Uønsket proceslinie

Download hijackthis herfra og gem det i en folder for sig selv på dit skrivebord

http://www.downloadportal.dk/viewinfo.asp?rid=1658
Eller
http://www.arlet.dk/hjt.exe

Start programmet og vælge, at udføre en scan samt gemme en log fil.
Når hijackthis er færdig med, at scanne vil den bede dig om en placering hvor du vil gemme "hijackthis" en tekst fil.
Gem den i samme folder som hijackthis. Når du har sagt okay hopper der et nyt vindue frem nemlig notepad med en masse tekst linjer. Marker alle linjerne og kopir dem herind så jeg kan kigge på dem. Du må ikke selv begynde, at fikse noget i hijackthis.

Her er logfilen, håber det kan hjælpe.
vh Thormod

Logfile of HijackThis v1.99.1
Scan saved at 12:27:27, on 21-07-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\LVComS.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Programmer\SkoleKom\Fcc32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\UK\Skrivebord\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6303F885-05C9-25EB-2320-676D836F6E96} - C:\DOCUME~1\Lea\APPLIC~1\AMENON~1\Cool Tick.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programmer\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ping type enc obj] C:\Documents and Settings\All Users\Application Data\Book inside ping type\FASTBIRD.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2DBEFB64-B6C4-4A2C-BE6A-16FF065B99C6} - http://www.dialerzona.com/cuadruple.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Kalp > Den infektion (lop) er vi ved at finde et ordentligt fix til og jeg kunne godt tænke mig at køre nogle kommandoer, så vi kan se de ting som ellers er skjult.
Så jeg håber ikke du har noget imod at jeg lige får brugeren til at køre nogle kommandoer. De følger om et øjeblik ..

Hent dette program:

http://www.fbeej.dk/Programmer/fl.zip

Pak programmet ud til dit Skrivebord og dobbeltklik på fl.bat. Programmet åbner en tekstfil, som du skal kopiere herind.

**************************

Og hent dette program:

http://www.fbeej.dk/Programmer/findlop.zip

Pak programmet ud til dit Skrivebord og dobbeltklik på findlop.bat. Programmet åbner en tekstfil, som du skal kopiere herind.

Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\All Users\Application Data

07-05-2005  20:49    <DIR>          Adobe
19-07-2005  14:21    <DIR>          Book inside ping type
19-02-2004  19:56              376 hpzinstall.log
22-10-2004  17:32    <DIR>          InterVideo
25-01-2004  18:10    <DIR>          MSN6
03-06-2004  15:19    <DIR>          MSScanAppDataDir
10-03-2004  20:57    <DIR>          QuickTime
16-10-2004  19:48    <DIR>          remote1mpeguser
21-07-2005  11:44    <DIR>          Skype
20-07-2005  19:19    <DIR>          Spybot - Search & Destroy
              1 fil(er)              376 byte
              9 mappe(r)  26.820.538.368 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\G‘st\Application Data

14-01-2004  21:45    <DIR>          Adobe
14-01-2004  21:45    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
14-01-2004  18:47    <DIR>          Identities
14-01-2004  22:15    <DIR>          Macromedia
              1 fil(er)                0 byte
              4 mappe(r)  26.820.534.272 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\Karen\Application Data

14-01-2004  21:45    <DIR>          Adobe
14-01-2004  21:45    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
14-01-2004  18:47    <DIR>          Identities
13-02-2004  20:47    <DIR>          InterVideo
28-01-2005  23:51            38.473 Kommaseparerede v‘rdier (Windows).ADR
28-01-2005  23:50            9.364 Kommaseparerede v‘rdier (Windows).EML
30-11-2004  21:08    <DIR>          Lavasoft
30-08-2004  17:06    <DIR>          LocksAxisRect
14-01-2004  22:15    <DIR>          Macromedia
05-08-2004  19:04    <DIR>          MSN6
              3 fil(er)          47.837 byte
              8 mappe(r)  26.820.534.272 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\Lea\Application Data

