Hijack this log

Jeg ser på det, øjeblik.

Læs alle punkterne inden du gør noget.

(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe.

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Programmer\WhenUSearch\whse.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\VIVIAN~1.JEN\LOKALE~1\Temp\IXP000.TMP\"

(4)
Åbn en tilfældig mappe, i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende mappe(r):
C:\Programmer\WhenUSearch\
C:\DOCUME~1\VIVIAN~1.JEN\LOKALE~1\Temp\IXP000.TMP\

(5)
Start -> kør -> skriv "cleanmgr" -> Slet Temporary internet files, papirkurv og midlertidige filer. Gentag for alle dine drev.

(6)
Kør scanneren mwav.exe, og sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files. Tryk på Scan Clean.
Scanningen kan godt tage nogen tid.

Kør desuden også ad-aware, og fjern det som den foreslår.

(7)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind.

(8)
Når vi er helt færdige, så husk at aktiver systemgendannelse igen.

Hold da "bip" en omgang.. resulterede nu også i et par trojanere som Norton åbenbart havde overset... Nogen der har hørt om win32.crypt.t ? Kunne ikke finde den i noget virusleksikon...
Nå men ellers... her er den nye hijack this log :

Logfile of HijackThis v1.99.1
Scan saved at 23:08:49, on 10-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\EzButton\CplBCL50.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmer\ltmoh\Ltmoh.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Bluetooth-software\bin\btwdins.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Microsoft AntiSpyware\gcasServ.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\Programmer\Bluetooth-software\BTTray.exe
C:\Programmer\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vivian T. S. Jensen\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.zepto.dk
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.vagabond.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CplBCL50] C:\Programmer\EzButton\CplBCL50.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programmer\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AWMON] "C:\Programmer\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Ad-Aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe" +c
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Programmer\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Programmer\WhenUSearch\whse.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\VIVIAN~1.JEN\LOKALE~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth - C:\Programmer\Bluetooth-software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\Bluetooth-software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\Bluetooth-software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.zepto.dk
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A40787DF-0F11-4870-9AF6-286259C13BDD}: NameServer = 212.242.40.3,212.242.40.51
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programmer\Bluetooth-software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

øh ?? hjæælp :P
Maskinen gakker stadig ud :(

Jeg ser på det

Problemer er ikke væk, som du selv har bemærket. Følg nedenstående, som er næsten magen til ovenstående vejledning. Husk at du skal følge præcist, hvad der står. Når du har genstartet i punkt (2) skal du først genstarte igen i punkt (6).


(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Programmer\WhenUSearch\whse.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\VIVIAN~1.JEN\LOKALE~1\Temp\IXP000.TMP\"

(3)
Åbn en tilfældig mappe, i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende mappe(r):
C:\Programmer\WhenUSearch\
C:\DOCUME~1\VIVIAN~1.JEN\LOKALE~1\Temp\IXP000.TMP\

(4)
Start -> kør -> skriv "cleanmgr" -> Slet Temporary internet files, papirkurv og midlertidige filer. Gentag for alle dine drev.

(5)
Kør scanneren mwav.exe, og sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files. Tryk på Scan Clean.
Scanningen kan godt tage nogen tid.

(6)
Genstart computeren normalt. Lav en ny log med HijackThis, og send den herind.

(7)
Når vi er helt færdige, så husk at aktiver systemgendannelse igen.

Så prøver vi lige igen...

Logfile of HijackThis v1.99.1
Scan saved at 06:08:51, on 13-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\Programmer\Bluetooth-software\bin\btwdins.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\EzButton\CplBCL50.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmer\Google\Google Talk\googletalk.exe
C:\Programmer\Bluetooth-software\BTTray.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dennis Pedersen\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.zepto.dk
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CplBCL50] C:\Programmer\EzButton\CplBCL50.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AWMON] "C:\Programmer\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [Ad-Aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe" +c
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Programmer\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programmer\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [googletalk] "C:\Programmer\Google\Google Talk\googletalk.exe" /autostart
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send til &Bluetooth - C:\Programmer\Bluetooth-software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\Bluetooth-software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmer\Bluetooth-software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.zepto.dk
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A40787DF-0F11-4870-9AF6-286259C13BDD}: NameServer = 212.242.40.3,212.242.40.51
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programmer\Bluetooth-software\bin\btwdins.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Loggen ser fin ud. Kører windows som den skal?

