Åh nej spyware eller hvad

Download hijackthis herfra og gem det i en folder for sig selv på dit skrivebord

http://www.downloadportal.dk/viewinfo.asp?rid=1658
Eller
http://www.arlet.dk/hjt.exe

Start programmet og vælge, at udføre en scan samt gemme en log fil.
Når hijackthis er færdig med, at scanne vil den bede dig om en placering hvor du vil gemme "hijackthis" en tekst fil.
Gem den i samme folder som hijackthis. Når du har sagt okay hopper der et nyt vindue frem nemlig notepad med en masse tekst linjer. Marker alle linjerne og kopir dem herind så jeg kan kigge på dem. Du må ikke selv begynde, at fikse noget i hijackthis.

Eller prøv at slå systemgendannelse fra. Sluk computeren og start den i fejlsikker tilstand. Kør ad adware og spybot og start computeren normalt og slå systemgendannelse til igen.

Logfile of HijackThis v1.99.1
Scan saved at 12:17:16, on 16-05-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
c:\windows\system32\xkwqmte.exe
C:\windows\splionw.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\vjopagnt.exe
C:\WINDOWS\System32\vwiompos.exe
C:\Documents and Settings\Svend Christensen\Skrivebord\runescape.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Svend Christensen\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abcsearch4u.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [zgpyvk] c:\windows\system32\xkwqmte.exe
O4 - HKLM\..\Run: [775O3FQ] vwiompos.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Programmer\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [iocfypn] c:\windows\yguieep.exe
O4 - HKCU\..\Run: [Aaot] C:\Documents and Settings\Svend Christensen\Application Data\eeio.exe
O4 - HKCU\..\Run: [cadwwtn] c:\windows\yguieep.exe
O4 - HKCU\..\Run: [Oqbz] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [MwuERPcmh] vjopagnt.exe
O4 - HKCU\..\Run: [tqjyfwx] c:\windows\wymncfb.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [kiddsfd] c:\windows\splionw.exe
O4 - HKCU\..\Run: [dljyvdd] c:\windows\splionw.exe
O4 - HKCU\..\Run: [kcepnhj] c:\windows\splionw.exe
O4 - HKCU\..\Run: [pbtgixu] c:\windows\splionw.exe
O4 - HKCU\..\Run: [aradhnu] c:\windows\splionw.exe
O4 - HKCU\..\Run: [lorljnl] c:\windows\splionw.exe
O4 - HKCU\..\Run: [hklumqf] c:\windows\splionw.exe
O4 - HKCU\..\Run: [iilqvbb] c:\windows\splionw.exe
O4 - HKCU\..\Run: [knyewgy] c:\windows\splionw.exe
O4 - HKCU\..\Run: [qenvfxx] c:\windows\splionw.exe
O4 - HKCU\..\Run: [rweskey] c:\windows\splionw.exe
O4 - HKCU\..\Run: [mwwkdsc] c:\windows\splionw.exe
O4 - HKCU\..\Run: [iymskkv] c:\windows\splionw.exe
O4 - HKCU\..\Run: [dkivhyw] c:\windows\splionw.exe
O4 - HKCU\..\Run: [krqovad] c:\windows\splionw.exe
O4 - HKCU\..\Run: [onrhchw] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [siknaht] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [qvebywn] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [emxmyam] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [akpmqfj] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [perssjg] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [wepjxig] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [spphkpq] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [jkqqwub] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [qejpugu] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [vovmxwi] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [guqxyib] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [hiyyjis] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [amtnubw] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [tqdwyri] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [ovctwdu] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [upawpkm] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [eahodix] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [shnqanw] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [clherma] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [tpmcrvv] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [sfnqyjg] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [gyapjis] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [pipxxqd] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [wdnjixj] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [whaapps] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [qmxcbsn] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [ffpwqqv] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [qqhhsll] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [lnufbqq] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [weekdfl] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [wdcvqho] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [fyprxoq] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [srehbvj] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [nmkbxwp] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [rdvsjex] c:\windows\ocfofpn.exe
O4 - Global Startup: Aktiver trådløst Labtec-tastatursæt.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Microsoft AntiSpyware helper - {FA940B56-3F10-4460-9087-258724BF0E45} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FA940B56-3F10-4460-9087-258724BF0E45} - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116082913313
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.172.102/336//main.chm::/update.exe
O20 - Winlogon Notify: drct16 - drct16.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

her er hijack tingen

<kalp>: Er du der ?

yep nu:)

Meget meget snavset maskine.

Hent dette værktøj først
http://www.spywareedge.net/nf/nailfix.exe
Dobbeltklik på nailfix.exe, som du hentede før. Klik "Next" (der skal være flueben i "Run Nailfix") - og klik "Finish".