14-01-2004  21:45    <DIR>          Adobe
07-05-2005  20:49    <DIR>          AdobeUM
19-07-2005  14:21    <DIR>          Amenoneanti
30-11-2004  20:52    <DIR>          C2Media
14-01-2004  21:44                0 dm.ini
30-03-2004  18:08    <DIR>          Hewlett-Packard
14-01-2004  18:47    <DIR>          Identities
05-02-2004  20:04    <DIR>          InterVideo
30-11-2004  20:54    <DIR>          Lavasoft
19-07-2005  14:21    <DIR>          LocksAxisRect
31-12-2004  17:46    <DIR>          LocksAxisRect(2)
14-01-2004  22:15    <DIR>          Macromedia
26-08-2004  20:15    <DIR>          Messenger Plus! 3
19-07-2005  14:35    <DIR>          Skype
05-09-2004  19:07    <DIR>          Spybot - Search & Destroy
              1 fil(er)                0 byte
              14 mappe(r)  26.820.534.272 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\UK\Application Data

11-05-2005  21:46    <DIR>          Adobe
11-05-2005  21:59    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
30-03-2004  15:46    <DIR>          Help
19-02-2004  19:16    <DIR>          Hewlett-Packard
14-01-2004  18:47    <DIR>          Identities
05-02-2004  09:51    <DIR>          InterVideo
20-07-2005  18:58    <DIR>          Lavasoft
14-01-2004  22:15    <DIR>          Macromedia
31-01-2004  19:23    <DIR>          MSN6
26-12-2004  15:09    <DIR>          Skype
              1 fil(er)                0 byte
              10 mappe(r)  26.820.534.272 byte ledig

Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\All Users\Application Data

07-05-2005  20:49    <DIR>          Adobe
19-07-2005  14:21    <DIR>          Book inside ping type
19-02-2004  19:56              376 hpzinstall.log
22-10-2004  17:32    <DIR>          InterVideo
25-01-2004  18:10    <DIR>          MSN6
03-06-2004  15:19    <DIR>          MSScanAppDataDir
10-03-2004  20:57    <DIR>          QuickTime
16-10-2004  19:48    <DIR>          remote1mpeguser
21-07-2005  12:44    <DIR>          Skype
20-07-2005  19:19    <DIR>          Spybot - Search & Destroy
              1 fil(er)              376 byte
              9 mappe(r)  26.820.460.544 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\G‘st\Application Data

14-01-2004  21:45    <DIR>          Adobe
14-01-2004  21:45    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
14-01-2004  18:47    <DIR>          Identities
14-01-2004  22:15    <DIR>          Macromedia
              1 fil(er)                0 byte
              4 mappe(r)  26.820.456.448 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\Karen\Application Data

14-01-2004  21:45    <DIR>          Adobe
14-01-2004  21:45    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
14-01-2004  18:47    <DIR>          Identities
13-02-2004  20:47    <DIR>          InterVideo
28-01-2005  23:51            38.473 Kommaseparerede v‘rdier (Windows).ADR
28-01-2005  23:50            9.364 Kommaseparerede v‘rdier (Windows).EML
30-11-2004  21:08    <DIR>          Lavasoft
30-08-2004  17:06    <DIR>          LocksAxisRect
14-01-2004  22:15    <DIR>          Macromedia
05-08-2004  19:04    <DIR>          MSN6
              3 fil(er)          47.837 byte
              8 mappe(r)  26.820.456.448 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\Lea\Application Data

14-01-2004  21:45    <DIR>          Adobe
07-05-2005  20:49    <DIR>          AdobeUM
19-07-2005  14:21    <DIR>          Amenoneanti
30-11-2004  20:52    <DIR>          C2Media
14-01-2004  21:44                0 dm.ini
30-03-2004  18:08    <DIR>          Hewlett-Packard
14-01-2004  18:47    <DIR>          Identities
05-02-2004  20:04    <DIR>          InterVideo
30-11-2004  20:54    <DIR>          Lavasoft
19-07-2005  14:21    <DIR>          LocksAxisRect
31-12-2004  17:46    <DIR>          LocksAxisRect(2)
14-01-2004  22:15    <DIR>          Macromedia
26-08-2004  20:15    <DIR>          Messenger Plus! 3
19-07-2005  14:35    <DIR>          Skype
05-09-2004  19:07    <DIR>          Spybot - Search & Destroy
              1 fil(er)                0 byte
              14 mappe(r)  26.820.456.448 byte ledig
Disken i drev C har ikke noget navn.
Diskens serienummer er 6C65-4D3C