WhenUsearch og wextract_cleanup0 kommer tilbage hver gang jeg genstarter. Er til at blive vanvittig over.

De er ikke at se i loggen, hvilket er underligt. Prøv dette:

Hent Ewido: http://www.spywarefri.dk/downloads1/ewido-setup.exe

Installer og kør Ewido - Opdater straks efter installationen programmet (men lad være med at scanne endnu).

Genstart i fejlsikret tilstand.

Kør en fuld scanning med Ewido. Programmet laver en lille log, som du skal kopiere herind.

---------------------------------------------------------
ewido security suite - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            09:58:11, 14-12-2005
+ Rapport-Checksum:        1F1B533A

+ Scanningsresultat:
    :mozilla.6:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Adtech : Renset med backup
    :mozilla.7:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Adtech : Renset med backup
    :mozilla.9:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Doubleclick : Renset med backup
    :mozilla.29:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Falkag : Renset med backup
    :mozilla.30:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Falkag : Renset med backup
    :mozilla.31:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Falkag : Renset med backup
    :mozilla.32:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Atdmt : Renset med backup
    :mozilla.38:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.39:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.40:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.41:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.42:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.43:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.2o7 : Renset med backup
    :mozilla.58:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Euroclick : Renset med backup
    :mozilla.65:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Falkag : Renset med backup
    :mozilla.77:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Burstnet : Renset med backup
    :mozilla.78:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Renset med backup
    :mozilla.79:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Renset med backup
    :mozilla.80:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Renset med backup
    :mozilla.81:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Renset med backup
    :mozilla.87:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Com : Renset med backup
    :mozilla.88:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Com : Renset med backup
    :mozilla.178:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Overture : Renset med backup
    :mozilla.181:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Questionmarket : Renset med backup
    :mozilla.186:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Revenue : Renset med backup
    :mozilla.201:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Statcounter : Renset med backup
    :mozilla.202:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Statcounter : Renset med backup
    :mozilla.221:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Renset med backup
    :mozilla.222:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Trafficmp : Renset med backup
    :mozilla.223:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Trafficmp : Renset med backup
    :mozilla.224:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Trafficmp : Renset med backup
    :mozilla.225:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Trafficmp : Renset med backup
    :mozilla.226:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Trafficmp : Renset med backup
    :mozilla.227:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Renset med backup
    :mozilla.238:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Weborama : Renset med backup
    :mozilla.247:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Adserver : Renset med backup
    :mozilla.248:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Adserver : Renset med backup
    :mozilla.266:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    :mozilla.267:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    :mozilla.268:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    :mozilla.269:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Clickhype : Renset med backup
    :mozilla.295:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Comclick : Renset med backup
    :mozilla.296:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Comclick : Renset med backup
    :mozilla.297:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Comclick : Renset med backup
    :mozilla.315:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Masterstats : Renset med backup
    :mozilla.340:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Onestat : Renset med backup
    :mozilla.341:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Onestat : Renset med backup
    :mozilla.342:C:\Documents and Settings\Dennis Pedersen\Application Data\Mozilla\Firefox\Profiles\7gi9xpb2.default\cookies.txt -> Spyware.Cookie.Onestat : Renset med backup


::Rapport slut

Ifølge scanningsrapporten har ewido ikke fundet noget. Hvis dit problem ikke er løst, må du desværre vente på en anden "ekspert".

Har haft slukket i nogen tid nu, og gæt engang... Der er nada tilbage i reg-basen :)
Lader til at Ewido har gjort et eller andet alligevel, da den fandt 48 spyware tilfælde :))

Så, lader til at der er "renset ud" :)

Tusinde tak for hjælpen :)

np, det er dejligt når det lykkedes, selv om jeg ikke ved præcis hvordan :-)