Hijackthis-log. Skal have slettet de rigtige filer!

-- Hent Dr. Web, og gem det på skrivebordet:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

-- Hent "SuperAntiSpyware free" herfra:
http://www.spywarefri.dk/downloads1.htm
Installer, og opdater scannereren. Men vent med at scanne.

Fuld vejledning til superantispyware finder du her:
http://www.spywarefri.dk/manualer/superantispyware-manual.htm

-- Gå ind i kontrolpanel-tilføj/fjern programmer, og se om du kan få lov til at afinstallere følgende programmer:
SweetIm

-- Tast ctrl-alt-delete, Klik på Jobliste/Taskmanager, Processer/Processes. Find nedenstående processer, højreklik på dem og vælg afslut proces.
temp1.exe
temp2.exe

-- Kør Hijackthis, vælg "Do a system scan only", sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmer\Macrogaming\SweetIMBarForIE\toolbar.dll
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmer\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [SweetIM] C:\Programmer\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SweetIM] C:\Programmer\Macrogaming\SweetIM\SweetIM.exe

-- Genstart i fejlsikret, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1

-- Du skal nu til at slette. Som indledning hertil skal du have slået "Udvidet filvisning" til:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

-- Slet herefter følgende (hvis du kan finde dem):
Mapper:
C:\Programmer\Macrogaming\

Filer:
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\temp1.exe
C:\WINDOWS\system32\temp2.exe

-- Dobbeltklik på drweb-cureit.exe, den vil køre en expressscan, det siger du ja til. Lad den slette hvad den finder (say Yes to all). Undervejs i scanningen vil der dukke en grøn popup som tilbyder dig at købe Dr.Web, hvor du får mulighederne "Buy" eller "50% discount". Her skal du bare lukke popuppen, ved at klikke på krydset øverst til højre.

Når den skriver "Select object for Scanning" nederst til venstre, skal du klikke på Options->Change settings.
Skift til fanebladet Scan, fjern fluebenet ved Heuristic analysis.
Skift til fanebladet - File Types, prik i - All Files
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Move.
Fjern flueben ved "Prompt on action"
Ved "Move path", skriver du i tekstboksen "c:\" Så der kommer til at stå "c:\infected".
Skift til fanbladet Log File. Der fjerner du flueben ved: "Scanned objects" og "Archivers name".
Tryk på Anvend

Klik så på det eller de drev du vil have scannet, der kommer en rød prik for at vise det/de er valgt.
Tryk så på den grønne pil nederst til højre, så scanner den.
Lad den slette/move hvad den finder (Say yes to all)

Når scanningen er færdig, gå op i file – Tryk på- Save Report list.

Så ligger der en en fil der her hedder "drweb.csv" på skrivebordet. Luk Programmet

-- Start SuperAntispyware, klik "Scan your computer", sæt flueben i dine drev, ovre til venstre i vinduet. Ovre til højre i vinduet, sætter du prik i "Perform Complete Scan". Klik "næste", nu scanner den. Når den er færdig, så markerer du det den finder, og lader scannereren fjerne det.

-- Genstart til normal tilstand. Åbn SuperAntispyware-scannereren igen, og klik "preferences"-> "stastics/logs". Marker loggen, og klik "View log". Kopier loggen her ind i tråden. Lav også en frisk log med Hijackthis, som du lægger herind. Kopiér også indholdet af drweb.csv herind.

-- Til sidst så hent denne fil, og gem den på skrivebordet:
http://www.uploads.ejvindh.net/rootchk.exe
Dobbeltklik på rootchk. Efter kort tid dukker en logfil op, som du gerne må lægge herind.

Tusind tak for hjælpen... nåede ikke lige det hele i går, så jeg er ved at gøre det nu. Er lidt i tvivl, hvor der står jeg skal slette følgende filer:

Filer:
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\temp1.exe
C:\WINDOWS\system32\temp2.exe

temp-filerne er der ikke, og under windows jobliste kunne jeg heller ikke finde dem og lukke dem som jeg skulle i starten, men går bare ud fra, at de er væk så?

Den øverste af de der 3 filer er jeg også lidt i tvivl om. I selve mappen windows er der ikke nogen fil ved det navn, men i mappen system32 er der et program ved det navn, og da jeg søgte efter svchost.exe fandt den også en pf-fil i mappen windows\prefetch. Er det programmet svchost jeg skal slette eller er det bare en fil? For hvis det er programmet må det være en fejl i din gameplan - og så vil jeg bare lige være sikker inden jeg sletter noget vigtigt...!