Indhold af C:\Documents and Settings\UK\Application Data

11-05-2005  21:46    <DIR>          Adobe
11-05-2005  21:59    <DIR>          AdobeUM
14-01-2004  21:44                0 dm.ini
30-03-2004  15:46    <DIR>          Help
19-02-2004  19:16    <DIR>          Hewlett-Packard
14-01-2004  18:47    <DIR>          Identities
05-02-2004  09:51    <DIR>          InterVideo
20-07-2005  18:58    <DIR>          Lavasoft
14-01-2004  22:15    <DIR>          Macromedia
31-01-2004  19:23    <DIR>          MSN6
26-12-2004  15:09    <DIR>          Skype
              1 fil(er)                0 byte
              10 mappe(r)  26.820.456.448 byte ledig

TonnyBrandt >> Det genere mig selvfølgelig ikke.. du køre bare løs:)

Jeg skal ud af døren et par timer, men jeg vender tilbage, og håber, at vi få løst dette dumme problem.
v h
Thormod

Du fik kørt den samme batfile fl.bat 2 gange. 2 gang skulle have været findlop.bat. Den giver en helt anden tekstfil

Kalp > takker. Jeg siger til når "undersøgelsen" er færdig *s*

findlop.bat vil ikke udskrive nogen logfile

Nu dukker der også en masse uønskede genveje op på skrivebordet.

Ja, det er noget af det infektionen gør.

Prøv at se om der findes en fil c:\findlop.txt
Findes den så kopier indholdet herind.

Hvis den ikke findes, så prøv dette:

Klik start | kør, skriv cmd og tryk enter.
I det sorte billede skriver du:
SCHTASKS /Query /FO CSV /NH /V > c:\schtasks.log
og trykker enter.

Kopier så indholdet af c:\schtasks.log herind

c:\findlop.txt findes, men er tom

Ok. Hvis du så gider prøve at køre den anden ...

Altså den med SCHTASKS

Logfile of HijackThis v1.99.1
Scan saved at 12:27:27, on 21-07-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\LVComS.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Programmer\SkoleKom\Fcc32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\UK\Skrivebord\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6303F885-05C9-25EB-2320-676D836F6E96} - C:\DOCUME~1\Lea\APPLIC~1\AMENON~1\Cool Tick.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programmer\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ping type enc obj] C:\Documents and Settings\All Users\Application Data\Book inside ping type\FASTBIRD.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2DBEFB64-B6C4-4A2C-BE6A-16FF065B99C6} - http://www.dialerzona.com/cuadruple.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Det var vist igen forkert. Hvor finder jeg SCHTASK

Blot gør præcis som der står herunder, så skulle du ende op med en meget rodet fil, men der burde være de informationer som jeg efterlyser.

Klik start | kør, skriv cmd og tryk enter.
I det sorte billede skriver du:
SCHTASKS /Query /FO CSV /NH /V > c:\schtasks.log
og trykker enter.

Kopier så indholdet af c:\schtasks.log herind

Jeg skal smutte nu så TB du må gerne køre det færdigt:)

Jeg har prøvet flere gange, men svaret bliver, at den ikke bliver genkendt som en intern eller ekstern komando, et program eller en batchfil.

Prøv bare SCHTASKS alene i CMD boxen...

Prøv så denne kommando i cmd boksen:

C:\WINDOWS\system32\SCHTASKS /Query /FO CSV /V > c:\schtasks.log

Der kan være sket det at path variablen er ødelagt og den derfor ikke har c:\windows\system32 stien i søgestien og så kan den ikke finde kommandoen.
Ved at skrive hele stien undgår man det problem.

Blot for at forebygge tastefejl er her et tip.

Marker de næste 2 linier med musen:
C:\WINDOWS\system32\SCHTASKS /Query /FO CSV /V > c:\schtasks.log
pause

Højreklik markeringen og vælg kopier.

Skift til det sorte billede. Højreklik derinde og vælg sæt ind.
Den bør nu skrive at du skal trykke på en tast for at komme videre og på linien ovenover bør der ikke stå nogen fejl.
Tryk på en tast og se om du kan finde c:\schtasks.log og kopiere den herind.

Det lykkedes mig at få oplysningerne fra en anden maskine, så det er ikke nødvendigt at du udfører testen længere.

Jeg undskylder forsinkelsen mht at rense maskinen, men det burde have været 2 kommandoer og så kunne rensningen komme igang. Jeg vidste ikke at vi ville rende ind i disse problemer.

Så her kommer en procedure som vil fjerne infektionen.

