spyware (tro mig eller lad være) , der skal man anvende adaware og hijackthis

Jeg er fuldstændig enig med Dannyboyd.
Den fil er en af dem vi fjerner når vi renser HiJackThis logs for spyware.

Her er en beskrivelse af den trojaner:
http://secunia.com/virus_information/10881/dialinsace-a/

->tonnybrandt tak for din opbakning

Det der sikkert er sket er at virusscanneren har snuppet selve filen, men ikke henvisningen til filen i reg.basen. Og den henvisning kan ses i HiJackThis loggen *s*

Enig med Tonnybrandt.
->fidel-it ; du må heller ikke tro at din pc er ren fordi du har betalt for et antivirus. Der kan ligge meget spyware, trojaner og også dialers som du har haft , med de efterfølgende ændringer i registry og en del vil bruge ressourcer på computeren, andre kan udnyttes af hackere. Andre programmer kan overvåge din færden på internettet...

En god ide er at supplere med scan med mwav og adaware , tømme sine temp mapper og så en gang i mellem få analyseret sin hijacklog.
Så lad os da bare se den log , der er sikkert meget "spændede" som skal ud...

fint det vil jeg da prøve og komme tilbage ! Jeg tro da på hvad du skriver Dannyboyd,
var bare af den opfattelse McAfee kunne klare sådanne ting

Det er også ok , det er vist en generel opfattelse at bare man har et anerkendt antivirus så er pcén helt ok , så du bliver sikkert overrasket over hvor meget der ellers kan snige sig ind...*s

Her er lige et par artikler om emnet fra team spywarefri (hvor tonnybrandt også er med) http://www.eksperten.dk/artikler/144         Spywarefri pc sikkerhed
http://www.eksperten.dk/artikler/254        Undgå spyware & virus

så vender du bare tilbage når du er klar med en log....

Her er den så (min log) , ja langt de fleste tro at de 'in the clear' med en velkendt anti-vir program , det er vel også det som McAfee med flere vil havde til at tro, venter spændt på
jeres dom !! 

