Windows Firewall deaktiveres automatisk

Bare for en go' ordens skyld - følg guiden herfra ->
http://www.eksperten.dk/artikler/954
... så følger jeg op...

Nu er min net forbindelse HELT død (sidder hos en bekendt lige nu). Har kørt både Superantispyware og Dr.Web, men hver gang jeg så genstarter maskinen er den gal igen!

Har først fået hentet HijackThis nu, da det ikke har været muligt at komme online derhjemme... :O(

De filer der driller hedder noget med NewDotNet...

Jeg skriver lige de 2 scannings resultater i 2 seperate kommentarer herunder!

Harlis

SUPERAntiSpyware Scan Log
Generated 12/04/2006 at 05:14 PM

Application Version : 3.3.1020

Core Rules Database Version : 3141
Trace Rules Database Version: 1157

Scan type      : Complete Scan
Total Scan Time : 00:07:09

Memory items scanned      : 163
Memory threats detected  : 1
Registry items scanned    : 6067
Registry threats detected : 34
File items scanned        : 3636
File threats detected    : 42

Trojan.NewDotNet-Installer
    C:\PROGRAMMER\NEWDOTNET\NEWDOTNET7_22.DLL
    C:\PROGRAMMER\NEWDOTNET\NEWDOTNET7_22.DLL

Adware.Tracking Cookie
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@ehg-mgnlimited.hitbox[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@cgi-bin[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@kanoodle[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@mediaplex[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@1072556060[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@adtech[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@ads.pointroll[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@as-eu.falkag[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@tradedoubler[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@www.burstnet[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@hitbox[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@audit.median[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@ad.yieldmanager[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@advertising[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@adfair[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@media.fastclick[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@edge.ru4[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@yieldmanager[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@atdmt[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@doubleclick[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@indextools[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@statse.webtrendslive[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@statcounter[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@revsci[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@tribalfusion[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@questionmarket[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@adserver.banneradministration[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@fastclick[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@track.adform[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@www.etracker[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@Sport_Football[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@reduxads.valuead[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@ad1.emediate[2].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@e2.emediate[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@ad[1].txt
    C:\Documents and Settings\Mette & Mikael\Cookies\mette & mikael@microsoftgamestudio.112.2o7[1].txt

Trojan.NewDotNet
    HKCR\Tldctl2.URLLink
    HKCR\Tldctl2.URLLink\CLSID
    HKCR\Tldctl2.URLLink\CurVer
    HKCR\Tldctl2.URLLink.1
    HKCR\Tldctl2.URLLink.1\CLSID
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#UninstallString
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayIcon
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayVersion
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#Publisher
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#URLInfoAbout
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#HelpLink
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#URLUpdateInfo
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#VersionMajor
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#VersionMinor
    HKU\.DEFAULT\Software\New.net
    HKU\S-1-5-21-2313061315-1567741345-1044646493-1006\Software\New.net
    HKU\S-1-5-18\Software\New.net
    HKLM\Software\New.net
    HKLM\Software\New.net#InstalledVersion
    HKLM\Software\New.net#InstalledPath
    HKLM\Software\New.net#Tag
    HKLM\Software\New.net#DiscardTag
    HKLM\Software\New.net#FirstTime
    HKLM\Software\New.net#Source
    HKLM\Software\New.net#Prt
    HKLM\Software\New.net#LSPStatus
    HKLM\Software\New.net#NextUpgradeHi
    HKLM\Software\New.net#NextUpgradeLo
    HKLM\Software\New.net#UpgradeCounter
    HKLM\Software\New.net#Search
    HKLM\Software\New.net#Activity
    HKLM\Software\New.net#XpiDone
    C:\Programmer\NewDotNet\readme.html
    C:\Programmer\NewDotNet\uninstall6_38.exe
    C:\Programmer\NewDotNet\uninstall7_22.exe
    C:\Programmer\NewDotNet

Dr.Web:

