Your computer is infected. Tidligere besvarelser hjalp ikke

Det lyder umiddelbart som spy-axe, men følg instruktionen:
www.exp.dk/artikler/755 og kom med relevante logs:

http://www.arlet.dk/

Jeg går straks i gang

har lige et problem, når jeg starter i fejlsikret tilstand viser "drweb-cureit.exe" ikonet sig ikke på skrivebordet og det kommer heller ikke frem i "start -> programmer"

Du skal helst ikke gemme nogle at programmerne på skrivebordet.
Lav en mappe til dem alle. Ved HJT har man også backupfunktion, hvis den ikke er gemt på skrivebord.

ellers nøjes med ewido + HJT loggene

Logfile of HijackThis v1.99.1
Scan saved at 02:48:27, on 29-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\htpatch.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe
C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Antivirusprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\programmer\zango\zangohook.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [webhancer survey companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [dmqry.exe] C:\WINDOWS\system32\dmqry.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.danskebank.dk
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - C:\Programmer\Autodesk\Inventor Professional 8\bin\HSPCLPRO10.dll
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PavPrSrv - Unknown owner - (no file)
O23 - Service: PAVSRV - Unknown owner - (no file)
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 342146
Infected objects found: 14
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 108
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 2
Objects cured: 0
Objects deleted: 17
Objects renamed: 107
Objects moved: 0
Objects ignored: 0
Scan speed: 234 Kb/s
Scan time: 03:11:33
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 342238
Infected objects found: 14
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 109
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 2
Objects cured: 0
Objects deleted: 17
Objects renamed: 107
Objects moved: 0
Objects ignored: 0
Scan speed: 236 Kb/s
Scan time: 03:11:44

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            02:06:36, 29-12-2005
+ Rapport-Checksum:        A2186E17