Logfile of HijackThis v1.99.1
Scan saved at 19:17:03, on 18-02-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\GEARSEC.EXE
C:\Programmer\HP Web Jetadmin\hpwebjetd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\HP Web Jetadmin\hpwebjetd.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Programmer\mcafee.com\VSO\mcshield.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\V66SHELL.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Programmer\Winamp\Winampa.exe
C:\Programmer\WildTangent\Apps\GameChannel.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Analog Devices\SoundMAX\Smax4.exe
C:\Programmer\Ahead\InCD\InCD.exe
C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\WINNT\system32\RUNDLL32.exe
C:\WINNT\system32\internat.exe
C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
C:\Programmer\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\wspan\swgw\FilterAgent.exe
C:\Programmer\Microsoft Office\Office\OSA.EXE
C:\WINNT\system32\DllHost.exe
C:\WINNT\system32\hpoinw07.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Programmer\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Programmer\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINNT\system32\ntvdm.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Carsten Grønbech\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.standby.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Replace Search Ctl - {832BEBED-C3DA-4534-A2C2-B2FFF220C820} - C:\WINNT\system32\replaceSearch.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINNT\Downloaded Program Files\IEHelper.dll (file missing)
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINNT\System32\nzdd.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: searchforit - {C109664B-CEB1-420b-B353-D55A561536DD} - C:\WINNT\system32\SYSsfitb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [V66SHELL] V66SHELL.EXE
O4 - HKLM\..\Run: [ASUSTweakEnable] C:\Programmer\ASUS\Tweaking Utilities\atstart.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [WT GameChannel] C:\Programmer\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programmer\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1018.dll,InstantAccess
O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
O4 - Startup: Microsoft Hurtig søgning.lnk = C:\Programmer\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Programmer\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: RealDownload.lnk = C:\Programmer\Real\RealDownload\Realdownload.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Worldspan Filter Agent.lnk = C:\wspan\swgw\FilterAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://www.billetkontoret.dk
O15 - Trusted Zone: www.farewise.dk
O15 - Trusted Zone: http://*.worldspan.com
O15 - Trusted Zone: http://*.wspan.com
O15 - Trusted Zone: http://*.worldspan.com (HKLM)
O15 - Trusted Zone: http://*.wspan.com (HKLM)
O16 - DPF: {03DF0933-6E10-4D32-9835-B9A815622831} (WSSystemInfo Class) - https://gopublic.wspan.com/secure/DLLs/WSSystemInformation.cab
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1018_EN.cab
O16 - DPF: {0B682CC1-FB40-4006-A5DD-99EDD3C9095D} (vbiewer control) - http://www.thepaymentcentre.com/build/vbiewer.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1221EA33-878F-4672-B799-05DAAF1298CF} (sysinfo1 Class) - http://resources.tele2.dk/erhverv/internet/pctest/systeminfo1.dll
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) - http://stream1000.babenet.com/cabs/videox.cab
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,55/mcinsctl.cab
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,72/mcinsctl.cab
O16 - DPF: {5100C059-8E7C-11D6-87CD-024C41534154} (UpdateControl.FWUpdate) - http://www.billetkontoret.dk/farewise-flight/update/UpdateControl.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2728e25eb3d96181ba19/netzip/RdxIE2.cab
O16 - DPF: {5DBE3DC4-53D2-4935-BE03-0ED49B006E63} (UpdateControl.FWUpdate) - http://www.billetkontoret.dk/farewise-flight/update/UpdateControl.CAB
O16 - DPF: {6DD584C4-79F4-4F46-8F81-C26AA75D8467} (ComboBox.UserControl1) - https://go14b.wspan.com/Secure/DLLs/WSCombo.CAB
O16 - DPF: {7B72C3FC-34B5-4504-B4BE-EB38971A0888} (WSFileIO Class 3) - https://gopublic.wspan.com/Secure/Dlls/WSFileIO3.cab
O16 - DPF: {8E27C92B-1264-101C-8A2F-040224009C02} (Calendar Control 8.0) - http://gopublic.wspan.com/secure/DLLs/mscal.cab
O16 - DPF: {9145A52A-9B22-4858-AEE7-74D6C7D3F366} (BrowserConfig Class) - https://go6d.wspan.com/secure/DLLs/WSBrowserConfig.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.jv.dk/activex/AxisCamControl.ocx
O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} - http://fr4-scripts.downloadv3.com/binaries/DialHTML/EGDHTML_pack.cab
O16 - DPF: {A27AD582-5BE5-4C2D-82F0-48B24FE02040} - http://www.adshooter.com/pop_shooter/install/win2000/SYSsfitb.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/f8e4bfa101e77d/player.virtools.com/downloads/player/Install3.0/Installer.exe
O16 - DPF: {CB6F8DE2-913D-4543-9FBB-C1E1340BFD24} (FTPCtrl Class) - http://gopublic.wspan.com/secure/DLLs/wsftp.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1006_1034_pack.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D4233B6D-88A0-11D3-BC29-400011500032} (WspGoCal Class) - http://gopublic.wspan.com/scripts/us/bin/WSCAL.CAB
O16 - DPF: {D62B5127-8D03-4175-BA71-E0041595DA4B} (UDConnect Class) - http://01.sharedsource.org/html/TriacomUD_1.0.0.3ie.cab?
O16 - DPF: {D7C51CB6-56F4-42A2-93B8-14DB47C0C0C4} (UpdateControl.FWUpdate) - http://www.farewise.dk/flight_update/UpdateControl.CAB
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {E99BF99C-5D95-11D4-A0EC-00500489A32D} (WSFileIO Class) - http://gopublic.wspan.com/Scripts/us/DLLs/WSFileIO.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O17 - HKLM\System\CCS\Services\Tcpip\..\{37CAFDB2-E4D6-4B09-899D-577FB5833518}: NameServer = 194.239.134.83
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINNT\system32\GEARSEC.EXE
O23 - Service: HP Web Jetadmin (HPWebJetadmin) - Unknown owner - C:\Programmer\HP Web Jetadmin\hpwebjetd.exe" -k runservice (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Programmer\mcafee.com\VSO\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Som du kan se er den her:

O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1018.dll,InstantAccess

Men et hurtigt blik siger at der er mere i loggen.
Jeg har ikke tid lige nu, så hvis dannyboyd er online, napper han den. Ellers så skriv et indlæg igen om ½-1 times tid, så skal jeg nok tage den.

