nettet hopper af

Hent det her program:
http://cexx.org/lspfix.zip
Udpak det, og kør programmet. Sæt flueben i I know what I am doing, klik på finish, genstart og test om det hjalp på problemet.

Hvis ikke skal vi nok lige se en HiJackThis log fra dig:

Følg vejledningen her:
Gå ind her og hent Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Kør Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Logfile of HijackThis v1.99.1
Scan saved at 14:30:07, on 09-03-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
D:\Programmer\WindowBlinds\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\TCAUDIAG.exe
C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\rundll32.exe
D:\Programmer\D-Tools\daemon.exe
C:\Programmer\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
C:\WINDOWS\System32\devldr32.exe
D:\Programmer\Netlimiter\NetLimiter.exe
D:\Programmer\Winamp\winampa.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\spil\steam\steam.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kristi4n\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmer\NewDotNet\newdotnet6_38.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] D:\programmer\nero\InCD.exe
O4 - HKLM\..\Run: [AceGain LiveUpdate] D:\spil\battlefield vietnam\acegain\liveupdate.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [Dynu Enterprise Server Manager] D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\esconfig.exe -hide
O4 - HKLM\..\Run: [LogonStudio] "D:\Programmer\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NetLimiter] D:\Programmer\Netlimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [WinampAgent] D:\Programmer\Winamp\winampa.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\spil\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Active Desktop Calendar] D:\Programmer\Active Desktop Calendar\ADC.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\poker\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095164084170
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/236/webolr/OCX/FlashAX.cab
O20 - Winlogon Notify: WB - D:\PROGRA~1\WINDOW~1\fastload.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Dynu Control Server (dynucontrol) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuctrl.exe (file missing)
O23 - Service: Dynu FTP Server (dynuftp) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuftp.exe (file missing)
O23 - Service: Dynu IMAP Server (dynuimap) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuimap.exe (file missing)
O23 - Service: Dynu POP3 Server (dynupop3) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynupop3.exe (file missing)
O23 - Service: Dynu Proxy Server (dynuproxy) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuprxy.exe (file missing)
O23 - Service: Dynu Relay Server (dynurelay) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynurly.exe (file missing)
O23 - Service: Dynu SMTP Server (dynusmtp) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynusmtp.exe (file missing)
O23 - Service: Dynu Web Server (dynuweb) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuweb.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Vi napper lige New.net i første omgang, så ser vi hvor meget der er tilbage bagefter.

Hent de her to programmer:
http://cexx.org/lspfix.zip
http://danborg.org/spy/Newnet/winsockxpfix.exe - Winsockfix.
Forklaring følger.

Hent denne uninstaller: http://www.newdotnet.com/ det link du skal bruge skal du finde på siden, det ser således ud:
http://www.new.net/support/uninstall6_34.exe

Hent denne (Kaspersky) scanner, den skal du bruge senere.
http://www.spywareinfo.dk/download/mwav.exe - Virusscanner.

Fjern Newdotnet/Newnet i Tilføj/fjern programmer hvis du kan.
Kør Newdotnet uninstalleren fra diskette som de skriver på siden, genstart, mister du din internetforbindelse skal du bruge Lspfix eller Winsockfix til at genetablere den.
Forklaring følger allernederst:

Så kører du engangsskanneren fra Kaspersky - Aktiver det hele i opsætningen derinde, så den kan skanne alt igennem.
Genstart, husk at genaktivere ALLE sikkerhedsprogrammer inden du går på nettet.

Genstart og kom med en ny HiJackThis logfil til kontrol.

----------------------------------------------------
Kør først LSPfix, sæt flueben i I know what I am doing, klik på finish, genstart så burde det virke.
Gør det ikke det, så prøv Winsockfix, klik først på Reg-backup, og gem en kopi af din regdatabase, når det er slut klik på Fix, når den er færdig genstart og så skulle du gerne kunne komme på nettet igen.

Logfile of HijackThis v1.99.1
Scan saved at 08:17:04, on 14-03-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
D:\Programmer\WindowBlinds\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\TCAUDIAG.exe
C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programmer\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
D:\Programmer\Netlimiter\NetLimiter.exe
D:\spil\steam\steam.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Kristi4n\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmer\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Programmer\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NetLimiter] D:\Programmer\Netlimiter\NetLimiter.exe /s
O4 - HKCU\..\Run: [Steam] "d:\spil\steam\steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - D:\Programmer\MultiPoker\MultiPoker.exe
O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - D:\Programmer\MultiPoker\MultiPoker.exe
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - D:\poker\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095164084170
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/236/webolr/OCX/FlashAX.cab
O20 - Winlogon Notify: WB - D:\PROGRA~1\WINDOW~1\fastload.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Dynu Control Server (dynucontrol) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuctrl.exe (file missing)
O23 - Service: Dynu FTP Server (dynuftp) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuftp.exe (file missing)
O23 - Service: Dynu IMAP Server (dynuimap) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuimap.exe (file missing)
O23 - Service: Dynu POP3 Server (dynupop3) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynupop3.exe (file missing)
O23 - Service: Dynu Proxy Server (dynuproxy) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuprxy.exe (file missing)
O23 - Service: Dynu Relay Server (dynurelay) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynurly.exe (file missing)
O23 - Service: Dynu SMTP Server (dynusmtp) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynusmtp.exe (file missing)
O23 - Service: Dynu Web Server (dynuweb) - Unknown owner - D:\Programmer\BPFTP Server\Dynu Enterprise Server v1.17\dynuweb.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Hvis du bruger stardock er du nu færdig.

Det er denne linie som burde være stardock, men den er normalt installeret i en folder der hedder stardock og det er ikke tilfældet her:

O20 - Winlogon Notify: WB - D:\PROGRA~1\WINDOW~1\fastload.dll

Kender du ikke stardock, så skal ovennævnte linie fixes i fejlsikret tilstand.

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse  - genstart din computer - aktiver systemgendannelse.
(klik start | indstillinger | kontrolpanel | system, fanebladet systemgendannelse)

Du kan evt installere nogle af programmerne i spywarefri pakken..de er alle små, konflikter ikke og er meget effektive mod snavs af den slags du lige har været angrebet af.

Specielt anbefaler vi Spybot,spywareblaster, IE-Spyad og spywareguard.
Se mere i "pakken" her
http://www.spywarefri.dk/pakken.htm

Endvidere skal du også lige en tur på windowsupdate og have computeren opdateret. Du mangler servicepacks på maskinen.

jeg bruger ikke stardock. men tak for hjælpen

Velbekomme og takker for point :)