Ramt af virus, spyware ?

Følg denne vejledning, og læg logsene her ind i tråden, så kigger jeg på dem http://www.eksperten.dk/artikler/755

Det skal jeg gøre hurtigst muligt. Hvad så med den andet antivirus program skal jeg fjerne det eller ?

Det behøver du ikke.

ok tak. Men sætter den til at scanne her klokken 9.30 så skal nok give loggen når den er færdig ;)

Okay.

Min erfaring er at virus i noen få tilfeller kan diable og gjemme seg bak sikkerhetspakker (antivirus/firewall programmer). Helt vanlig er det vel ikke men jeg har da opplevd det helt konkret og i praksis (ca 200 virus / sikkerhetsfeil mens sikkerhetspakken meldte fra om null feil) slik at jeg alltid pleier å avinstallere sikkerhetspakken ifb med feilretting ifb med virus.

her kommer den med Dr.web. :

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 108386
Infected objects found: 33
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 15
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 33
Objects renamed: 15
Objects moved: 0
Objects ignored: 0
Scan speed: 513 Kb/s
Scan time: 00:54:30
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 108484
Infected objects found: 36
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 15
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 36
Objects renamed: 15
Objects moved: 0
Objects ignored: 0
Scan speed: 520 Kb/s
Scan time: 00:54:48
=============================================================================

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            13:05:48, 16-01-2006
+ Rapport-Checksum:        80117C1E

+ Scanningsresultat:
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\c -> Adware.WinFixer : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@adtech[2].txt -> Spyware.Cookie.Adtech : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@as-eu.falkag[1].txt -> Spyware.Cookie.Falkag : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@com[2].txt -> Spyware.Cookie.Com : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@lop[1].txt -> Spyware.Cookie.Lop : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@microsoftwga.112.2o7[1].txt -> Spyware.Cookie.2o7 : Renset med backup
    C:\Documents and Settings\Silver_Flame\Cookies\silver_flame@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del1A.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del1B.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del202.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del25.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del32.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del38.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del4D6.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del55.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del560.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del578.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del83.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del87.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\Del8A.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\DelC.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\Documents and Settings\Silver_Flame\Lokale indstillinger\Temp\DelE0.#mp -> Spyware.Hijacker.Generic : Renset med backup
    C:\WINDOWS\tool3.exe -> Trojan.Small : Renset med backup
    C:\WINDOWS\tool4.exe -> Trojan.Small : Renset med backup
    C:\WINDOWS\tool5.exe -> Trojan.Small : Renset med backup


::Rapport slut

Logfile of HijackThis v1.99.1
Scan saved at 13:06:16, on 16-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\drweb\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {37FB36B3-38B1-F9AE-1F67-A678DAC0E1EE} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C38C315-A56F-FDF6-495E-BD9E1E157922} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [site creative stupid each] C:\Documents and Settings\All Users\Application Data\Puresetupsitecreative\CurbKind.exe
O4 - HKLM\..\Run: [Blehtwocdromcomp] C:\Documents and Settings\All Users\Application Data\Face Up Bleh Two\drive type.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131393008683
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energy-factor.com/dialer/it/activex_2279_it.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe

Messenger Plus 3 med tilhørende sponsorprogram, er kilden til dine problemer.

Hent en prøveversion af denne scanner, som er specielt god til at fjerne Lop.com spyware http://www.superadblocker.com/ Installer programmet, og opdater det. Afinstaller Messenger Plus, samt sponsor, og genstart til fejlsikret og kør scanneren. Genstart til normal tilstand, kør HijackThis igen, og lad mig se loggen. Det er vigtigt at loggen er kørt fra normal tilstand.

jeg kan ikk afinstalere det da noget af scanneren muligvis har fjernet en fil.. den beder mig om at gå ind på siden for at hente det igen kan ikk slette det.

Ok, så gå bare videre med scanneren.

ok. tak. gør jeg med det samme 2 sec ;)

Den siger der ikke er noget skadeligt software på min computer. Den fandt ikk noget ?

Jamen så har de andre scanner jo ryddet pænt op, så vi tjekker lige for evt. rester som scannerne måske ikke finder.

For at kunne se alle filer og mapper, gør du dette http://www.spywareinfo.dk/#/tip-og-tricks

Kør en scanning med HijackThis, så du kan se alle filer. Luk alle vinduer, sæt flueben ved disse linier, og klik fix checked.

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {37FB36B3-38B1-F9AE-1F67-A678DAC0E1EE} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O2 - BHO: (no name) - {6C38C315-A56F-FDF6-495E-BD9E1E157922} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [site creative stupid each] C:\Documents and Settings\All Users\Application Data\Puresetupsitecreative\CurbKind.exe
O4 - HKLM\..\Run: [Blehtwocdromcomp] C:\Documents and Settings\All Users\Application Data\Face Up Bleh Two\drive type.exe
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energy-factor.com/dialer/it/activex_2279_it.exe

Tjek at disse mapper er væk. Er nogen af dem tilstede endnu, så slet dem i fejlsikret:

C:\Programmer\MessengerPlus! 3 <== Mappen
C:\Documents and Settings\All Users\Application Data\Puresetupsitecreative <==Mappen
C:\DOCUME~1\SILVER~1 <== Mappen
C:\Documents and Settings\All Users\Application Data\Face Up Bleh Two <== Mappen

Gå også lige i Start kør, og søg på mapper med søgeordene messengerplus og msgplus.

