Blankt pop up vindue i IE

Kør denne igennem http://www.eksperten.dk/artikler/954

Det kan være en fejl fra den der laver popup'en, er det den samme popup, som er blank, (dumt formuleret, men er der et mønster i hvornår den popper up)?

Her følger logs fra guiden:

SUPERAntiSpyware Scan Log
Generated 12/11/2006 at 11:19 PM

Application Version : 3.3.1020

Core Rules Database Version : 0
Trace Rules Database Version: 0

Scan type      : Complete Scan
Total Scan Time : 00:38:21

Memory items scanned      : 163
Memory threats detected  : 0
Registry items scanned    : 6119
Registry threats detected : 0
File items scanned        : 68105
File threats detected    : 73

Adware.ZToolbar
    C:\WINDOWS\system32\azebar.xml
    C:\DOCUMENTS AND SETTINGS\THURE\DESKTOP\BACKUPS\BACKUP-20061211-154956-544.INF

Adware.Lop-Gen
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\EACH START MP3 DUMB\INTERNET BAT.EXE
    C:\DOCUMENTS AND SETTINGS\THURE\APPLICATION DATA\MEAL MORE SECOND\DENT BLUE WMA.EXE
    C:\DOCUMENTS AND SETTINGS\THURE\APPLICATION DATA\MEAL MORE SECOND\KMKARUXI.EXE
    C:\DOCUMENTS AND SETTINGS\THURE\LOCAL SETTINGS\TEMP\BIS73.EXE
    C:\PROGRAM FILES\NETPUMPER\ZM\MINIME.EXE
    C:\WINDOWS\Prefetch\INTERNET BAT.EXE-025B3BCB.pf

Adware.Lop
    C:\DOCUMENTS AND SETTINGS\THURE\APPLICATION DATA\MEAL MORE SECOND\LIVE HTM.EXE

Adware.Tracking Cookie
    C:\Documents and Settings\Thure\Cookies\thure@ad.600.tbn[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ad.tbn[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@ad.text.tbn[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ad.zanox[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ad1.emediate[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ad1.hardware[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@adfair[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@adlegend[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@admarketplace[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@adopt.hbmediapro[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@ads.incgamers[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ads.realtechnetwork[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@ads.segamer[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@ads.wowscreenies[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@ads2.jubii[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@adtech[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@adultfriendfinder[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@adverts.loadedinc[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@azjmp[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@cassava[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@clicktorrent[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@forums.sw-stats[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@http.edge.vru4[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@interclick[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@m1.webstats4u[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@partygaming.122.2o7[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@partypoker[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@revenue[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@server.cpmstar[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@serving.rpowermedia[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@sexdebut[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@sexfriends[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@stat.postdanmark[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@stats.drivecleaner[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@stats[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@toplist[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@toplist[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@track.adform[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@tracker.myspacemaps[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@w4exxx[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@warez4ever[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.checkmystats.com[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.serials[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.sextask[2].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.sexuploader[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.sex[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@www.xxxporn-babes[1].txt
    C:\Documents and Settings\Thure\Cookies\thure@xiti[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@ad.yieldmanager[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@ad.zanox[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@adbrite[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@adopt.euroclick[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@adopt.hbmediapro[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@ads.loadedinc[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@adverts.loadedinc[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@partypoker[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@server.cpmstar[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@tacoda[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@track.adform[2].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@warez4ever[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@www.sexuploader[1].txt
    C:\Documents and Settings\Thure\Local Settings\Temp\Cookies\thure@xiti[1].txt

Adware.Unknown Origin
    C:\WINDOWS\SHOPPING.ICO

Adware.TrustInCash
    C:\WINDOWS\SPYWAREREMOVAL.ICO

Process.#xe;C:\Documents and Settings\Thure\Desktop\Misc\Fjern Lort.dk\smit\smitRem;Tool.Prockill;Renamed.;
ssms.#xe;C:\WINDOWS\system32;Program.SrvAny;Renamed.;

Logfile of HijackThis v1.99.1
Scan saved at 23:28:25, on 11-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Thure\Desktop\hijackthis.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [REF JOY] C:\DOCUME~1\Thure\APPLIC~1\MEALMO~1\live htm.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM+ Component Service (COMCSVC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: COM+ System Service (COMSS) - Unknown owner - C:\WINDOWS\system32\SSMS.EXE (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Network DDE Connections (NETDDEC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Og det er så det...

og til jacla:

Det er den samme lille hvide pop up uden noget tekst eller noget... Men der er også begyndt at komme diverse kasino pop ups -.-

Du skal fixe disse linier med HiJackThis:

O4 - HKCU\..\Run: [REF JOY] C:\DOCUME~1\Thure\APPLIC~1\MEALMO~1\live htm.exe

O23 - Service: COM+ Component Service (COMCSVC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: COM+ System Service (COMSS) - Unknown owner - C:\WINDOWS\system32\SSMS.EXE (file missing)
O23 - Service: Network DDE Connections (NETDDEC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)

Bagefter søger du efter exe-filerne (husk at søge i skjulte filer og mapper) og sletter filerne, hvis du finder dem - det SKAL kun være de filer, der ligger på netop den sti, som du ser her.

Du bør gøre ovennævnte i fejlsikker tilstand og bagefter lægge en ny log herind.

Det er hermed gjort;

Ny log :

Logfile of HijackThis v1.99.1
Scan saved at 13:44:36, on 12-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Thure\Desktop\hijackthis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM+ Component Service (COMCSVC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: COM+ System Service (COMSS) - Unknown owner - C:\WINDOWS\system32\SSMS.EXE (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Network DDE Connections (NETDDEC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Det er stadig galt med disse 3:

O23 - Service: COM+ Component Service (COMCSVC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)
O23 - Service: COM+ System Service (COMSS) - Unknown owner - C:\WINDOWS\system32\SSMS.EXE (file missing)
O23 - Service: Network DDE Connections (NETDDEC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe (file missing)

Fik du fixet dem i fejlsikker tilstand og søgt efter exe-filerne? Tjek evt. fra 'kør' med msconfig under tjenester om du kan se servicen og sikre dig at den er stoppet.

Jeg gjorde det i fejlsikret tilstand, søgte efter dem, men kunne ikke finde filerne...

Prøvede at køre hjt igen, lige efter jeg havde scannet og fjernet filerne for anden gang, og straks efter var de der igen.

Klik på Start->Kør skriv Services.msc og klik OK.

Find Tjenesten

* COM+ Component Service (COMCSVC)
* COM+ System Service (COMSS)
* Network DDE Connections (NETDDEC)

stop dem hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

dr1 -> det svarer jo til at bruge msconfig, som jeg skrev ;)

Da det er en LOP-infektion, skal joblisten også checkes, hvis computeren skal forblive ren. Ellers kan man risikere at infektionen vil geninficere computeren i løbet af kort tid.

(Hvad endte denne tråd med?)

http://www.eksperten.dk/spm/779011 ???

???