Download LSPFix. Vi skal bruge den senere.
http://cexx.org/lspfix.zip

Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Download Ewido (Trial version) (Vi skal bruge den senere)
http://shop.element5.com/product.html?productid=531168

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.

Slet denne mappe

C:\WINDOWS\isrvs\

Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelt tjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abcsearch4u.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/index.htm
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [zgpyvk] c:\windows\system32\xkwqmte.exe
O4 - HKLM\..\Run: [775O3FQ] vwiompos.exe
O4 - HKCU\..\Run: [iocfypn] c:\windows\yguieep.exe
O4 - HKCU\..\Run: [Aaot] C:\Documents and Settings\Svend Christensen\Application Data\eeio.exe
O4 - HKCU\..\Run: [Oqbz] C:\WINDOWS\System32\l?ass.exe
O4 - HKCU\..\Run: [MwuERPcmh] vjopagnt.exe
O4 - HKCU\..\Run: [tqjyfwx] c:\windows\wymncfb.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [kiddsfd] c:\windows\splionw.exe
O4 - HKCU\..\Run: [dljyvdd] c:\windows\splionw.exe
O4 - HKCU\..\Run: [kcepnhj] c:\windows\splionw.exe
O4 - HKCU\..\Run: [pbtgixu] c:\windows\splionw.exe
O4 - HKCU\..\Run: [aradhnu] c:\windows\splionw.exe
O4 - HKCU\..\Run: [lorljnl] c:\windows\splionw.exe
O4 - HKCU\..\Run: [hklumqf] c:\windows\splionw.exe
O4 - HKCU\..\Run: [iilqvbb] c:\windows\splionw.exe
O4 - HKCU\..\Run: [knyewgy] c:\windows\splionw.exe
O4 - HKCU\..\Run: [qenvfxx] c:\windows\splionw.exe
O4 - HKCU\..\Run: [rweskey] c:\windows\splionw.exe
O4 - HKCU\..\Run: [mwwkdsc] c:\windows\splionw.exe
O4 - HKCU\..\Run: [iymskkv] c:\windows\splionw.exe
O4 - HKCU\..\Run: [dkivhyw] c:\windows\splionw.exe
O4 - HKCU\..\Run: [krqovad] c:\windows\splionw.exe
O4 - HKCU\..\Run: [onrhchw] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [siknaht] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [qvebywn] c:\windows\thbosrj.exe
O4 - HKCU\..\Run: [emxmyam] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [akpmqfj] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [perssjg] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [wepjxig] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [spphkpq] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [jkqqwub] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [qejpugu] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [vovmxwi] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [guqxyib] c:\windows\vderunh.exe
O4 - HKCU\..\Run: [hiyyjis] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [amtnubw] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [tqdwyri] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [ovctwdu] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [upawpkm] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [eahodix] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [shnqanw] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [clherma] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [tpmcrvv] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [sfnqyjg] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [gyapjis] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [pipxxqd] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [wdnjixj] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [whaapps] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [qmxcbsn] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [ffpwqqv] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [qqhhsll] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [lnufbqq] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [weekdfl] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [wdcvqho] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [fyprxoq] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [srehbvj] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [nmkbxwp] c:\windows\ocfofpn.exe
O4 - HKCU\..\Run: [rdvsjex] c:\windows\ocfofpn.exe
O9 - Extra button: Microsoft AntiSpyware helper - {FA940B56-3F10-4460-9087-258724BF0E45} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FA940B56-3F10-4460-9087-258724BF0E45} - (no file) (HKCU)
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c5.cab
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.172.102/336//main.chm::/update.exe
O20 - Winlogon Notify: drct16 - drct16.dll (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Højreklik på windows start knappen (helt nede i venstre hjørne af din skærm) og vælge "Stifinder", klik på Funktioner->Mappeindstillinger->Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Find og slet (Kig godt efter!!.. Det du ikke finder har hijackthis muligvis selv kunne slette!)

Filerne

c:\windows\system32\xkwqmte.exe
C:\WINDOWS\System32\l?ass.exe
c:\windows\thbosrj.exe
c:\windows\vderunh.exe
c:\windows\splionw.exe
C:\WINDOWS\System32\vjopagnt.exe
c:\windows\ocfofpn.exe
C:\WINDOWS\System32\vwiompos.exe
c:\windows\wymncfb.exe
c:\windows\yguieep.exe
C:\Documents and Settings\Svend Christensen\Application Data\eeio.exe
C:\WINDOWS\svcproc.exe

søg efter disse filer og slet dem:

BackWeb-8876480.exe
drct16.dll

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Scan med Ewido nu!

Genstart normalt nu.

Kør LSPfix nu, sæt flueben i "I know what I am doing" klik på finish, genstart og send mig en ny log fra hijackthis.

(Hvad endte denne tråd mon med?)

Den er helt clean nu tak