start side

Hent og dobbeltklik på smitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
Programmet pakker sig ud til mappen smitRem.

Hent denne scanner:
Ewido kan du downloade her: http://www.ewido.net/en/download/
Klik på Download now. Installer og kør Ewido. Opdater straks efter installationen programmet, (men lad være med at scanne endnu).


Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: HomepageBHO - {1ca480cd-c0e5-4548-874e-b85b17905b3a} - C:\WINDOWS\System32\hp9202.tmp

Kør nu en fuld scanning med Ewido. Når den er færdig trykker du save report og gemmer rapporten.

Åbn mappen smitRem, og dobbeltklik på RunThis.bat (Følg vejledningen i vinduet.)

Klik på Start->Kontrolpanel->Skærm->Skrivebord->Tilpas Skrivebordet->Web fjern flueben i Security Info og View my Active desktop as a web page (Det er ikke sikkert det eksisterer).

Genstart og kom med en frisk Hijackthislog, samt loggen fra Ewido. Find smitfiles.txt via Start/Søg. Kopier også denne log ind.

værsgo her er log filer:

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            00:42:25, 22-12-2005
+ Rapport-Checksum:        70D3A9A5

+ Scanningsresultat:
    HKLM\SOFTWARE\Classes\Interface\{F864100B-0250-43FB-AE95-F50C5537B178} -> Spyware.CoolWebSearch : Ignoreret
    HKLM\SOFTWARE\Classes\Interface\{FACCC49A-4D7B-415B-8250-15C3B854E9FF} -> Spyware.CoolWebSearch : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Dokumenter\AV-Sikkerhed\hijckthis\backups\backup-20050215-142226-517.dll -> Spyware.Hijacker.Generic : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\asmfiles.cab/asm.exe -> Spyware.Altnet : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\asmfiles.cab/asmps.dll -> Spyware.Altnet : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\dia2E.exe -> Heuristic.Win32.Dialer : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\dia6.exe -> Heuristic.Win32.Dialer : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\dia8.exe -> Dialer.Generic : Ignoreret
    C:\Documents and Settings\Documents and Settings  C\Hossein.PRIVAT-YVL1SWYR\Lokale indstillinger\Temp\__unin__.exe -> Spyware.Altnet : Ignoreret
    C:\Documents and Settings\Naghmeh\Cookies\naghmeh@free.wegcash[2].txt -> Spyware.Cookie.Wegcash : Ignoreret
    C:\Documents and Settings\Naghmeh\Cookies\naghmeh@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\IMCUpdate.dll -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\IMCUpdateInstall.exe -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\ImcWselParser.dll -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\WebBand.dll -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\WhistleHelper.dll -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\WselServices.dll -> Spyware.Whistle : Ignoreret
    C:\Program Files\WhistleSoftware\WselServices\WselTypeLibrary.dll -> Spyware.Whistle : Ignoreret
    C:\Programmer\SpyAxe\SpyAxe.exe -> Adware.Spyaxe : Ignoreret
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\gdnDK1932.exe -> Downloader.Small.ayl : Ignoreret
    C:\WINDOWS\Downloaded Program Files\CONFLICT.2\gdnDK1932.exe -> Downloader.Small.ayl : Ignoreret
    C:\WINDOWS\Downloaded Program Files\CONFLICT.3\gdnDK1932.exe -> Downloader.Small.ayl : Ignoreret
    C:\WINDOWS\Downloaded Program Files\gdnDK1932.exe -> Downloader.Small.ayl : Ignoreret
    C:\WINDOWS\system32\1024\ld8D1E.tmp -> Downloader.Zlob.dd : Ignoreret
    C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\0LABKHMF\protector[1].exe -> Spyware.Hijacker.Generic : Ignoreret
    C:\WINDOWS\system32\hgqhp.exe -> Trojan.DNSChanger.u : Ignoreret
    C:\WINDOWS\system32\ioctrl.dll -> Adware.Spyaxe : Ignoreret
    C:\WINDOWS\system32\mssearchnet.exe -> Downloader.Zlob.dd : Ignoreret
    C:\WINDOWS\system32\ntfsnlpa.exe -> Spyware.Msnagent : Ignoreret
    C:\WINDOWS\system32\rdsndin.exe -> Spyware.FindSpy : Ignoreret
    HKLM\SOFTWARE\Classes\Interface\{FACCC49A-4D7B-415B-8250-15C3B854E9FF} -> Spyware.CoolWebSearch : Renset med backup


