start med at deaktiver systemgendannelse og kryds følgende af: R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.ewebsearch.net[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.ewebsearch.net[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.ewebsearch.net[...] O4 - HKLM..Run: [QuickTime Task] "C:WINNTSystem32qttask.exe" -atboottime O9 - Extra button: Real.com (HKLM) med mindre du kender noget af det her skal det oss krydses! O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com[...] O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com[...] O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com[...] O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} - http://cdn.climaxbucks.com[...] O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com[...] O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com[...] O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} (InstallCtl Class) - http://download.redswoosh.net[...]
--
Jahh.. Så kan du lære det! MSN: [email protected]

Logfile of HijackThis v1.97.7 Scan saved at 18:47:25, on 12-06-2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:WINNTSystem32smss.exe C:WINNTsystem32winlogon.exe C:WINNTsystem32services.exe C:WINNTsystem32lsass.exe C:WINNTsystem32svchost.exe C:WINNTSystem32svchost.exe C:WINNTsystem32spoolsv.exe C:WINNTSystem32driversCDAC11BA.EXE C:WINNTSystem32inetsrvinetinfo.exe C:WINNTSystem32 vsvc32.exe C:WINNTSystem32 cpsvcs.exe C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe C:WINNTSystem32snmp.exe C:WINNTsystem32oneLabsvsmon.exe C:WINNTExplorer.EXE C:ProgrammerFælles filerRealUpdate_OB ealsched.exe C:WINNTSystem32RUNDLL32.EXE C:Programmerone LabsoneAlarmzlclient.exe C:WINNTSystem32ctfmon.exe C:PROGRA~1GrisoftAVG7avgupsvc.exe C:PROGRA~1GrisoftAVG7avgamsvr.exe C:ProgrammerGrisoftAVG7avgcc.exe C:Download oolHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.americasarmy.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTSystem32msdxm.ocx O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINNTSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [TkBellExe] "C:ProgrammerFælles filerRealUpdate_OB ealsched.exe" -osboot O4 - HKLM..Run: [MMTrayLSI] C:WINNTSystem32MMTrayLSI.exe O4 - HKLM..Run: [MMTray2K] C:WINNTSystem32MMTray2k.exe O4 - HKLM..Run: [MMTray] C:WINNTSystem32MMTray.exe O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINNTSystem32NvMcTray.dll,NvTaskbarInit O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP O4 - HKLM..Run: [Zone Labs Client] "C:Programmerone LabsoneAlarmzlclient.exe" O4 - HKCU..Run: [CTFMON.EXE] C:WINNTSystem32ctfmon.exe O4 - HKCU..Run: [Red Swoosh EDN Client] C:ProgrammerRSNetRSEDNClient.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com[...] O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com[...] O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com[...] O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com[...] O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com[...] O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com[...] O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net[...] O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com[...] O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net[...] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com[...] O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com[...] O16 - DPF: {D27CDB6E-11CF-96B9-4400-000000000000} - http://active.macromedia.com[...] O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com[...] O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com[...] O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com[...] O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} - http://download.redswoosh.net[...] sådan ser min log ud nu... stadig intet jeg kan fjerne?
--

#2 Du skal lige have disse ting fixet også: Kør en ny scanning med HJT og sæt flueben ved disse: O4 - HKLM..Run: [TkBellExe] "C:ProgrammerFælles filerRealUpdate_OB ealsched.exe" -osboot O4 - HKCU..Run: [Red Swoosh EDN Client] C:ProgrammerRSNetRSEDNClient.exe O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} - http://download.redswoosh.net[...] Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand (tryk F8 efter POST skærmen). Find og slet denne: C:\Programmer\RSNet\RSEDNClient.exe Genstart normalt. Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

da jeg prøvede at starte op i fejlsikker tilstand gik min computer ned.. nu vil den ikke starte op... =/
--

Logfile of HijackThis v1.97.7 Scan saved at 18:40:22, on 14-06-2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:WINNTSystem32smss.exe C:WINNTsystem32winlogon.exe C:WINNTsystem32services.exe C:WINNTsystem32lsass.exe C:WINNTsystem32svchost.exe C:WINNTSystem32svchost.exe C:WINNTsystem32spoolsv.exe C:PROGRA~1GrisoftAVG7avgamsvr.exe C:PROGRA~1GrisoftAVG7avgupsvc.exe C:WINNTSystem32driversCDAC11BA.EXE C:WINNTSystem32inetsrvinetinfo.exe C:WINNTSystem32 vsvc32.exe C:WINNTSystem32 cpsvcs.exe C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe C:WINNTSystem32snmp.exe C:WINNTsystem32oneLabsvsmon.exe C:WINNTExplorer.EXE C:WINNTSystem32MMTrayLSI.exe C:WINNTSystem32MMTray2k.exe C:WINNTSystem32MMTray.exe C:WINNTSystem32RUNDLL32.EXE C:PROGRA~1GrisoftAVG7avgcc.exe C:Programmerone LabsoneAlarmzlclient.exe C:WINNTSystem32ctfmon.exe C:PROGRA~1GrisoftAVG7avgw.exe C:Download oolHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.americasarmy.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTSystem32msdxm.ocx O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINNTSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [MMTrayLSI] C:WINNTSystem32MMTrayLSI.exe O4 - HKLM..Run: [MMTray2K] C:WINNTSystem32MMTray2k.exe O4 - HKLM..Run: [MMTray] C:WINNTSystem32MMTray.exe O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINNTSystem32NvMcTray.dll,NvTaskbarInit O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP O4 - HKLM..Run: [Zone Labs Client] "C:Programmerone LabsoneAlarmzlclient.exe" O4 - HKCU..Run: [CTFMON.EXE] C:WINNTSystem32ctfmon.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com[...] O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com[...] O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com[...] O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com[...] O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com[...] O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com[...] O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net[...] O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com[...] O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net[...] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com[...] O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com[...] O16 - DPF: {D27CDB6E-11CF-96B9-4400-000000000000} - http://active.macromedia.com[...] O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com[...] O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com[...] O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com[...] okay nu virker lortet igen!! her er den så min nye hjt log...
--