Hej igen så er jeg tilbage efter lidt research i din log ,  der er en del som skal renses/fixes men start med at hente denne scanner som skal bruges senere.

http://www.mwti.net/download/tools/mwav.exe


Disse linier skal fixes i hijackthis – markér og vælg fix checked:

O2 - BHO: Replace Search Ctl - {832BEBED-C3DA-4534-A2C2-B2FFF220C820} - C:\WINNT\system32\replaceSearch.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINNT\System32\nzdd.dll
O3 - Toolbar: searchforit - {C109664B-CEB1-420b-B353-D55A561536DD} - C:\WINNT\system32\SYSsfitb.dll
O4 - HKLM\..\Run: [WT GameChannel] C:\Programmer\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programmer\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1018.dll,InstantAccess
O4 - Global Startup: RealDownload.lnk = C:\Programmer\Real\RealDownload\Realdownload.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1018_EN.cab
O16 - DPF: {0B682CC1-FB40-4006-A5DD-99EDD3C9095D} (vbiewer control) - http://www.thepaymentcentre.com/build/vbiewer.cab
O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) - http://stream1000.babenet.com/cabs/videox.cab
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN.cab
O16 - DPF: {A27AD582-5BE5-4C2D-82F0-48B24FE02040} - http://www.adshooter.com/pop_shooter/install/win2000/SYSsfitb.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/f8e4bfa101e77d/player.virtools.com/downloads/player/Install3.0/
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1006_1034_pack.cab

Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Disse filer skal du slette i fejlsikret, du kommer i fejlsikret ved at trykke F8 ved opstart:
C:\Programmer\WildTangent\Apps\GameChannel.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
C:\WINNT\system32\replaceSearch.dll

Nb. Hvis du ikke bruger smart card skal denne slettes for ikke at optage unødige ressourcer: C:\WINNT\System32\SCardSvr.exe

Mens du er i fejsikret så kør mvaw scanneren og indstil den til at scanne alle filer.
Start i normal og kom med en ny log....

Dannyboyd > han skal hente denne scanner istedet for den fra mwti.
http://www.spywareinfo.dk/download/mwav.exe

Det er ikke den samme !! Den fra mwti kan ikke længere fjerne vira, blot fortælle om dem.

ok tak for info tonnybrandt , det vidste jeg ikke , var kommet til at slette mit gamle link fra spywarefri.

hej

Har været på ferie !!

