Hjælp hvad skal jeg gøre med denne Hijackthis log

Jeg kigger på den

1. Hent Look2Me-Destroyer herfra:

http://www.atribune.org/ccount/click.php?id=7
Gem værktøjet på dit Skrivebord.

2. Luk alle åbne programvinduer - inklusiv Internet Explorer.

3. Dobbeltklik på Look2Me-Destroyer, sæt et flueben i "Run this program as a task". Du får en meddelelse om, at Look2Me-Destroyer vil lukke og åbne efter 10 sekunder - klik på OK.

4. Hvis din firewall vil blokere Look2Me-Destroyers adgang til nettet, så skal du lade programmet få adgang.
Hvis du får en runtime error 339, så skal du hente MSWINSCK.OCX herfra:
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
Læg den ned i mappen C:\Windows\System32.

5. Når Look2Me-Destroyer genåbner - klik på "Scan for L2M" - dine ikoner forsvinder - klik "Remove L2M". Klik OK når du får meddelelsen "Done scanning". Nu får du meddelelsen "Done removing infected files!. Programmet vil lukke din computer - klik OK.

Kopier Look2Me-Destroyer´s log her ind.

Hvis din firewall vil blokere Look2Me-Destroyers adgang til nettet, så skal du lade programmet få adgang.

Hvis du får en runtime error 339, så skal du hente MSWINSCK.OCX herfra:
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
...og placere den i mappen C:\Windows\System32 Directory.




Bagefter kører du disse to scannere:

Download og gem denne scanner på skrivebordet. Du skal ikke aktivere den endnu.
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Kig denne vejledning grundigt igennem.
http://fromsej.dk/Vejledninger/html/drweb.html

Hent denne scanner http://www.superantispyware.com/downloads/SUPERAntiSpyware1241.exe

Installer, og opdater scanneren manuelt. OBS, ved installationen bliver det foreslået at du registrerer med din email. Det behøver du ikke at gøre.


Start op i fejlsikret tilstand (tast f8 flere gange under opstart). Hvis du ikke kan det, så se her
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=110&PN=1


Kør så drwebcureit. Når du har dobbeltklikket filen laver den en kort memoryscan. Når den er færdig markerer du dine drev, og klikker på den grønne pil. Lad den kurere, eller slette, det den finder. Klik så på Start->Søg, find filen cureit.log kopier det nederste af teksten herind, startende med:
Total session statistics.


Start SuperAntiSpyware, klik "Scan your computer", sæt flueben i dine drev, ovre til venstre i vinduet. Ovre til højre i vinduet, sætter du prik i "Perform Complete Scan". Klik "næste", nu scanner den. Når den er færdig, så markerer du det den finder, og lader scannereren fjerne det.

Genstart til normal tilstand (scanneren tilbyder måske at gøre det).

Åbn scanneren igen, og klik "preferences"-> "stastics/logs". Marker loggen, og klik "View log". Kopier loggen her ind i tråden, sammen med en frisk HijackThis log.

Ok tak her er den


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 30-05-2006 22:15:05

Infected! C:\WINDOWS\system32\jtn4075qe.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015570.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015580.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015748.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015773.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015786.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015815.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015816.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015867.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015868.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015882.dll
Infected! C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015883.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\jtn4075qe.dll
C:\WINDOWS\system32\jtn4075qe.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015570.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015570.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015580.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015580.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015748.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015748.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015773.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015773.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015786.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP110\A0015786.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015815.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015815.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015816.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015816.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015867.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015867.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015868.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015868.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015882.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015882.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015883.dll
C:\System Volume Information\_restore{6246A7CB-8E19-41F6-A6C1-98B837AEFCC4}\RP111\A0015883.dll could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Shell Extensions

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7AC0ACE6-C91B-48C9-BFC7-7E673D11AC46}"
HKCR\Clsid\{7AC0ACE6-C91B-48C9-BFC7-7E673D11AC46}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A1165DC5-BD25-47D7-B82D-73ED470E3682}"
HKCR\Clsid\{A1165DC5-BD25-47D7-B82D-73ED470E3682}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{81559C35-8464-49F7-BB0E-07A383BEF910}"
HKCR\Clsid\{81559C35-8464-49F7-BB0E-07A383BEF910}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administratorer - Succeeded

Kom lige også med en frisk HijackThis log, og loggen fra SuperAntiSpyware.

