Hjælp Jeg er blevet hijacket - Part 2

Hijack this i fejlsikret tilstand

Logfile of HijackThis v1.99.1
Scan saved at 16:54:02, on 30-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Cybercity Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\prefs.js)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [!ewido] "C:\Programmer\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Programmer\BHODemon 2\BHODemon.exe
O4 - Global Startup: Acrobat-assistenten.lnk = C:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Programmer\WinTV\Ir.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmer\Fælles filer\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmer\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Programmer\Dantz\Retrospect\retrorun.exe

Ewido anti spy ware log i fejlsikret tilstand

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at:    16:43:08 30-08-2006

+ Scan result:   



HKLM\SOFTWARE\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : Cleaned.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : Cleaned.
:mozilla.14:C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.15:C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Henrik\Cookies\henrik@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Henrik\Cookies\henrik@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.16:C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.17:C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Henrik\Cookies\henrik@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\CX6FG5QF\srvuty[1].exe -> Trojan.Pakes : Cleaned.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : Cleaned.


::Report end

Historikken er på http://www.eksperten.dk/spm/729163

Jeg kan stadigvæk ikke få SmitfraudFix til at virker

Download About buster:
http://www.malwarebytes.org/AboutBuster.zip
Udpak den til C:\
Åbn Programmet og klik på AboutBuster.exe
Klik Begin Removal, der vil poppe en besked op
"About Buster will not shut down all Internet Explorer windows..."
klik OK

følg derefter denne artikel:

http://www.eksperten.dk/artikler/954

Kom med loggene fra: Dr Web, SuperAntispyware og Hijackthis ;)

Nyt link til About Buster da det andet ikke virker:
http://files3.majorgeeks.com/files/e5b2ab6f40f18e0a3ddd836595ce4e2b/spyware/aboutbuster.zip

For at få smitfraud-fix til at virke, så prøv dette:

Hent denne fil, og pak den ud til rodbiblioteket (c:\), så der oprettes en mappe, der hedder c:\fixpath2
http://internet.cybermesa.com/~bstewart/files/fixpath2.zip

Åben herefter en kommandoprompt, ved at klikke på START-KØR, skriv CMD, og klik på OK. Inde i kommandoprompten skal du så skrive følgende:
cd c:\ [efterfulgt af et tryk på enter-tasten]
cd FIXPATH2 [efterfulgt af et tryk på enter-tasten]

Så skulle du få følgende prompt:
C:\>fixpath2

Her skal du så skrive
FIXPATH.EXE [efterfulgt af et tryk på enter-tasten]

Så vil der komme nogle forskellige indledende informationer, og du vil blive spurgt om det skal fortsætte med at checke for fejl. Det skal du bekræfte. Når værktøjet er færdig, skal du genstarte computeren, og se om det har hjulpet på problemet.

About Buster - Famdt Ingenting

DR Web scannede til langt ud på natten - smider log fil senere, kører SAS i eftermiddag - og smider dernæst logfil

bare iorden

Status Update - Jubii hijacker er besejret af Dr.Web

Først kørte jeg Dr.web - det tog meeeeget lang tid - men løste hijacker problemet.
Men med livrem og seler - kørte jeg også SuperAntiSpyware - den fandt også en masse snavs - til sidst downloadede jeg fixpath - der skete ikke rigtig noget.

Er jeg nu Home and Safe nu - eller skal jeg foretage mig yderligere ??