Loggen er også ren nu, så bare aktiver systemgendannelse igen. Jeg vil anbefale dig at få systemet opdateret med SP1 og kritiske opdateringer via Windows update.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

okay... men hvordan aktivere men den igen?
--

#7 gøre omvendt procedure! samme måde som du vel deaktiverede den!
--
Jahh.. Så kan du lære det! MSN: [email protected]

Hey - Håber ik jeg bryder ind i denne tråd, men synes det er lidt tåbeligt at oprette en ny - Er der én (Armageddon) med tjek på sagerne, som gider analysere min log aswell? Ville være ret lækkert.. Hvis det tromler ind over de andre indlæg, så er i velkommen til at smide en mail med lidt rettelser til hvad der ikke burde være der på [email protected] Love TD :) Logfile of HijackThis v1.97.7 Scan saved at 00:04:53, on 15-06-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSSystem32Ati2evxx.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSExplorer.EXE C:WINDOWSsystem32spoolsv.exe C:WINDOWSSystem32CTHELPER.EXE C:Program FilesMicrosoft HardwareMousepoint32.exe C:Program FilesDU MeterDUMeter.exe C:Program FilesJavaj2re1.4.2_04injusched.exe C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe C:WINDOWSSystem32LVCOMSX.EXE C:Program FilesLogitechVideoLogiTray.exe C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe C:Program FilesLogitechVideoFxSvr2.exe C:WINDOWSSystem32svchost.exe E:mIRCmirc.exe C:Program FilesInternet ExplorerIEXPLORE.EXE E:ProginstHiJackThisHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.housevalhalla.dk[...] R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,Shellnext = http://www.windowsupdate.com[...] O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar1.dll O4 - HKLM..Run: [CTHelper] CTHELPER.EXE O4 - HKLM..Run: [DAEMON Tools-1033] "C:Program FilesD-Toolsdaemon.exe" -lang 1033 O4 - HKLM..Run: [POINTER] point32.exe O4 - HKLM..Run: [DU Meter] C:Program FilesDU MeterDUMeter.exe O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_04injusched.exe O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe O4 - HKLM..Run: [LVCOMSX] C:WINDOWSSystem32LVCOMSX.EXE O4 - HKLM..Run: [LogitechVideoRepair] C:Program FilesLogitechVideoISStart.exe O4 - HKLM..Run: [LogitechVideoTray] C:Program FilesLogitechVideoLogiTray.exe O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE O8 - Extra context menu item: &Google Search - res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~3Office10EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com[...] O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com[...] O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com[...] O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com[...] O17 - HKLMSystemCCSServicesTcpip..{E6C348BE-345F-41B0-A9BA-1C9832578176}: NameServer = 212.242.40.3,212.242.40.51
--

#9 Hejsa, din log er ren - dog kan du med fordel fixe disse da de bare sluger ressourcer (sæt flueben ved dem): O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_04 injusched.exe O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart maskinen. Det var det.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#10 er det her ikk malware? O4 - HKLM..Run: [LVCOMSX] C:WINDOWSSystem32LVCOMSX.EXE
--
Jahh.. Så kan du lære det! MSN: [email protected]

#11 Nej, det er til Logitech.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

Gas mand - I burde oprette noget firma. Med den service herinde kan man da kun være taknemmelig :) Jeg takker i hvert fald.
--

ditto her mand!! syntes i for goede!!! =) hmm men kan nu stadig ikke finde ud af at aktivere dem igen!! hmm...
--

#14 ... Tryk windowstasten + pause/break knappen.. så popper dine system-egenskaber op. Derfra er der et faneblad der hedder "system gendannelse/system restore" ... Der vælger du så dit system-drev (c:) --> trykker på egenskaber/settings knappen ude til højre i vinduet, og slår det til.
--

hmm... men bortset fra at der ikke er noget sted jeg kan vælge drev c og trykke egenskaber og slå det til med går det da meget godt...
--