+ Scanningsresultat:
    HKLM\SOFTWARE\Classes\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10} -> Spyware.MySearch : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC} -> Spyware.MyWay : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -> Spyware.MyWay : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{1D6711C8-7154-40BB-8380-3DEA45B69CBF} -> Downloader.WebP2P : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{3646c2bd-3554-49ca-8125-44deefb881de} -> Spyware.Altnet : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{3f4d4f88-0198-4921-b630-957f3eb814e0} -> Spyware.Altnet : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Spyware.NewDotNet : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07} -> Spyware.SaveNow : Fejl under renselse
    HKLM\SOFTWARE\Classes\CLSID\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Fejl under renselse
    HKLM\SOFTWARE\Classes\Interface\{16097036-894C-4C00-A61F-93CA0D49A70E} -> Spyware.TOPicks : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{2ED5AF98-9258-45BA-B79B-06625C92F662} -> Spyware.TOPicks : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD} -> Spyware.TOPicks : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97} -> Spyware.SaveNow : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{D273D427-57C6-4B12-860F-BBB8195F6E2A} -> Spyware.TOPicks : Renset med backup
    HKLM\SOFTWARE\Classes\Interface\{FD42F6D3-7AB1-470C-979B-7996EDC99099} -> Spyware.TOPicks : Renset med backup
    HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Renset med backup
    HKLM\SOFTWARE\Classes\TypeLib\{F720B40F-3A38-4B22-B30D-DCF095D42498} -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer\CLSID -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer\CurVer -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Classes\WebP2PInstaller.Installer.1 -> Spyware.P2PNetworking : Renset med backup
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D6711C8-7154-40BB-8380-3DEA45B69CBF} -> Downloader.WebP2P : Renset med backup
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -> Spyware.MyWay : Renset med backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Spyware.NewDotNet : Renset med backup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\aui -> Spyware.WebSearch : Renset med backup
    [500] C:\Programmer\NewDotNet\newdotnet6_98.dll -> Spyware.NewDotNet : Fejl under renselse
    C:\Documents and Settings\Bjarne Schack\Lokale indstillinger\Temp\asmfiles.cab/asm.exe -> Spyware.Altnet : Fejl under renselse
    C:\Documents and Settings\Bjarne Schack\Lokale indstillinger\Temp\__unin__.#xe -> Spyware.Altnet : Renset med backup
    C:\Documents and Settings\Bjarne Schack\Programmer\Nero\Nero 7.0 Premium\setup.exe -> Trojan.KillAV.ft : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Cookies\bjarne schack@burstnet[2].txt -> Spyware.Cookie.Burstnet : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Dokumenter\eDonkey2000 Downloads\Nero 7.0 Premium with keygen.rar/Nero 7.0 Premium\setup.exe -> Trojan.KillAV.ft : Fejl under renselse
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~130553.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~140500.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~14092.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~16549.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~17017.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~1715.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~2748.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~322229.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~334565.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~346603.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~347894.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~3654.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~388.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~390.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~403572.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~414435.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~414905.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~416267.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~454.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~490669.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~494574.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~516821.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~535.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~536587.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~562905.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~579657.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~591.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~634.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~636.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~696524.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~740608.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~749476.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~750512.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~782220.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~802669.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~824946.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~838.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~875302.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~906270.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~909055.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~967148.#mp -> Spyware.Wintools : Renset med backup
    C:\Documents and Settings\Bjarne Schack.BJARNE-KONTORET\Lokale indstillinger\Temp\~983561.#mp -> Spyware.Wintools : Renset med backup
    C:\Program Files\Common Files\Java\xclean.exe -> Spyware.Broadcap.b : Renset med backup
    C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Renset med backup
    C:\Program Files\XML\xclean.exe -> Spyware.Broadcap.b : Renset med backup
    C:\Program Files\XML\xcpy1_inst.#xe -> Spyware.Broadcap.b : Renset med backup
    C:\Programmer\NewDotNet\newdotnet6_98.#ll -> Spyware.NewDotNet : Renset med backup
    C:\Programmer\NewDotNet\uninstall6_38.#xe -> Spyware.NewDotNet : Renset med backup
    C:\Programmer\NewDotNet\uninstall6_98.#xe -> Adware.NewDotNet : Renset med backup
    C:\RECYCLER\S-1-5-21-1645522239-1677128483-682003330-1004\Dc135.#mp -> Adware.180Solutions : Renset med backup
    C:\WINDOWS\Downloaded Program Files\WebP2PInstaller.#ll -> Downloader.WebP2PInstaller : Renset med backup
    C:\WINDOWS\NDNuninstall6_38.#xe -> Spyware.NewDotNet : Renset med backup
    C:\WINDOWS\NDNuninstall6_90.#xe -> Adware.NewDotNet : Renset med backup
    C:\WINDOWS\NDNuninstall6_98.#xe -> Adware.NewDotNet : Renset med backup
    C:\WINDOWS\system32\dmfyw.exe -> Trojan.Pakes : Renset med backup
    C:\WINDOWS\system32\filesafer23.exe -> Hijacker.Small : Renset med backup
    C:\WINDOWS\system32\howiper.exe -> Trojan.Qhost.df : Renset med backup
    C:\WINDOWS\system32\idemlog.#xe -> Hijacker.Small : Renset med backup
    C:\WINDOWS\system32\P2P Networking -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0x1d152bee766625cf2ea94d355451eaad.sig -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0x452030b12cb8ea50bc691f34da1e8059.sig -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10000-0xca00e2c4cc962457870bf9a6eff216db.sig -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-10001-3278371691.sig -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\file-1001-77.sig -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\Cache\Database\index256.dbb -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\system32\P2P Networking\P2P Networking.eng -> Spyware.P2PNetworking : Renset med backup
    C:\WINDOWS\Temp\~488425.#mp -> Spyware.Wintools : Renset med backup
    C:\WINDOWS\Temp\~488792.#mp -> Spyware.Wintools : Renset med backup
    C:\WINDOWS\webhdll.#ll_tobedeleted -> Spyware.WebHancer : Renset med backup
    D:\Programmer\Fælles filer\GMT\GatorStubSetup.#xe -> Adware.Gator : Renset med backup
    D:\Programmer\Fælles filer\GMT\egieengine.#ll -> Adware.Gator : Renset med backup
    D:\Programmer\Fælles filer\GMT\egnsengine.dll -> Adware.Gator : Renset med backup
    D:\System Volume Information\_restore{4753BCB0-6765-4C95-873A-35CBF1429704}\RP627\A0259090.#xe -> Adware.Gator : Renset med backup
    D:\System Volume Information\_restore{4753BCB0-6765-4C95-873A-35CBF1429704}\RP628\A0260141.#xe -> Adware.Gator : Renset med backup
    D:\System Volume Information\_restore{4753BCB0-6765-4C95-873A-35CBF1429704}\RP628\A0260144.#ll -> Adware.Gator : Renset med backup
    E:\Bjarne Schack\Winrar.3.30.Final.DK.Dansk.Danish.incl.Keygen.crack.vejledning.rar/WinRAR_v3.30_KeyGen.exe -> Spyware.Hijacker.Generic : Fejl under renselse


::Rapport slut

Fjern Webhancer og P2P networking i Tilføj/fjern programmer.
---------------------------------------
Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret (tryk på <F8> under opstarten), slet mapper og filer listet længere nede.

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [webhancer survey companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [dmqry.exe] C:\WINDOWS\system32\dmqry.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
---------------------------------------
Sletning af \mapper\ og filer:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
C:\WINDOWS\System32\P2P Networking\
C:\Program Files\webHancer\
-------------------
Filer:
C:\WINDOWS\system32\dmqry.exe
C:\WINDOWS\system32\idemlog.exe
---------------------------------------
Genstart normalt og kom med en frisk Hijackthislog.

hverken webhancer eller P2P networking findes i tilføj/fjern programmer. Skal jeg køre videre fra punktet #kør hijackthis, scan.....igen?

