Problem med CoolWebSearch

Hent Ewido og Hijackthis her : http://www.arlet.dk/ewidohjt.htm

Er i gang med Ewido

Download CWShredder, der er lavet til at fjerne Coolwebsearch
http://www.intermute.com/products/cwshredder.html og
Sysclean fra trendmicro http://www.trendmicro.com/ftp/products/tsc/sysclean.com

Hvis det ikke virker så post en hijackthis log.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            18:57:10, 12-07-2005
+ Report-Checksum:        6B753327

+ Scan result:

    HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Spyware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Spyware.Altnet : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{145E6FB1-1256-44ed-A336-8BBA43373BE6} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{B599C57E-113A-4488-A5E9-BC552C4F1152} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\TypeLib\{64BFAE89-DA25-41B1-A349-88032CDA7F88} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\WTLBAss.VDOMP -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\WTLBAss.VDOMP\CLSID -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\WTLBAss.VDOMP\CurVer -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\unwcpr2000 -> Spyware.WebRebates : Cleaned with backup
    HKLM\SOFTWARE\Upsf -> Spyware.Delfin : Cleaned with backup
    HKLM\SYSTEM\CurrentControlSet\Services\delprot -> Spyware.iSearch : Cleaned with backup
    HKLM\SYSTEM\CurrentControlSet\Services\delprot\Security -> Spyware.iSearch : Cleaned with backup
    HKLM\SYSTEM\CurrentControlSet\Services\delprot\Enum -> Spyware.iSearch : Cleaned with backup
    HKU\S-1-5-21-1004336348-1035525444-1801674531-500\Software\Dvx -> Spyware.Delfin : Cleaned with backup
    C:\Download I\PaintShopProv8.0FinalTry&BuypatchLasH\Patcher.exe -> Not-A-Virus.Tool.TPE.a : Cleaned with backup
    C:\Download I\Pakkede\PaintShopProv8.0FinalTry&BuypatchLasH.zip/Patcher.exe -> Not-A-Virus.Tool.TPE.a : Error during cleaning
    C:\loader.exe -> TrojanDownloader.Small.bas : Cleaned with backup
    D:\Programmer\WildTangent\Components\SystemConfig0100.dll -> Spyware.WinAD : Cleaned with backup
    :mozilla.10:H:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\ye3ob663.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.6:H:\Documents and Settings\Administrator\Application Data\Phoenix\Profiles\default\3ek7cegz.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.7:H:\Documents and Settings\Administrator\Application Data\Phoenix\Profiles\default\3ek7cegz.slt\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.8:H:\Documents and Settings\Administrator\Application Data\Phoenix\Profiles\default\3ek7cegz.slt\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.14:H:\Documents and Settings\Administrator\Application Data\Phoenix\Profiles\default\3ek7cegz.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
    :mozilla.15:H:\Documents and Settings\Administrator\Application Data\Phoenix\Profiles\default\3ek7cegz.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    H:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Gummy.class-7e60c2e9-1a1d7a8b.class -> Trojan.Java.Femad : Cleaned with backup
    H:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-6fd9f626-792a6cea.class -> TrojanDownloader.Small.wv : Cleaned with backup
    H:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\67Q9O7U9\ncal[1].exe -> TrojanDropper.Small.um : Cleaned with backup
    H:\HijackThis\backups\backup-20050201-212944-434.dll -> Spyware.SearchAssistant : Cleaned with backup
    H:\HijackThis\backups\backup-20050201-213007-472.dll -> Spyware.SearchAssistant : Cleaned with backup