Så er jeg helt færtig:


Først drwebcureit

Total session statistics

Objects scanned: 116613
Infected objects found: 6
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 19
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 6
Objects renamed: 19
Objects moved: 0
Objects ignored: 2
Scan speed: 1811 Kb/s
Scan time: 00:35:38



Og en fra SUPERAntiSpyware

SUPERAntiSpyware Scan Log
Generated 05/30/2006 at 11:39 PM

Core Rules Database Version : 2956
Trace Rules Database Version: 1062

Memory threats detected  : 0
Registry threats detected : 38
File threats detected    : 30

Adware.Tracking Cookie
    C:\Documents and Settings\Gisse\Cookies\gisse@ad.yieldmanager[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@metacafe.122.2o7[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@adtech[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@stats[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@ads.stileproject[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@track.adform[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@banner.monacogoldcasino[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@serving-sys[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@stat.onestat[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@cgi-bin[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@statcounter[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@adbrite[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@tradedoubler[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@2o7[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@e2.emediate[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@bs.serving-sys[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@www.popupsandbanners[1].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@adserver.banneradministration[2].txt
    C:\Documents and Settings\Gisse\Cookies\gisse@mb[1].txt
    C:\Documents and Settings\Gisse\Lokale indstillinger\Temp\Cookies\gisse@www.popupsandbanners[1].txt

Trojan.NetMon/DNSChange
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc

Trojan.cmdService
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Type
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Start
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#ObjectName
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Description
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#DependOnGroup
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService#DependOnService
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#DeviceDesc

Trojan.Security Toolbar
    C:\Documents and Settings\All Users\Menuen Start\Online Security Guide.url
    C:\Documents and Settings\All Users\Menuen Start\Security Troubleshooting.url
    C:\Documents and Settings\Gisse\Foretrukne\Antivirus Test Online.url

Browser Hijacker.Internet Explorer Settings Hijack
    HKLM\Software\Microsoft\Internet Explorer\Main#Start Page [ prosearching.com ]
    HKLM\Software\Microsoft\Internet Explorer\Main#Search Page [ prosearching.com ]
    HKLM\Software\Microsoft\Internet Explorer\Main#Local Page [ prosearching.com ]
    HKLM\Software\Microsoft\Internet Explorer\Main#Default_Search_URL [ prosearching.com ]

Adware.ClickSpring/Yazzle
    HKLM\Software\Snowball Wars

Trojan.Homepage/Puper
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#wininet.dll [ regperf.exe ]

Adware.ClickSpring
    C:\Programmer\Common Files\SMBOLS~1\wowexec.exe

Trojan.AtmClk
    C:\WINDOWS\system32\atmclk.exe

Trojan.DCOMCfg
    C:\WINDOWS\system32\dcomcfg.exe

Adware.NicTech Networks
    C:\WINDOWS\system32\fpj6031se.#ll
    C:\WINDOWS\system32\jtn4075qe.#ll
    C:\WINDOWS\system32\mdcbase.#ll

Trojan.RegPerf
    C:\WINDOWS\system32\regperf.exe

Og til slut en ny Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 23:53:33, on 30-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Norton Internet Security\ISSVC.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\Programmer\Canon\CAL\CALMAIN.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Programmer\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Gisse\Skrivebord\hjt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [defender] C:\\defender24.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: MemTurbo.lnk = C:\Programmer\Silicon Prairie Software\MemTurbo\memturbo.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opret Foretrukken på mobil enhed - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på mobil enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: winzoa32 - winzoa32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programmer\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

Inden vi rydder op i det sidste, så skal du lige uploade denne fil C:\\defender24.exe til scanning her http://virusscan.jotti.org/

Den ligger der ikke mere, så den kan jeg ikke scanne, den er væk efter at jeg har genstartet.