Her er de log'er jeg skulle kopiere herind:

SuperAntiSpyware:

SUPERAntiSpyware Scan Log
Generated 05/13/2007 at 02:59 PM

Application Version : 3.5.1016

Core Rules Database Version : 3237
Trace Rules Database Version: 1248

Scan type      : Complete Scan
Total Scan Time : 00:48:48

Memory items scanned      : 189
Memory threats detected  : 0
Registry items scanned    : 5227
Registry threats detected : 0
File items scanned        : 27076
File threats detected    : 63

Adware.Tracking Cookie
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@www.burstnet[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@cs.sexcounter[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adserver.banneradministration[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@questionmarket[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adtech[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@sexlist[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@paycounter[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter13.sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@67057183[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@doubleclick[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@serving-sys[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@citi.bridgetrack[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adfair[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ads.arto[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@xxxcounter[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@advertstream[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter7.sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter11.sextracker[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@mediaplex[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ads.addynamix[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ads.pointroll[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter5.sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@yourmedia[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ads.cnn[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ehg-ghd.hitbox[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@c.goclick[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@advertising[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@track.adform[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter4.sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@microsoftwlmessengermkt.112.2o7[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@hitbox[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@www.upspiral[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@cgi-bin[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adultreviews[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@mb[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ilead.itrack[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@bs.serving-sys[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@2o7[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@yieldmanager[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adbrite[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adrevolver[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@atdmt[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@realmedia[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@server.iad.liveperson[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@tradedoubler[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter8.sextracker[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@www.freesitexxx[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@casalemedia[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@adv.surinter[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@revenue[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@spylog[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@www.webstat[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@counter3.sextracker[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@cz4.clickzs[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@10151[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@trafficmp[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@1071739650[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@as1.falkag[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@ad.yieldmanager[1].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@statcounter[2].txt
    C:\Documents and Settings\Tummas_i_D\Cookies\tummas_i_d@windowsmedia[2].txt


Drweb.csv:

full[1].anr    C:\Documents and Settings\Tummas_i_D\Lokale indstillinger\Temporary Internet Files\Content.IE5\I95YZYDK    Exploit.ANIFile    Deleted.
anal[1].htm\javascript.3    C:\Documents and Settings\Tummas_i_D\Lokale indstillinger\Temporary Internet Files\Content.IE5\SFP72IJT\anal[1].htm    Trojan.DownLoader.2141   
anal[1].htm    C:\Documents and Settings\Tummas_i_D\Lokale indstillinger\Temporary Internet Files\Content.IE5\SFP72IJT    Archive contains infected objects    Moved.
ass[1].htm\javascript.3    C:\Documents and Settings\Tummas_i_D\Lokale indstillinger\Temporary Internet Files\Content.IE5\SFP72IJT\ass[1].htm    Trojan.DownLoader.2141   
ass[1].htm    C:\Documents and Settings\Tummas_i_D\Lokale indstillinger\Temporary Internet Files\Content.IE5\SFP72IJT    Archive contains infected objects    Moved.
A0044500.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044501.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044509.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044510.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044519.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044520.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044528.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044529.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044555.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044556.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044566.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.Copier    Incurable.Moved.
A0044567.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP184    Trojan.DownLoader.10355    Deleted.
A0044615.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP188    Trojan.Copier    Incurable.Moved.
A0044616.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP188    Trojan.DownLoader.10355    Deleted.
A0044626.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP188    Trojan.Copier    Incurable.Moved.
A0044627.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP188    Trojan.DownLoader.10355    Deleted.
A0044641.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP189    Trojan.Copier    Incurable.Moved.
A0044642.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP189    Trojan.DownLoader.10355    Deleted.
A0044785.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP191    Trojan.Copier    Incurable.Moved.
A0044786.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP191    Trojan.DownLoader.10355    Deleted.
A0044794.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP191    Trojan.Copier    Incurable.Moved.
A0044795.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP191    Trojan.DownLoader.10355    Deleted.
A0044803.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.Copier    Incurable.Moved.
A0044804.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.DownLoader.10355    Deleted.
A0044819.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.Copier    Incurable.Moved.
A0044820.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.DownLoader.10355    Deleted.
A0044832.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.Copier    Incurable.Moved.
A0044833.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.DownLoader.10355    Deleted.
A0044842.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.Copier    Incurable.Moved.
A0044843.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP192    Trojan.DownLoader.10355    Deleted.
A0044853.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP193    Trojan.Copier    Incurable.Moved.
A0044854.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP193    Trojan.DownLoader.10355    Deleted.
A0044862.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP194    Trojan.Copier    Incurable.Moved.
A0044863.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP194    Trojan.DownLoader.10355    Deleted.
A0044873.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP195    Trojan.Copier    Incurable.Moved.
A0044874.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP195    Trojan.DownLoader.10355    Deleted.
A0044892.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP196    Trojan.Copier    Incurable.Moved.
A0044893.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP196    Trojan.DownLoader.10355    Deleted.
A0044901.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP197    Trojan.Copier    Incurable.Moved.
A0044902.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP197    Trojan.DownLoader.10355    Deleted.
A0044910.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.Copier    Incurable.Moved.
A0044911.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.DownLoader.10355    Deleted.
A0044919.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.Copier    Incurable.Moved.
A0044920.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.DownLoader.10355    Deleted.
A0044933.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.Copier    Incurable.Moved.
A0044934.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP198    Trojan.DownLoader.10355    Deleted.
A0044946.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.Copier    Incurable.Moved.
A0044947.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.DownLoader.10355    Deleted.
A0044960.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.Copier    Incurable.Moved.
A0044961.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.DownLoader.10355    Deleted.
A0044980.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.Copier    Incurable.Moved.
A0044981.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP199    Trojan.DownLoader.10355    Deleted.
A0045005.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP200    Trojan.Copier    Incurable.Moved.
A0045006.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP200    Trojan.DownLoader.10355    Deleted.
A0045015.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.Copier    Incurable.Moved.
A0045016.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.DownLoader.10355    Deleted.
A0045025.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.Copier    Incurable.Moved.
A0045026.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.DownLoader.10355    Deleted.
A0045096.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.Copier    Incurable.Moved.
A0045097.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.DownLoader.10355    Deleted.
A0045106.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.Copier    Incurable.Moved.
A0045107.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.DownLoader.10355    Deleted.
A0045114.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.Copier    Incurable.Moved.
A0045115.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP201    Trojan.DownLoader.10355    Deleted.
A0045125.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP202    Trojan.Copier    Incurable.Moved.
A0045126.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP202    Trojan.DownLoader.10355    Deleted.
A0045142.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP204    Trojan.Copier    Incurable.Moved.
A0045143.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP204    Trojan.DownLoader.10355    Deleted.
A0045198.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP205    Trojan.Copier    Incurable.Moved.
A0045199.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP205    Trojan.DownLoader.10355    Deleted.
A0045216.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP205    Trojan.MulDrop.4181    Deleted.
A0045217.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP205    Trojan.Copyself    Incurable.Moved.
A0046206.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP206    Trojan.Copier    Incurable.Moved.
A0046207.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP206    Trojan.DownLoader.10355    Deleted.
A0046259.exe    C:\System Volume Information\_restore{26FBF7D6-90BD-4B6B-9B40-27D3A07CC125}\RP207    Trojan.MulDrop.4181    Deleted.
xcopy.exe    C:\WINDOWS    Trojan.Copyself    Incurable.Moved.