    H:\HijackThis\backups\backup-20050201-213113-128.dll -> Spyware.SearchAssistant : Cleaned with backup
    H:\HijackThis\backups\backup-20050201-221251-107.dll -> Spyware.SearchAssistant : Cleaned with backup
    H:\WINDOWS\LastGood\ceres.dll -> Adware.BetterInternet : Cleaned with backup
    H:\WINDOWS\ms2.exe -> Backdoor.Haxdoor.cn : Cleaned with backup
    H:\WINDOWS\system32\ahgzz.dll -> Spyware.SearchPage : Cleaned with backup
    H:\WINDOWS\system32\appkv32.exe -> Trojan.Agent.bi : Cleaned with backup
    H:\WINDOWS\system32\chim.dll -> Spyware.Hijacker.Generic : Cleaned with backup
    H:\WINDOWS\system32\drivers\delprot.sys -> Trojan.Delprot.a : Cleaned with backup
    H:\WINDOWS\system32\mspp.exe -> Trojan.Agent.bi : Cleaned with backup
    H:\WINDOWS\system32\rhcjecy.exe -> TrojanDownloader.Agent.jc : Cleaned with backup
    H:\WINDOWS\system32\spools.exe -> Backdoor.Delf.zq : Cleaned with backup
    H:\WINDOWS\system32\sunocqp.exe -> TrojanDownloader.Agent.jc : Cleaned with backup
    H:\WINDOWS\system32\tibs.exe -> TrojanDownloader.Small.mx : Cleaned with backup
    H:\WINDOWS\system32\wldr.dll -> TrojanDownloader.Agent.le : Cleaned with backup
    H:\WINDOWS\system32\xee32.dll -> Backdoor.Delf.yo : Cleaned with backup
    H:\WINDOWS\tool.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
    H:\WINDOWS\tool1.exe -> Trojan.LowZones.y : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.0
Scan saved at 19:01:24, on 12-07-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
H:\Programmer\Sygate\SPF\smc.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\System32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\Fælles filer\Stardock\SDMCP.exe
H:\Programmer\Stardock\Object Desktop\WindowBlinds\wbload.exe
H:\WINDOWS\Explorer.EXE
H:\Programmer\Logitech\iTouch\iTouch.exe
H:\WINDOWS\System32\rundll32.exe
H:\WINDOWS\System32\RUNDLL32.EXE
H:\Programmer\SPAMfighter\SFAgent.exe
H:\PROGRA~1\PHILIP~1\VProperty.exe
H:\Programmer\SpywareGuard\sgmain.exe
H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
H:\Programmer\SpywareGuard\sgbhp.exe
H:\Programmer\Internet Explorer\iexplore.exe
H:\HijackThis\HijackThis 1.99.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:mozilla
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [zBrowser Launcher] H:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Jet Detection] H:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [JVM0.14] H:\WINDOWS\System32\bamtm.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "H:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SmcService] H:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ToUcamVProperty] H:\PROGRA~1\PHILIP~1\VProperty.exe
O4 - HKCU\..\Run: [STYLEXP] H:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: SpywareGuard.lnk = H:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: Stardock ObjectDock.lnk = H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Sothink SWF Catcher - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {7AEBACC1-D7E4-4360-B520-6DA4C565B42C} (UploaderCtrl Class) - http://foto.tdconline.dk/upload-classes/Uploader.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O23 - Service: Macromedia Licensing Service - Macromedia - H:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall - Sygate Technologies, Inc. - H:\Programmer\Sygate\SPF\smc.exe
O23 - Service: StyleXPService - Unknown - H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TuneUp WinStyler Theme Service - TuneUp Software GmbH - H:\Programmer\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Ser ud til Ewido har klaret ærterne, Arlet, eller hvordan ser du det?