Okay, så har scannerne nuppet den.

Kør en scanning med HijackThis, så du kan se alle filer. Luk alle vinduer, sæt flueben ved disse linier, og klik fix checked.


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [defender] C:\\defender24.exe
O20 - Winlogon Notify: winzoa32 - winzoa32.dll (file missing)

Genstart, og kom så lige med den forhåbentligt sidste HijackThis log

Ok jeg prøver når jeg kommer hjem.

Hvordan beskytter jeg mig best mod så dannede andgreb.
Du virker jo son en der her styr på det så hvad gør du for et holde det væk og ikke bare fjerne det når skaden er sket.

Så er det gjort:


Logfile of HijackThis v1.99.1
Scan saved at 12:52:51, on 31-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Norton Internet Security\ISSVC.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\Programmer\Canon\CAL\CALMAIN.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Programmer\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Gisse\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmer\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: MemTurbo.lnk = C:\Programmer\Silicon Prairie Software\MemTurbo\memturbo.exe
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opret Foretrukken på mobil enhed - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på mobil enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programmer\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programmer\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

nu går det helt gak gak den er 10 min om at starte op.

Jeg Formatere den, så håber jeg at det bliver bedre.

Så hvis du kender til nogle programmer der kan blokere og scanne i fremtiden så smid dem her.

http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Det er da vist ikke normalt at fixe denne:

F2 - REG:system.ini: UserInit=userinit.exe

Om det betyder noget i denne forbindelse ved jeg ikke, men du kan da med HJT restore de fixede linier tilbage og så undlade at fixe denne ene linie næste gang.

nva-> Det betyder faktisk ikke noget at fixe den der. Det er bare lidt korrektion. HijackThis genkender linien "UserInit=userinit.exe," (med komma, som er default) - hvis linien mangler komma, så vises den i HijackThis log'en. Et fix gør ikke andet end at sætte komma'et, så værdien bliver default.

Tak så lærte jeg det ;-)

Inden du formatterer, så se lige her http://spywareinfo.dk/#/tip-og-tricks/langsom-op-og-nedlukning-xp.htm

Det er ikke unormalt at få lidt problemer efter en rensning, men det kan for det meste genoprettes uden formattering.

De små gratis programmer i pakken som nva linker til er gode, men for at få en bedre beskyttelse, mener jeg at du også må ud i at købe et program, til at supplere med. PRO versionen af SuperAntiSpyware er et bud på sagen. Ellers denne, hvor du får opdateringer for livstid. Den er aldeles fremragende http://www.nsclean.com/boclean.html

Bemærk, ingen demoversion, men du kan få pengene tilbage hvis du ikke er tilfreds, og den garanti virker.

Det kørte ikke rigtig så nu er den formateret, kan der gemme sig noget i Ramene når man formatere eller går det altsammen væk når man genstarter, og kan det gemme sig i Rammene i Grafikkortet.

Efter jeg har formateret køre jeg med:
SpywareGuard
Dr.Web
SuperAntiSpyware
Spybot - Search & Destroy
Ad-Aware SE Personal

Er det andet jeg kan gøre

Når du har formatteret er alt snavset væk. Der er ikke noget i ram eller grafikkort.

Har du geninstalleret Norton ?

Spywareguard -> OK
Dr.Web -> Den vi brugte til at rense med duer ikke til aktiv beskyttelse. Der skal du have et rigtigt antivirus. Hvis det skal være gratis, så vælg AVG eller Avast.
SuperAntiSpyware -> Det er kun PRO versionen, som har aktiv beskyttelse. Hvis du har gratisversionen, og vil have gratis spywarebeskyttelse, så hent Windows Defender. Hvis du henter den, så fjern Spywareguard, ellers vil de konflikte.
Spybot -> Ok, bare husk sætte den til aktiv beskyttelse.
Ad-Aware -> Ok til at scanne med.

Du bør også installere Spywareblaster, og IE-Spyad.

Jeg takker for hjælpen til alle

forevernewbie smider su lige et svar så får du nogle p.

Velbekomme

Tak for point