Logfiler kan ses nedenunder

Dr Webs - csv fil

issearch.exe    C:\WINDOWS\system32    Trojan.Popuper    Will be cured after reboot.
ixt1.dll    C:\WINDOWS\system32    Trojan.Popuper    Will be cured after reboot.
g1947500.dll    C:\WINDOWS    Trojan.DownLoader.12191    Will be cured after reboot.
winosz32.dll    C:\WINDOWS\system32    Trojan.Mezzia    Will be cured after reboot.
Setup.exe    C:\Documents and Settings\All Users\Dokumenter    Win32.HLLW.Pinom.5    Deleted.
mst72.tmp    C:\Documents and Settings\Henrik\Lokale indstillinger\Temp    Trojan.Mezzia    Deleted.
mst84.tmp    C:\Documents and Settings\Henrik\Lokale indstillinger\Temp    Trojan.Mezzia    Deleted.
tvmupdater.exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temp    Adware.TVMedia    Renamed.
srvftz[1].exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\C5I741QB    Trojan.SPuper    Deleted.
srvwpk[1].exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\C5I741QB    Trojan.SPuper    Deleted.
srvapo[1].exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\CX6FG5QF    Trojan.SPuper    Deleted.
bgates[1].exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\OTABO9AF    Dialer.Silent    Deleted.
srvivb[1].exe    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\WDMNGD2N    Trojan.SPuper    Deleted.
Process.exe    C:\Documents and Settings\Henrik\Skrivebord\SmitfraudFix\SmitfraudFix    Tool.Prockill    Renamed.
restart.exe    C:\Documents and Settings\Henrik\Skrivebord\SmitfraudFix\SmitfraudFix    Tool.ShutDown.11    Renamed.
Setup.exe    C:\inetpub\wwwroot    Win32.HLLW.Pinom.5    Deleted.
Process.exe    C:\Programmer\Roguescanfix    Tool.Prockill    Renamed.
Process.exe    C:\SmitfraudFix    Tool.Prockill    Renamed.
restart.exe    C:\SmitfraudFix    Tool.ShutDown.11    Renamed.
A0152864.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Bispy    Deleted.
A0153833.exe\data001    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320\A0153833.exe    Trojan.Fakealert   
A0153833.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Archive contains infected objects    Moved.
A0154837.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154838.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0154839.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154872.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154873.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0154880.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0154881.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154893.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154894.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0154895.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155893.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155894.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155900.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Fakealert    Deleted.
A0155906.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155907.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155914.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155915.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155916.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155923.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155924.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155925.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155932.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0155933.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155936.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155937.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155939.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Tool.Prockill    Renamed.
A0155941.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Tool.ShutDown.11    Renamed.
A0155946.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Adware.EasyEr    Renamed.
A0155960.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155962.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Probably DLOADER.Trojan    Renamed.
A0155963.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0155964.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.DownLoader.12191    Deleted.
A0155965.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.65    Deleted.
A0156960.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0156965.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.DownLoader.396    Deleted.
A0156966.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.DownLoader.396    Deleted.
A0156967.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Probably DLOADER.Trojan    Renamed.
A0156968.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Probably DLOADER.Trojan    Renamed.
A0156969.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Starter.79    Deleted.
A0156970.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Adware.WinUpd    Renamed.
A0156972.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.DownLoader.12309    Deleted.
A0157960.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0157968.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP320    Trojan.Popuper    Deleted.
A0158968.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Trojan.Popuper    Deleted.
A0158998.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Trojan.Popuper    Deleted.
A0159013.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.Prockill    Renamed.
A0159015.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.ShutDown.11    Renamed.
A0159999.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Trojan.Popuper    Deleted.
A0160027.dll    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Trojan.Popuper    Deleted.
A0160029.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Win32.HLLW.Pinom.5    Deleted.
A0160030.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.Prockill    Renamed.
A0160031.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.ShutDown.11    Renamed.
A0160032.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Win32.HLLW.Pinom.5    Deleted.
A0160038.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.Prockill    Renamed.
A0160039.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.Prockill    Renamed.
A0160040.exe    C:\System Volume Information\_restore{1B56FE77-A7AA-45D9-A11D-1BBB3EADDD97}\RP321    Tool.ShutDown.11    Renamed.
Process.exe    C:\unzipped\SmitfraudFix\SmitfraudFix    Tool.Prockill    Renamed.
restart.exe    C:\unzipped\SmitfraudFix\SmitfraudFix    Tool.ShutDown.11    Renamed.
Process.exe    C:\unzipped\SmitfraudFix[1]\SmitfraudFix    Tool.Prockill    Renamed.
restart.exe    C:\unzipped\SmitfraudFix[1]\SmitfraudFix    Tool.ShutDown.11    Renamed.
g1947500.dll    C:\WINDOWS    Trojan.DownLoader.12191    Will be cured after reboot.
g7131906.dll    C:\WINDOWS    Probably DLOADER.Trojan    Renamed.
g749953.dll    C:\WINDOWS    Trojan.DownLoader.12191    Deleted.
g868812.dll    C:\WINDOWS    Trojan.DownLoader.12191    Deleted.
ishost.exe    C:\WINDOWS\system32    Trojan.Popuper    Will be cured after reboot.
ismon.exe    C:\WINDOWS\system32    Trojan.Starter.79    Will be cured after reboot.
issearch.exe    C:\WINDOWS\system32    Trojan.Popuper    Will be cured after reboot.
ixt0.dll    C:\WINDOWS\system32    Trojan.Popuper    Deleted.
ixt1.dll    C:\WINDOWS\system32    Trojan.Popuper    Will be cured after reboot.
winosz32.dll    C:\WINDOWS\system32    Trojan.Mezzia    Will be cured after reboot.
idd11.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd12.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd15.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd16.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd17.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd18.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd1C.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd1F.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd2.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd20.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
idd22.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
iddD.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
iddF.tmp.exe    C:\WINDOWS\Temp    Dialer.Riprova    Deleted.
win1.tmp.exe    C:\WINDOWS\Temp    Trojan.SPuper    Deleted.
win10.tmp.exe    C:\WINDOWS\Temp    Trojan.SPuper    Deleted.
winC.tmp.exe    C:\WINDOWS\Temp    Trojan.SPuper    Deleted.

