Har jeg Virus

tjekker den nu

Umiddelbart er der ikke noget i loggen..

Download og gem disse scanner på skrivebordet:

Mwav: http://www.spywareinfo.dk/download/mwav.exe
(men lad være med at scanne endnu).

-----

Ewido: http://www.ewido.net/en/download/
Klik på Download now. Installer og kør Ewido. Opdater straks efter installationen programmet, (men lad være med at scanne endnu).

----------

Genstart i fejlsikret tilstand. Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange. Kør nu en fuld scanning med Ewido. Når den er færdig trykker du save report.

-----

Kør nu en fuld scanning med Ewido. Når den er færdig trykker du save report og gemmer rapporten.

-----

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files. Klik på scan clean. Når scanneren er færdig med at scanne, så kopier indholdet af vinduet "Virus Log Information" herind (marker det, og tast ctrl-c)

-----

Begge rapporter kopier du herind sammen med en ny hijackthis (taget i normal mode, ikke fejlsikret)efter du har kørt de 2 scannere

ok..prøver

gør det noget ´hvis jeg kører begge scans på een gang, eller skal jeg lad være med det ?

Hver for sig er bedst

ok

fff

kan ikke copy paste så meget txt ind her ? - ved ikke om det er min pc eller eksperten ?
, men den her går fint igennem.

Har du evt en emailadr. som jeg kan sende de to log´s på ?

Så fik jeg kørt de to scans og har kopieret resultatet ind forneden...Min pc har det tydeligvis bedre nu - dog er der dukket at par nye problemer op. F.eks, vil min Symantec autoprotect ikke virke (udrøbstegn i proceslinien) og min netforbindelse er lidt ustabil (kan dog være mit trådløse netværk som ikke er optimalt).

Når jeg genstarter får jeg en lille dialog boks op:

"isactiveguard: RegOpenKeyEx Failed 2 0" - ved ikke hvad der betyder ???

Men her er scan resultaterne fra de to scans du anbefalede mig at kører igennem:

..hmm kan altså ikke paste teksten ind - det er nødvendigt med en email  ? pft

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            14:35:37, 17-12-2005
+ Report-Checksum:        7996BC26

+ Scan result:

    HKLM\SOFTWARE\Classes\ImgConv.clsImgConv -> Spyware.WebRebates : Cleaned with backup
    HKLM\SOFTWARE\Classes\ImgConv.clsImgConv\Clsid -> Spyware.WebRebates : Cleaned with backup
    HKLM\SOFTWARE\Classes\Interface\{2DDD90D6-F153-4EA7-A324-4B2D83D1027E} -> Spyware.HotBar : Cleaned with backup
    HKLM\SOFTWARE\Classes\TypeLib\{15E7D23B-736E-46FA-BFFD-CBEC4126BEFD} -> Spyware.WebRebates : Cleaned with backup
    :mozilla.51:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    :mozilla.55:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.56:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.58:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.77:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.86:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
    :mozilla.87:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup
    :mozilla.121:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.122:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Firefox\Profiles\3mpkrzxr.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.11:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.12:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.13:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.19:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.20:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.21:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.22:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.42:C:\Documents and Settings\Administrator.CONNECT.000\Application Data\Mozilla\Profiles\default\d171slz0.slt\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
    C:\Program Files\Save -> Spyware.SaveNow : Cleaned with backup
    C:\WINDOWS\system32\unregister.exe -> Spyware.VB : Cleaned with backup


::Report End

ang mwav scanningen er det kun det nederste af loggen jeg skal se..

Samt en ny hijackthis

Her er mwav (nederste del):

Sat Dec 17 14:57:37 2005 => ***** Checking for specific ITW Viruses *****
Sat Dec 17 14:57:37 2005 => Checking for Welchia Virus...
Sat Dec 17 14:57:37 2005 => Checking for LovGate Virus...
Sat Dec 17 14:57:37 2005 => Checking for CodeRed Virus...
Sat Dec 17 14:57:37 2005 => Checking for OpaServ Virus...
Sat Dec 17 14:57:37 2005 => Checking for Sobig.e Virus...
Sat Dec 17 14:57:37 2005 => Checking for Winupie Virus...
Sat Dec 17 14:57:37 2005 => Checking for Swen Virus...
Sat Dec 17 14:57:37 2005 => Checking for JS.Fortnight Virus...
Sat Dec 17 14:57:37 2005 => Checking for Novarg Virus...
Sat Dec 17 14:57:37 2005 => Checking for Pagabot Virus...
Sat Dec 17 14:57:37 2005 => Checking for Parite.b Virus...
Sat Dec 17 14:57:37 2005 => Checking for Parite.a Virus...

Sat Dec 17 14:57:37 2005 => ***** Scanning complete. *****

Sat Dec 17 14:57:37 2005 => Total Number of Files Scanned: 24989
Sat Dec 17 14:57:37 2005 => Total Number of Virus(es) Found: 2
Sat Dec 17 14:57:37 2005 => Total Number of Disinfected Files: 0
Sat Dec 17 14:57:37 2005 => Total Number of Files Renamed: 0
Sat Dec 17 14:57:37 2005 => Total Number of Deleted Files: 0
Sat Dec 17 14:57:37 2005 => Total Number of Errors: 3
Sat Dec 17 14:57:37 2005 => Time Elapsed: 00:20:12
Sat Dec 17 14:57:37 2005 => Virus Database Date: 2005/12/14
Sat Dec 17 14:57:37 2005 => Virus Database Count: 165076

Sat Dec 17 14:57:37 2005 => Scan Completed.

..og her er den ny HJT-log:

Logfile of HijackThis v1.99.1
Scan saved at 16:02:07, on 19-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\dllcache\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator.CONNECT.000\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.connect.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by HPC Factor
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IndicatorUtility] C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe
O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\RunOnce: [SNDInst.exe] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDInst.exe /7
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/TerraExplorer/Install/TEInstallPlugIn.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by1fd.bay1.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} (ActiveView Control) - http://66.97.41.143/web1/web/ActiveView.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Kører norton stadig ikke optimalt??

jeg har nu reinstalleret Norton og ser ud til at virke nu...

men kan du se noget ud fra HJT-loggen eller andre mistænkelige ting, vil jeg gerne høre om det. Ellers må jeg se de kommende dage, om den kører som "normalt"...kunne Ewido og Norton konflikte med hinanden ?

Nej, intet i loggen.

Ewido og norton konfligter ikke med hinanden

Tak for hjælpen :)- LUKKER

du skulle gerne have fået point ?

Ja, det har jeg og tak for point*S*