Disse mapper findes tilsyneladende ikke, jeg har søgt som foreskrevet uden resultat og herefter søgt manuelt i stifinder, også uden succes

C:\WINDOWS\System32\P2P Networking\
C:\Program Files\webHancer\
-------------------

Denne fil eksisterer tilsyneladende ikke, jeg har søgt som foreskrevet og derefter manuelt, begge dele uden resultat

C:\WINDOWS\system32\dmqry.exe

Ved søgning efter C:\WINDOWS\system32\idemlog.exe kommer er søgeresultatet følgende:
C:\windows\prefetch\idemlog.exe-1A2FC915.pf

skal jeg slette denne?

Ja, tøm hele C:\windows\prefetch mappen.

Lad os så se en frisk Hijackthislog.

nu har jeg så slettet hele prefetch mappen. Når windows starter popper der en dialogboks op med følgende meddelelse

Spybot-SD has detected an important registry entry that has been changed
Category : System Startup user entry
Change  : Value deleted
Entry    : Desktop
Old data : C:\WINDOWS\system32\idemlog.exe

Denne meddelelse kom iøvrigt også før jeg slettede prefetch-mappen



Her er hijackthis loggen:

Logfile of HijackThis v1.99.1
Scan saved at 18:51:40, on 29-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe
C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Antivirusprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\programmer\zango\zangohook.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.danskebank.dk
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - C:\Programmer\Autodesk\Inventor Professional 8\bin\HSPCLPRO10.dll
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PavPrSrv - Unknown owner - (no file)
O23 - Service: PAVSRV - Unknown owner - (no file)
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

Det her bliver vist til 100 point i stedet for 60 :-)

Fix disse med Hijackthis:
O2 - BHO: Zango Search Assistant Helper - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\programmer\zango\zangohook.dll (file missing)
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe

Genstart i fejlsikret og slet:
c:\programmer\zango\ << Mappen.
C:\WINDOWS\system32\idemlog.exe << Den burde være væk.

Genstart normalt, deaktiver TeaTimer i Spybot, genstart, prøv at genaktivere, får du så stadig fejlmeldingen?

Vi skal lige se en ny Hijackthislog, når du har gjort det andet.

Nu ser det ud som om det kører men det kan du nok bedre se end jeg når nu du checker logfilen herunder

Logfile of HijackThis v1.99.1
Scan saved at 20:38:00, on 29-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe
C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Antivirusprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.danskebank.dk
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - C:\Programmer\Autodesk\Inventor Professional 8\bin\HSPCLPRO10.dll
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PavPrSrv - Unknown owner - (no file)
O23 - Service: PAVSRV - Unknown owner - (no file)
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

Nu ser det ud til at køre men det kan du nok bedre se end jeg når du får kigget på logfilwn herunder :-)


Logfile of HijackThis v1.99.1
Scan saved at 20:38:00, on 29-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe
C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Antivirusprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmer\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\PROGRA~1\iolo\SYSTEM~1\PopupStopper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.danskebank.dk
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O18 - Protocol: pcl - {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} - C:\Programmer\Autodesk\Inventor Professional 8\bin\HSPCLPRO10.dll
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PavPrSrv - Unknown owner - (no file)
O23 - Service: PAVSRV - Unknown owner - (no file)
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

Jeg kunne iøvrigt ikke finder hverken zangoo-mappen eller filen idemlog.exe

De er åbenbart væk, lad den hvile i fred.*S*

Så er din log ren, vi behøver ikke at se flere.
Du bør lige deaktivere systemgendannelse, genstarte og genaktivere samt sætte filvisning til normal.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.
Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis ikke skjulte filer og mapper".

For at holde den ren kan du kigge på vores pakke til formålet.
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://fromsej.dk/html/avoid.html
Mvh:
Fromsej/Team Spywarefri.

Tusind tak for hjælpen. Mit sidste spørgsmål til dig går såmænd blot på hvordan jeg får givet dig dine point, dem har du sq (beklager mit sprogbrug) mere end fortjent

Velbekomme.*S*
Det er altid en fornøjelse af få aflivet noget af cyperspaceskidtet.

Du markerer mit navn i boksen og klikker på Accepter, så skulle pointtildelingen lykkes.

Jeg har vist givet dig de 60 point men hvis ikke jeg husker helt forkert løb begejstringen helt af med mig og du mangler 40 mere.....hvordan kommer jeg af med dem

Det behøver du ikke gøre mere ud af, 60 point er passende for en HJT log, desuden mangler jeg ikke ligefrem point, og som før nævnt, man kan ikke købe øl for dem alligevel.

Tak for point. :-)

*LOL* Okay, men tak for hjælpen, ville have mailet en øl til dig men kunne ikke finde adressen :-) Ha' et rigtigt godt nytår

Tak i lige måde.*S*