Superantispyware log fil

SUPERAntiSpyware Scan Log
Generated 08/31/2006 at 05:09 PM

Core Rules Database Version : 3067
Trace Rules Database Version: 1109

Memory threats detected  : 1
Registry threats detected : 95
File threats detected    : 39

Adware.Vundo Variant
    C:\WINDOWS\SYSTEM32\VTUTQ.DLL
    C:\WINDOWS\SYSTEM32\VTUTQ.DLL
    HKLM\Software\Classes\CLSID\{45D05FC4-0463-4025-B015-F9F5DE6C7291}
    HKCR\CLSID\{45D05FC4-0463-4025-B015-F9F5DE6C7291}
    HKCR\CLSID\{45D05FC4-0463-4025-B015-F9F5DE6C7291}\InprocServer32
    HKCR\CLSID\{45D05FC4-0463-4025-B015-F9F5DE6C7291}\InprocServer32#ThreadingModel
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45D05FC4-0463-4025-B015-F9F5DE6C7291}
    Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\vtutq

Parasite.CoolWebSearch Variant
    HKLM\Software\Classes\CLSID\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}
    HKCR\CLSID\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}
    HKCR\CLSID\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}
    HKCR\CLSID\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}\InprocServer32
    HKCR\CLSID\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}\InprocServer32#ThreadingModel
    C:\WINDOWS\system32\admparsek.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{0B5F7FDF-0717-45BF-B49D-695F3168C7FE}

Trojan.URLChanger-Gen
    HKLM\Software\Classes\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\InprocServer32
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\InprocServer32#ThreadingModel
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\ProgID
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\Programmable
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\TypeLib
    HKCR\CLSID\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}\VersionIndependentProgID
    C:\WINDOWS\system32\bthservb.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D4C7057-EAD2-44C6-AD18-9092905F28F1}