Genstart pc'en i fejlsikret tilstand. Klik F8 under opstart. log ind som Lea.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

O2 - BHO: (no name) - {6303F885-05C9-25EB-2320-676D836F6E96} - C:\DOCUME~1\Lea\APPLIC~1\AMENON~1\Cool Tick.exe
O4 - HKLM\..\Run: [ping type enc obj] C:\Documents and Settings\All Users\Application Data\Book inside ping type\FASTBIRD.exe
O16 - DPF: {2DBEFB64-B6C4-4A2C-BE6A-16FF065B99C6} - http://www.dialerzona.com/cuadruple.cab

---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
-------------------
Mapper:
C:\Documents and Settings\All Users\Application Data\Book inside ping type
C:\Documents and Settings\Lea\Application Data\Amenoneanti


Filer:
<ingen>

Genstart normalt og kom med en ny log til kontrol

Så har jeg gjort som du har beskrevet det. Og det har tilsyneladende løst problemet. Jegindsætter alligevel logfilen fra HjackThis.
venlig hilsen Thormod

Logfile of HijackThis v1.99.1
Scan saved at 11:46:53, on 22-07-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Programmer\Panda Software\Panda Antivirus Platinum\apvxdwin.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Skype\Phone\Skype.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\LVComS.exe
C:\Programmer\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\UK\Skrivebord\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.napakkigvn.net/18IGJyZ1WwKadYR8o1ceI3CvXZzEInaQUoHnx2/cPirMM4ebbE4XRFOU7ZS9DoG8.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6303F885-05C9-25EB-2320-676D836F6E96} - C:\DOCUME~1\Lea\APPLIC~1\AMENON~1\Cool Tick.exe (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programmer\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ping type enc obj] C:\Documents and Settings\All Users\Application Data\Book inside ping type\View Dupe.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [aimless] C:\DOCUME~1\UK\APPLIC~1\LOCKSA~1\Soap mpeg.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Der er stadig noget tilbage, og det er sikkert fordi loggen, jeg studerede jo efterhånden var blevet lidt gammel.

Gå i tilføj/fjern programmer og afinstaller Messenger Plus 3, hvis den er der.

Så skal du genstarte pc'en i fejlsikret tilstand. Klik F8 under opstart.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.napakkigvn.net/18IGJyZ1WwKadYR8o1ceI3CvXZzEInaQUoHnx2/cPirMM4ebbE4XRFOU7ZS9DoG8.jsp
O2 - BHO: (no name) - {6303F885-05C9-25EB-2320-676D836F6E96} - C:\DOCUME~1\Lea\APPLIC~1\AMENON~1\Cool Tick.exe (file missing)
O4 - HKLM\..\Run: [ping type enc obj] C:\Documents and Settings\All Users\Application Data\Book inside ping type\View Dupe.exe
O4 - HKCU\..\Run: [aimless] C:\DOCUME~1\UK\APPLIC~1\LOCKSA~1\Soap mpeg.exe

---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
-------------------
Mapper:
C:\Documents and Settings\Lea\Application Data\Amenoneanti
C:\Documents and Settings\All Users\Application Data\Book inside ping type
C:\Documents and Settings\UK\Application Data\LOCKSA~1

Filer:
<ingen>

Genstart normalt og kom med en ny log til kontrol

Her er den nye log:

Logfile of HijackThis v1.99.1
Scan saved at 12:35:12, on 22-07-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\WINDOWS\system32\LVComS.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programmer\Ahead\InCD\InCDsrv.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Documents and Settings\UK\Skrivebord\Hijack\HijackThis.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programmer\Panda Software\Panda Antivirus Platinum\pavProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vwcfjtzbfnifazqnvwxc.uk/18IGJyZ1WwLqRY6VrKsGLeANNC6mMNlg0TnM3uwhjbg.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programmer\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra 'Tools' menuitem: Adgangforalle.dk fjernbetjening - {0AD5A451-967F-46BD-9F5E-39247D7FC77F} - c:\AdgangForAlle\adgangforalle.exe
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Programmer\Ahead\InCD\InCDsrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programmer\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Luk alle programmer foruden hijackthis og fix denne:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vwcfjtzbfnifazqnvwxc.uk/18IGJyZ1WwLqRY6VrKsGLeANNC6mMNlg0TnM3uwhjbg.php

Scan så igen og se om den stadig er der.

Hvis ikke, så genstart, kør hijackthis og check igen. Er den forsvundet er du helt ren nu.

1000 tak for hjælpen. Det var en odentlig omgang. Det er dejligt, at vi har denne hjemmeside.
v h
Thormod

Velbekomme og igen .. undskyld for forsinkelsen *s*