Får at være sikre på at Winfixer også er helt væk, så gør lige dette:

Hent og dobbeltklik på smitRem.exe

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

Programmet pakker sig ud til mappen smitRem.


Genstart i fejlsikret.


Åbn mappen smitRem, og dobbeltklik på RunThis.bat (Følg vejledningen i vinduet.)



Genstart og kom med en frisk Hijackthislog. Find smitfiles.txt via Start/Søg. Kopier også denne log ind.

Tip: Logitech Desktop Messenger er ikke til meget nytte, og bruger bare ressourcer. Hvis du vil, så kan du afinstallere den i Tilføj/Fjern programmer.

Mange tak for de gode råd ;)
Nu er det ikke for at være besværlig, men jeg har ikk rettigheder til at se det link du har sendt til mig http://www.spywareinfo.dk/#/tip-og-tricks

Jeg har da heller ikke rettigheder til den, ser det ud til. Jeg tror at fru Overgaard driller lidt i øjeblikket ;)

Du får det lige på denne måde i stedet for:

For at kunne se alle filer

Win2K og XP:

Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

se det virkede ;)
Jeg forsætter med din gode guide.
Skriver tilbage når jeg er færdig  :)

Logfile of HijackThis v1.99.1
Scan saved at 17:01:09, on 16-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmer\D-Tools\daemon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Programmer\Logitech\SetPoint\KEM.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\NETGEAR\WG121 Configuration Utility\wlancfg8.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
c:\programmer\internet explorer\iexplore.exe
C:\drweb\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.played.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {37FB36B3-38B1-F9AE-1F67-A678DAC0E1EE} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C38C315-A56F-FDF6-495E-BD9E1E157922} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
O4 - Startup: Genvej til daemon.lnk = C:\Programmer\D-Tools\daemon.exe
O4 - Startup: Genvej til steam.lnk = E:\Valve\Steam\steam.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted Zone: *.energy-factor.com
O15 - Trusted Zone: *.hardcorefantasyland.com
O15 - Trusted Zone: *.hardfootballbabes.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131393008683
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energy-factor.com/dialer/it/activex_2279_it.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SABWinLogon - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe

smitRem © log file
    version 2.8

    by noahdfear


Microsoft Windows XP [version 5.1.2600]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 876 'explorer.exe'

Starting registry repairs

Deleting files


  Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN! :)

Smitrem loggen er fin :)

Vi mangler lidt i HijackThis.

Hent DelDomains til skrivebordet her http://www.greyknight17.com/spy/DelO15Domains.inf

Når du har den på skrivebordet, så højreklik på den, og klik installer.

Start op i fejlsikret, og fix disse liner med Hijackthis:

O2 - BHO: (no name) - {37FB36B3-38B1-F9AE-1F67-A678DAC0E1EE} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O2 - BHO: (no name) - {6C38C315-A56F-FDF6-495E-BD9E1E157922} - C:\DOCUME~1\SILVER~1\APPLIC~1\SPAMDE~1\SurfBin.exe (file missing)
O16 - DPF: {FFFF0001-0001-101A-A3C9-08002B2F49FC} - http://download.energy-factor.com/dialer/it/activex_2279_it.exe

Tjek lige om denne mappe er væk:

:\DOCUME~1\SILVER~1 <== Denne mappe

Genstart til normal tilstand, og kør HijackThis igen.

Mappen er nu væk : C:\DOCUME~1\SILVER~1

Logfile of HijackThis v1.99.1
Scan saved at 18:16:14, on 16-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmer\D-Tools\daemon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\Logitech\SetPoint\KEM.exe
C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
C:\Programmer\NETGEAR\WG121 Configuration Utility\wlancfg8.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\ewido anti-malware\ewidoguard.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\spnpinst.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\drweb\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.played.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
O4 - Startup: Genvej til daemon.lnk = C:\Programmer\D-Tools\daemon.exe
O4 - Startup: Genvej til steam.lnk = E:\Valve\Steam\steam.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131393008683
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://scanner.virus112.com/cabs/cssweb.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SABWinLogon - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido anti-malware\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Programmer\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe

Det ser godt ud. Din log ren


Efter et virus/spyware angreb, er det altid en god ide at rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.


Afsluttende rensning af browser cachen:


1. Klik på Funktioner - Internetindstillinger.

2. Under midlertidige filer, klik på slet cookies.

3. Under midlertidige filer, klik på slet filer – sæt flueben i slet alt offline indhold.

4. Under oversigten, klik på ryd oversigten.

5. Klik på ok.

6  Tøm papirkurven.


Husk at "skjule" dine filer igen.


Link til sikring af din computer http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Jeg takker meget for din Hjælp ;)
Nu køre min computer tiptop igen. Mange tak ;)
Du må foresat have en god aften.

Det var godt lykkedes. Du må også have en fortsat god aften.

Nu har du fået dine point ikke ?

Jo, og tak for dem :)

Intet problem.
De var godt fortjent ;)
Hyggehejsa