Unclassified.Unknown Origin
    HKLM\Software\Classes\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}
    HKCR\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}
    HKCR\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}
    HKCR\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}#ThreadingModel
    HKCR\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}\InprocServer32
    HKCR\CLSID\{259BA022-2005-45E9-A965-10EDB9C00618}\InprocServer32#ThreadingModel
    C:\WINDOWS\g7131906.dll
    HKLM\Software\Classes\CLSID\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}
    HKCR\CLSID\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}
    HKCR\CLSID\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}
    HKCR\CLSID\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}\InprocServer32
    HKCR\CLSID\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}\InprocServer32#ThreadingModel
    C:\WINDOWS\g868812.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{259BA022-2005-45E9-A965-10EDB9C00618}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{A4F94C0C-54A7-4DB1-9AF3-B22E63D00322}

Browser Hijacker.BestSafetyGuide
    HKLM\Software\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
    HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
    HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
    HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}\InprocServer32
    HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}\InprocServer32#ThreadingModel
    C:\WINDOWS\system32\ixt1.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4}

Adware.Tracking Cookie
    C:\Documents and Settings\Henrik\Cookies\henrik@adtech[2].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@track.adform[1].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@mediaplex[1].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@tradedoubler[2].txt
    C:\Documents and Settings\Henrik\Cookies\henrik@adsense[2].txt

Trojan.Unknown Origin
    HKLM\SOFTWARE\Microsoft\MSSMGR
    HKLM\SOFTWARE\Microsoft\MSSMGR#Data
    HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd
    HKLM\SOFTWARE\Microsoft\MSSMGR#Rid
    HKLM\SOFTWARE\Microsoft\MSSMGR#LID
    HKLM\SOFTWARE\Microsoft\MSSMGR#SCLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#SSLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#BSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#MSLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#BPTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#PSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#SSTV
    C:\Documents and Settings\Henrik\Lokale indstillinger\Temp\win7F.tmp.exe
    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\CX6FG5QF\l11[1].exe
    C:\Programmer\Fælles filer\{B07396FA-0708-1030-0929-01091801002d}\services.dll
    C:\WINDOWS\system32\ot.ico
    C:\WINDOWS\system32\ts.ico
    C:\WINDOWS\system32\wnstscc.exe

Adware.Toolbar888
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid32
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib
    HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib#Version
    HKU\S-1-5-21-1426590395-670792205-3813086739-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CBCC61FA-0221-4CCC-B409-CEE865CACA3A}
    HKU\S-1-5-21-1426590395-670792205-3813086739-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{cbcc61fa-0221-4ccc-b409-cee865caca3a} [ úaÌË!ÌL´    ÎèeÊÊ: ]

Trojan.Security Toolbar
    C:\Documents and Settings\Henrik\Foretrukne\Antivirus Test Online.url

Trojan.Malware
    HKCR\MezziaCodec.Chl
    HKCR\MezziaCodec.Chl\CLSID

Adware.TrustInCash
    HKCR\TrustIn.activator
    HKCR\TrustIn.activator\CLSID
    HKCR\TrustIn.activator\CurVer
    HKCR\TrustIn.activator.1
    HKCR\TrustIn.activator.1\CLSID
    HKCR\TrustIn.StockBar
    HKCR\TrustIn.StockBar\CLSID
    HKCR\TrustIn.StockBar\CurVer
    HKCR\TrustIn.StockBar.1
    HKCR\TrustIn.StockBar.1\CLSID
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustIn Bar
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustIn Bar#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustIn Bar#UninstallString
    HKCR\TrustInContext.ContextualAds
    HKCR\TrustInContext.ContextualAds\CLSID
    HKCR\TrustInContext.ContextualAds\CurVer
    HKCR\TrustInContext.ContextualAds.1
    HKCR\TrustInContext.ContextualAds.1\CLSID
    HKU\S-1-5-21-1426590395-670792205-3813086739-1005\Software\TrustIn
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Contextual Ads
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Contextual Ads#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Contextual Ads#UninstallString

Adware.ClickSpring/Yazzle
    HKLM\Software\Cowabanga
    C:\Programmer\Cowabanga\License.txt
    C:\Programmer\Cowabanga\uninstaller.exe
    C:\Programmer\Cowabanga