GMVegasSetup-dm.exe;C:\Download;Adware.TryMedia;Renamed.;
WinBejSetup-dm[1].exe;C:\Downloads;Adware.TryMedia;Renamed.;
A0043371.exe;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP176;Adware.Casino;Renamed.;
A0043379.old;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP176;Adware.Casino;Renamed.;
A0043995.dll;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP187;Adware.NewDotNet;Renamed.;
A0044063.EXE;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP187;Adware.NewDotNet;Renamed.;
A0045704.exe;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP192;Adware.NewDotNet;Renamed.;
A0045705.exe;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP192;Adware.NewDotNet;Renamed.;
A0045707.dll;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP192;Adware.NewDotNet;Renamed.;
A0048718.exe;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP192;Adware.TryMedia;Renamed.;
A0048719.exe;C:\System Volume Information\_restore{FDFF6704-B445-46DC-A83C-5857ED410A5E}\RP192;Adware.TryMedia;Renamed.;
NDNuninstall6_38.exe;C:\WINDOWS;Adware.NewDotNet;Renamed.;
NDNuninstall7_22.exe;C:\WINDOWS;Adware.NewDotNet;Renamed.;

Derudover kan jeg nævne, at jeg har kørt AdAware. (Sjovt nok opstår problemet gerne de gange jeg installerer og begynder at bruge AdAware, men det er nok bare et tilfælde...). Har været udsat for noget lignende før, også med de der irriterende NewDotNet filer, dengang mener jeg at Ewido kom ind over, da det !#!¤% skulle fjernes...

Nu har jeg så HijackThis, men jeg tør ikke bare begynde at rode med det, for hvad nu hvis...

HJÆLP!!!!!!

PUHA - Jo denne NEWDOTNET er lidt kringlet...

Jeg 'skal' have en HiJackThis Log tekst - det er IKKE meningen at du selv skal pille i noget derfra. Afvent instruks fra mig... kender proceduren...

broken internet access because of LSP provider "C:\programmer...\NewDotNet\newdotnet7_22.dll" missing.

Siger Hijack... Det må være den linie fejler er i...

Tror muligvis en af de 2 tidligere programmer fjernede den dll. fil? Kunne ikke følge guiden, da net adgangen røg... Tog den efter hukommelsen!

Har stadig ingen internet adgang, så det bliver sådan lidt hist og pist jeg kan besvare denne tråd... Håber du har tålmodighed med mig ;o)

... der skal mere en 'bare' slette omtalte linier i HiJackThis...

Lad mig se hele Loggen ...

Kommer her...

Havde loggen derhjemme (nul internet), sad nede på arbejdet...

Logfile of HijackThis v1.99.1
Scan saved at 19:50:39, on 05-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
C:\Programmer\CA\eTrust Antivirus\InoRT.exe
C:\Programmer\CA\eTrust Antivirus\InoTask.exe
C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\CmUCReye.exe
C:\Programmer\Medion Info Display\MdionLCM.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Programmer\Home Cinema\PowerDVD\PDVDServ.exe
C:\Programmer\Home Cinema\PowerCinema\PCMService.exe
C:\Programmer\Java\jre1.5.0_09\bin\jusched.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Download\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar4.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmer\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Programmer\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Programmer\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Programmer\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [InstantOn] "C:\Programmer\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmer\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Programmer\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Programmer\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmer\Fælles filer\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programmer\newdotnet\newdotnet7_22.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130600261343
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_07) -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programmer\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programmer\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programmer\CA\eTrust Antivirus\InoTask.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmer\Fælles filer\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmer\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Sakset fra anden tråd:

Det første du skal gøre er at hente et program, der hedder LSPFix, for når du fixer de 010 New.net, så kan din internetforbindelse forsvinde.
http://www.cexx.org/lspfix.htm
direkte link http://www.cexx.org/lspfix.zip

Hvis det skal bruges, så følg denne anvisning:
Pak filen ud, kør programmet, sæt flueben i "I know what I am doing" klik på finish.

Hent også dette, hvis den første mod forventning fejler: http://members.shaw.ca/techcd/WinsockXPFix.exe

Du lader de to programmer ligge på skrivebordet, og hvis du mister din internetforbindelse, når du har fixed, så skal du køre LSPFix for at komme på Internettet igen. Genstart derefter din computer. Brug ikke programmet endnu - kun hvis det går galt.

Ellers 'fix'
O10 - Broken Internet access because of LSP provider 'c:\programmer\newdotnet\newdotnet7_22.dll' missing

linien i HiJackThis...

Så er den vist nok clean...

LSP Fix kurerede den!

Kan du, ganske kort, fortælle mig hvad NewDotNet er?

Det kan du gøre som et svar, så du kan få nogle points...

Ping...

Du er velkommen en anden gang...

Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt prik i "Vis ikke skjulte filer og mapper".

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.

Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Safe Surfing...