::Rapport slut

Logfile of HijackThis v1.98.2
Scan saved at 21:06:28, on 21-12-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Documents and Settings  C\Dokumenter\AV-Sikkerhed\hijckthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [QuickTime Task] :":C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToniArts EasyCleaner] :"C:\Programmer\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
O4 - HKLM\..\Run: [RegisterDropHandler] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE"
O4 - HKLM\..\Run: [MsmqIntCert] :regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\windows\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [InstantAccess] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
O4 - HKLM\..\Run: [hclean32.exe] :":C:\WINDOWS\system32\hclean32.exe"
O4 - HKLM\..\Run: [SpyAxe] C:\Programmer\SpyAxe\spyaxe.exe /h
O4 - HKCU\..\Run: [updateMgr] :C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] :"C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4642/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1E245B-DD8A-4E06-9353-28699D1FB894}: NameServer = 195.95.218.20,85.255.112.10

smitfiles.txt. findes ikke

Hent og kør den scanner: http://www.spywarefri.dk/spywarefri-onlinescan.htm

genstart og ny hijackthis log

En ny logfil, jeg havede problemer med at "save logfil" og den blev gemt i prg. sas jeg har på min pc:

Logfile of HijackThis v1.98.2
Scan saved at 17:39:40, on 22-12-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\windows\System32\PDesk.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\system32\netdde.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mgabg.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Documents and Settings  C\Dokumenter\AV-Sikkerhed\hijckthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jp.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [QuickTime Task] :":C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToniArts EasyCleaner] :"C:\Programmer\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
O4 - HKLM\..\Run: [RegisterDropHandler] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE"
O4 - HKLM\..\Run: [MsmqIntCert] :regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\windows\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [InstantAccess] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
O4 - HKLM\..\Run: [hclean32.exe] :":C:\WINDOWS\system32\hclean32.exe"
O4 - HKCU\..\Run: [updateMgr] :C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] :"C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4642/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1E245B-DD8A-4E06-9353-28699D1FB894}: NameServer = 195.95.218.20,85.255.112.10

Jeg tror at jeg er jule træt*S*

Du har kørt med en gammel hijackthis, uden jeg har lagt mærke til det..

Hent nyeste version af hijackthis(1.99.1) herfra : http://www.arlet.dk/hjt.htm
og lav et scan for at være sikker på at du er ren..

ny log, ellers må du ha, en god jul!

Logfile of HijackThis v1.99.1
Scan saved at 17:57:44, on 22-12-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\windows\System32\PDesk.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\system32\netdde.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mgabg.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Real\RealPlay.exe
C:\Programmer\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\Hossein\Skrivebord\hjt.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jp.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [QuickTime Task] :":C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToniArts EasyCleaner] :"C:\Programmer\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
O4 - HKLM\..\Run: [RegisterDropHandler] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE"
O4 - HKLM\..\Run: [MsmqIntCert] :regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\windows\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [InstantAccess] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
O4 - HKLM\..\Run: [hclean32.exe] :":C:\WINDOWS\system32\hclean32.exe"
O4 - HKCU\..\Run: [updateMgr] :C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] :"C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4642/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1E245B-DD8A-4E06-9353-28699D1FB894}: NameServer = 195.95.218.20,85.255.112.10
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
O23 - Service: McShield - Unknown owner - C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe

hent Deldomains herfra:
http://www.greyknight17.com/spy/DelO15Domains.inf

Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)

Fix disse i hijackthis:
O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

Kør Deldomains

genstart normalt og ny hijackthis log

ny logfil
Logfile of HijackThis v1.99.1
Scan saved at 18:31:46, on 22-12-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\windows\System32\PDesk.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\explorer.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\netdde.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mgabg.exe
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Hossein\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jp.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [QuickTime Task] :":C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToniArts EasyCleaner] :"C:\Programmer\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
O4 - HKLM\..\Run: [RegisterDropHandler] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE"
O4 - HKLM\..\Run: [MsmqIntCert] :regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\windows\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [InstantAccess] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
O4 - HKLM\..\Run: [hclean32.exe] :":C:\WINDOWS\system32\hclean32.exe"
O4 - HKCU\..\Run: [updateMgr] :C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] :"C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4642/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1E245B-DD8A-4E06-9353-28699D1FB894}: NameServer = 195.95.218.20,85.255.112.10
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
O23 - Service: McShield - Unknown owner - C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe


DelDomains.inf
; Created by: Mike Burgess  Microsoft MVP
; http://mvps.org/winhelp2002/
;
; Warning: Deletes all entries in the Restricted & Trusted Zone list
;
; To execute this file: in Explorer - right-click (this file)
; Select Install from the Menu.

[version]
signature="$CHICAGO$"

[DefaultInstall]
DelReg=DelTemps
AddReg=AddTemps

[DelTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"

; Recreate the keys to avoid a restart

[AddTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"

Og så din sidste infektion..

Under dette fix vil computeren blive genstartet, og du bør derfor printe vejledningen ud, for at have den ved din side under hele fixet. Fixet skal bruge adgang til internettet, så det skal du sikre dig, at der er.

1. Hent FixWareout fra et af disse links:

http://forums.subratam.org/index.php?act=A...e=post&id=43811
http://swandog46.geekstogo.com/Fixwareout.exe

2. Gem filen på dit Skrivebord og dobbeltklik på den. Klik Next -> Install og check, at der er et flueben i "Run fixit" - klik herefter på Finish. Fixet vil nu starte, og du skal blot følge instruktionerne. Du vil blive bedt om at genstarte din computer - gør venligst det. Genstarten vil tage lidt længere tid end normalt...

3. Når dit system genstarter skal du fortsat følge den vejledning, der gives på skærmen. Når fixet er færdigt vil HijackThis starte automatisk - klik på Scan, og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1E245B-DD8A-4E06-9353-28699D1FB894}: NameServer = 195.95.218.20,85.255.112.10

genstart og ny hijackthis log

Hijackthis kom ikke op automatisk, dette sket manualt og 017- blev fixet og her en ny log:

Logfile of HijackThis v1.99.1
Scan saved at 19:44:39, on 22-12-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\windows\System32\PDesk.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Hossein\Skrivebord\hjt.exe
C:\WINDOWS\system32\netdde.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mgabg.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [QuickTime Task] :":C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToniArts EasyCleaner] :"C:\Programmer\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
O4 - HKLM\..\Run: [RegisterDropHandler] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE"
O4 - HKLM\..\Run: [MsmqIntCert] :regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\windows\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [InstantAccess] :"::C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE" /h
O4 - HKCU\..\Run: [updateMgr] :C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] :"C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Matrox PC-VCR Scheduler.lnk = C:\Programmer\MATROX~4\PC-VCRScheduler.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4642/mcfscan.cab
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
O23 - Service: McShield - Unknown owner - C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe

Så er din log ren.

Efter sådan en tur er det altid en god ide og rydde op i dine systemgendannelses filerne.
Deaktiver systemgendannelse ( http://www.arlet.dk/systemgendannelsen.htm ) - genstart din computer - aktiver systemgendannelse.

Generel oprydning: http://www.arlet.dk/oprydning.htm

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan se her : www.arlet.dk/pakke.htm

Meget vigtigt:
Hent og installer Sp2 til Windows og IE her:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/
Gå derefter ind på windows update http://v5.windowsupdate.microsoft.com/v5consumer/default.aspx?ln=da
og hent alt hvad der ligger af opdateringer der.

Du skal have 1000 tak for din indsats. Hvad angår diverse sikkerheds prg. må jeg sige at jeg har alt hvad I anbefaler i den sikkedspakke også IE. Mht. SP2 er jeg lidt bange da jeg har forsøgt et par gange med elendig resultat, hvor jeg var nødt til at lave en geninstallering.

Det er bare helt i orden..

God jul

lig over

Har du brug for mere hjælp, eller har du fået dit spørgsmål besvaret??, for så skal du huske at lukke dit spørgsmål pænt igen ved at marker mit navn i boksen til venstre og tryk accepter..