Malware.Trust Cleaner
    C:\Documents and Settings\Henrik\Menuen Start\Programmer\Trust Cleaner\Uninstall.lnk
    C:\Documents and Settings\Henrik\Menuen Start\Programmer\Trust Cleaner

Malware.Notifier
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#ishost.exe [ ishost.exe ]
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#issearch.exe [ issearch.exe ]
    C:\WINDOWS\system32\isnotify.exe

Trojan.URL Changer
    HKCR\ChangerBHO.ChangerBHO
    HKCR\ChangerBHO.ChangerBHO\CLSID
    HKCR\ChangerBHO.ChangerBHO\CurVer
    HKCR\ChangerBHO.ChangerBHO.1
    HKCR\ChangerBHO.ChangerBHO.1\CLSID

Browser Hijacker.Favorites
    C:\Documents and Settings\Henrik\Desktop\Online Shopping.url
    C:\Documents and Settings\Henrik\Desktop\Remove Adware.url
    C:\Documents and Settings\Henrik\Desktop\Sex Personals.url
    C:\Documents and Settings\Henrik\Desktop\Video Slots.url

Trojan.Freeprod
    C:\Documents and Settings\Henrik\Lokale indstillinger\Temp\win76.tmp.exe

Adware.Universa
    C:\Documents and Settings\Henrik\Lokale indstillinger\Temporary Internet Files\Content.IE5\WDMNGD2N\srvfve[1].exe
    C:\WINDOWS\Temp\win2B.tmp.exe
    C:\WINDOWS\Prefetch\WIN2B.TMP.EXE-2DCF9519.pf

Unclassified.Unknown Origin/System
    C:\WINDOWS\Temp\idd2C.tmp.exe
    C:\WINDOWS\Temp\idd33.tmp.exe
    C:\WINDOWS\Temp\idd38.tmp.exe
    C:\WINDOWS\Temp\idd3F.tmp.exe
    C:\WINDOWS\Temp\idd44.tmp.exe
    C:\WINDOWS\Temp\idd49.tmp.exe
    C:\WINDOWS\Temp\idd50.tmp.exe

Til sidst en frisk Hijack log fil

Logfile of HijackThis v1.99.1
Scan saved at 17:32:41, on 31-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ewido anti-spyware 4.0\guard.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Dantz\Retrospect\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Winamp\Winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Cybercity Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Henrik\Application Data\Mozilla\Profiles\default\86ckjere.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {45D05FC4-0463-4025-B015-F9F5DE6C7291} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmer\Fælles filer\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O20 - Winlogon Notify: h618 - C:\WINDOWS\g7131906.dll (file missing)
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: winosz32 - winosz32.dll (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmer\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Programmer\Dantz\Retrospect\retrorun.exe

Er spændt på at høre om jeg skal foretage mig mere ??

Du kan for en sikkerheds skyld køre smitrem, som stort set virker lige som smitfraudfix:
Hent og dobbeltklik på smitRem.exe

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

Programmet pakker sig ud til mappen smitRem.


Genstart i fejlsikret (tast f8 flere gange under opstart). Hvis du ikke kan, så kig her:

http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=110&PN=1


Åbn mappen smitRem, og dobbeltklik på RunThis.bat (Følg vejledningen i vinduet.)


Find smitfiles.txt via Start/Søg, og kopier den her ind.

Jeg formoder Fazli går videre med loggen.

Følg forevernewbie's instrukser ;)

så følger jeg op

Så har jeg kørt smitRem - den gav flg log


  smitRem © log file
    version 3.1

    by noahdfear


Microsoft Windows XP [version 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\Henrik\Skrivebord\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 744 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN! :)

Skal jeg foretage mig yderligere - eller er jeg Home Safe nu ??

oplever du problemer?

herfra ser alt godt ud ;)

Alt kører Perfekt igen - igen problemer

Stort Tak for hjælpen :-)

sku det være en anden gang ;)