Her er en ny log og ja har ikke fået slettes SCardSvr.exe , men det skal jeg havde
gjort !!
Hvordan 'ser' denne log ud 
Logfile of HijackThis v1.99.1
Scan saved at 17:33:39, on 05-03-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\GEARSEC.EXE
C:\Programmer\HP Web Jetadmin\hpwebjetd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\HP Web Jetadmin\hpwebjetd.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Programmer\mcafee.com\VSO\mcshield.exe
C:\WINNT\Explorer.EXE
C:\WINNT\V66SHELL.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Programmer\Winamp\Winampa.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\QuickTime\qttask.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Analog Devices\SoundMAX\Smax4.exe
C:\Programmer\Ahead\InCD\InCD.exe
C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\wspan\swgw\FilterAgent.exe
C:\Programmer\Microsoft Office\Office\OSA.EXE
C:\WINNT\system32\DllHost.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Programmer\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Programmer\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\Carsten Grønbech\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.standby.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: searchforit - {C109664B-CEB1-420b-B353-D55A561536DD} - C:\WINNT\system32\SYSsfitb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [V66SHELL] V66SHELL.EXE
O4 - HKLM\..\Run: [ASUSTweakEnable] C:\Programmer\ASUS\Tweaking Utilities\atstart.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Microsoft Hurtig søgning.lnk = C:\Programmer\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Programmer\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Worldspan Filter Agent.lnk = C:\wspan\swgw\FilterAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://www.billetkontoret.dk
O15 - Trusted Zone: www.farewise.dk
O15 - Trusted Zone: http://*.worldspan.com
O15 - Trusted Zone: http://*.wspan.com
O15 - Trusted Zone: http://*.worldspan.com (HKLM)
O15 - Trusted Zone: http://*.wspan.com (HKLM)
O16 - DPF: {03DF0933-6E10-4D32-9835-B9A815622831} (WSSystemInfo Class) - https://gopublic.wspan.com/secure/DLLs/WSSystemInformation.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1221EA33-878F-4672-B799-05DAAF1298CF} (sysinfo1 Class) - http://resources.tele2.dk/erhverv/internet/pctest/systeminfo1.dll
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,55/mcinsctl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,72/mcinsctl.cab
O16 - DPF: {5100C059-8E7C-11D6-87CD-024C41534154} (UpdateControl.FWUpdate) - http://www.billetkontoret.dk/farewise-flight/update/UpdateControl.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2728e25eb3d96181ba19/netzip/RdxIE2.cab
O16 - DPF: {5DBE3DC4-53D2-4935-BE03-0ED49B006E63} (UpdateControl.FWUpdate) - http://www.billetkontoret.dk/farewise-flight/update/UpdateControl.CAB
O16 - DPF: {6DD584C4-79F4-4F46-8F81-C26AA75D8467} (ComboBox.UserControl1) - https://go14b.wspan.com/Secure/DLLs/WSCombo.CAB
O16 - DPF: {7B72C3FC-34B5-4504-B4BE-EB38971A0888} (WSFileIO Class 3) - https://gopublic.wspan.com/Secure/Dlls/WSFileIO3.cab
O16 - DPF: {8E27C92B-1264-101C-8A2F-040224009C02} (Calendar Control 8.0) - http://gopublic.wspan.com/secure/DLLs/mscal.cab
O16 - DPF: {9145A52A-9B22-4858-AEE7-74D6C7D3F366} (BrowserConfig Class) - https://go6d.wspan.com/secure/DLLs/WSBrowserConfig.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.jv.dk/activex/AxisCamControl.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {CB6F8DE2-913D-4543-9FBB-C1E1340BFD24} (FTPCtrl Class) - http://gopublic.wspan.com/secure/DLLs/wsftp.cab
O16 - DPF: {D4233B6D-88A0-11D3-BC29-400011500032} (WspGoCal Class) - http://gopublic.wspan.com/scripts/us/bin/WSCAL.CAB
O16 - DPF: {D62B5127-8D03-4175-BA71-E0041595DA4B} (UDConnect Class) - http://01.sharedsource.org/html/TriacomUD_1.0.0.3ie.cab?
O16 - DPF: {D7C51CB6-56F4-42A2-93B8-14DB47C0C0C4} (UpdateControl.FWUpdate) - http://www.farewise.dk/flight_update/UpdateControl.CAB
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {E99BF99C-5D95-11D4-A0EC-00500489A32D} (WSFileIO Class) - http://gopublic.wspan.com/Scripts/us/DLLs/WSFileIO.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O17 - HKLM\System\CCS\Services\Tcpip\..\{37CAFDB2-E4D6-4B09-899D-577FB5833518}: NameServer = 194.239.134.83
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C8A4A57-225B-4BF7-ABCE-3FE6E6026574}: NameServer = 194.239.134.83
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINNT\system32\GEARSEC.EXE
O23 - Service: HP Web Jetadmin (HPWebJetadmin) - Unknown owner - C:\Programmer\HP Web Jetadmin\hpwebjetd.exe" -k runservice (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Programmer\mcafee.com\VSO\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Nu skal jeg se på den, men den ser umiddelbart ikke slem ud ...

Denne skal fixes
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2728e25eb3d96181ba19/netzip/RdxIE2.cab

Har du nogen idé til hvorfor du har sat disse i trusted zone i iE?
O15 - Trusted Zone: http://*.worldspan.com
O15 - Trusted Zone: http://*.wspan.com
O15 - Trusted Zone: http://*.worldspan.com (HKLM)
O15 - Trusted Zone: http://*.wspan.com (HKLM

ja det nogle trusted zones jeg benytter i forbindelse med et job, så
de er helt ok  !!

ok så er der ikke mere, men se lidt på de artikler om hvordan du kan holde din pc ren for snavs. 
Så  er det bare fjong
Dennis

fint du skal havde mange tak for din hjælp

http://expfaq.1go.dk/?id=3#behandling_af_svar