Hijackthis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16.11.38, on 13-05-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmer\Intel\Wireless\Bin\WLKeeper.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Symantec AntiVirus\DefWatch.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmer\SMART Board Software\SMARTBoardService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Symantec AntiVirus\Rtvscan.exe
C:\Programmer\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmer\Dell\QuickSet\quickset.exe
C:\Programmer\r\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmer\Apoint\Apntex.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Digital Line Detect\DLG.exe
C:\Programmer\SMART Board Software\SMARTBoardTools.exe
C:\Programmer\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmer\SMART Board Software\Aware.exe
C:\Programmer\SMART Board Software\Marker.exe
C:\Programmer\Fælles filer\SMART Technologies Inc\SMART Product Update\SmartProductUpdate.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Microsoft Office\Office10\EXCEL.EXE
C:\Documents and Settings\Tummas_i_D\Skrivebord\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Programmer\SMART Board Software\NotebookPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [Apoint] C:\Programmer\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Dell QuickSet] C:\Programmer\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Programmer\r\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Programmer\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Gyldendals Røde Ordbøger.lnk = C:\Programmer\TEXTware\Illuminator 2\Illview02.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SMART Board-værktøjer.lnk = C:\Programmer\SMART Board Software\SMARTBoardTools.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programmer\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programmer\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programmer\Symantec AntiVirus\SavRoam.exe
O23 - Service: SMART Board-tjeneste (SMART Board Service) - SMART Technologies Inc. - C:\Programmer\SMART Board Software\SMARTBoardService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programmer\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programmer\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7966 bytes


Her skulle det hele være... mangler kun at fjerne det der svchost.exe - hvis altså du mener jeg skal fjerne programmet...

Nej!!! Du må endelig ikke fjerne den fil, der ligger inde i system32. Det er en meget vigtig systemfil. Hvis den ikke ligger ude i windows-mappen, må vi bare regne med, at den er røget med scanningerne.

Loggen fra Hijackthis er ren, men jeg vil også gerne se den log fra rootchk, som jeg nævnte ;-)

Kører computeren bedre nu?