Nix, de er der stadig, når jeg bruger Spybot.

Du har ikke brugt linket til hijackthis fra mit link, for det er en gammel version du har der..

Hent nyeste her: www.arlet.dk/hjt.exe

Arlet du har stadig denne trojan på din maskine: Troj/Teadoor-B backdoor TROJAN!

Boot maskinen op i safemode:
Kill processen
Start hijackthis
vælg denne entry
O4 - HKLM\..\Run: [JVM0.14] H:\WINDOWS\System32\bamtm.exe
Klik fix it
Rename filen H:\WINDOWS\System32\bamtm.exe

Boot
Download dette offline antivirus program
http://www.spywareinfo.dk/download/mwav.exe
Skan din maskine med mwav.exe
Download sidste vertion af hijackthis 1.99.9 fra www.hijackthis.de
Boot og post en ny log

Logfile of HijackThis v1.99.1
Scan saved at 19:33:04, on 12-07-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\csrss.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
H:\Programmer\Sygate\SPF\smc.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Programmer\Fælles filer\Stardock\SDMCP.exe
H:\Programmer\Stardock\Object Desktop\WindowBlinds\wbload.exe
H:\WINDOWS\System32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\System32\wdfmgr.exe
H:\WINDOWS\System32\wbem\wmiprvse.exe
H:\Programmer\Logitech\iTouch\iTouch.exe
H:\WINDOWS\System32\rundll32.exe
H:\WINDOWS\System32\RUNDLL32.EXE
H:\Programmer\SPAMfighter\SFAgent.exe
H:\PROGRA~1\PHILIP~1\VProperty.exe
H:\Programmer\SpywareGuard\sgmain.exe
H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
H:\Programmer\SpywareGuard\sgbhp.exe
H:\Programmer\Internet Explorer\iexplore.exe
H:\Temp\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:mozilla
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [zBrowser Launcher] H:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Jet Detection] H:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SPAMfighter Agent] "H:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SmcService] H:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ToUcamVProperty] H:\PROGRA~1\PHILIP~1\VProperty.exe
O4 - HKCU\..\Run: [STYLEXP] H:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: SpywareGuard.lnk = H:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: Stardock ObjectDock.lnk = H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Sothink SWF Catcher - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {7AEBACC1-D7E4-4360-B520-6DA4C565B42C} (UploaderCtrl Class) - http://foto.tdconline.dk/upload-classes/Uploader.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O20 - Winlogon Notify: drct16 - H:\WINDOWS\SYSTEM32\drct16.dll
O20 - Winlogon Notify: MCPClient - H:\Programmer\Fælles filer\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - H:\Programmer\Stardock\Object Desktop\WindowBlinds\fastload.dll
O23 - Service: Macromedia Licensing Service - Macromedia - H:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - H:\Programmer\Sygate\SPF\smc.exe
O23 - Service: StyleXPService - Unknown owner - H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - H:\Programmer\TuneUp Utilities 2004\WinStylerThemeSvc.exe

pesko-> Hvad snakker du om??

Jeg har sg ikke en trojan på min maskinen, det ligger helt fast...

Pesko -> Hvordan skal jeg forklare mig pænt... hmm...

Bland dig venligst uden om, jeg er igang med at hjælpe brugeren og dine halve løsninger hjælper ikke, det forvirrer bare brugeren endnu mere..

Jeg er i gang og jeg kører den hele vejen igennem..  Sådan foregår det herinde.

Hey guys.....stay with me

Tak Arlet.....you're the man c",)

Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

----------------------


Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.

F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)

O20 - Winlogon Notify: drct16 - H:\WINDOWS\SYSTEM32\drct16.dll


--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

------------------------------

Hent denne bats fil og kør den :
http://www.spywareinfo.dk/download/cleantempxp2k.bat
den sletter alt i din temp mappe.

------------------------------

Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)
Find og slet disse manuelt :

H:\WINDOWS\SYSTEM32\drct16.dll

-----------------------------

Stadig i fejlsikret:
Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files
Og så trykker du på Scan Clean
Det tager lidt over en time at scanne

-------------------------------


Så genstarter du computeren normalt og laver en ny hijackthis log, som du lægger herind

Ok...tales ved senere

Jeg går ud fra at et klik på "afhjælp valgte problemer" ikke nytter?

Sorry - glem lige den kommentar

Ny log, efter Kaspersky og sletning af diverse filer. Måtte bruge Dr. Delete til drct16.dll

Logfile of HijackThis v1.99.1
Scan saved at 22:25:34, on 12-07-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
H:\Programmer\Sygate\SPF\smc.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\System32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\Fælles filer\Stardock\SDMCP.exe
H:\Programmer\Stardock\Object Desktop\WindowBlinds\wbload.exe
H:\WINDOWS\Explorer.EXE
H:\Programmer\Logitech\iTouch\iTouch.exe
H:\WINDOWS\System32\rundll32.exe
H:\WINDOWS\System32\RUNDLL32.EXE
H:\Programmer\SPAMfighter\SFAgent.exe
H:\PROGRA~1\PHILIP~1\VProperty.exe
H:\Programmer\SpywareGuard\sgmain.exe
H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
H:\Programmer\SpywareGuard\sgbhp.exe
H:\WINDOWS\System32\wuauclt.exe
H:\HijackThis\HiJackThis 1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:mozilla
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [zBrowser Launcher] H:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Jet Detection] H:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SPAMfighter Agent] "H:\Programmer\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SmcService] H:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ToUcamVProperty] H:\PROGRA~1\PHILIP~1\VProperty.exe
O4 - HKCU\..\Run: [STYLEXP] H:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: SpywareGuard.lnk = H:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: Stardock ObjectDock.lnk = H:\Programmer\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Sothink SWF Catcher - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - H:\Programmer\Fælles filer\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {7AEBACC1-D7E4-4360-B520-6DA4C565B42C} (UploaderCtrl Class) - http://foto.tdconline.dk/upload-classes/Uploader.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O20 - Winlogon Notify: MCPClient - H:\Programmer\Fælles filer\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - H:\Programmer\Stardock\Object Desktop\WindowBlinds\fastload.dll
O23 - Service: Macromedia Licensing Service - Macromedia - H:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - H:\Programmer\Sygate\SPF\smc.exe
O23 - Service: StyleXPService - Unknown owner - H:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - H:\Programmer\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Og de er der stadigvæk.......hmmmmmmrrrrffffff.....

Hej download CWShredder 2.15 den er beregnet til at fjerne Not so coolwebsearch
Linker er http://www.bleepingcomputer.com/files/cwshredder.php

I tillæg til dette har du 2 andre nasty sjovere som må fjernes

Boot din maskine op i safemode
Kør CWShredder

Start killbox
Skriv ind stien til
H:\Programmer\Fælles filer\Stardock\mcpstub.dll
H:\Programmer\Stardock\Object Desktop\WindowBlinds\fastload.dll
Klikk det røde kryds (delete on boot)
Ta backup af filerne FØR boot.
Og rename filen til mcpstub.dll.bad og fastload.dll

Boot
Create system restore point
Hvis du ikke ved hvordan se her http://ict.cas.psu.edu/Training/HowTo/ENComputers/RestorePoint.html

Start hijackthis
vælg dette
O20 - Winlogon Notify: MCPClient - H:\Programmer\Fælles filer\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - H:\Programmer\Stardock\Object Desktop\WindowBlinds\fastload.dll
click fix it.
boot
Da skulle Coolwebsearch være væk.

Jeg må nok give Arlet ret. Du skal ikke blande dig i noget, som du ikke kan gabe over. De 2 filer du henviser til er IKKE, og jeg gentager, IKKE virus. Det er programmer som jeg bruger dagligt.

Og hvis du absolut skal linke til noget, så check lige om det er den rigtige fil du linker til.

Så til sidst kan jeg sige, at filerne, indtil videre, er væk.

Grunden til at jeg bad dig om at køre systemrestore FØR du fjernede de 2 filer var at der kunne hvis det jeg det jeg sagde viste sig at være forkert rulle tilbage.

I øvrigt så bruges CWShredder til at fjerne Coolwebsearch. Men ok du skal slippe flere indlæg fra mig.

Har ikke lige været hjemme, så undskyld mit sene svar..

Finder spybot stadig de ting og hvad gør du når den finder dem??