Hjälp! Spyware på startsidan.

1 december, 2004

Jag får upp en startsida som jag inte kan få bort med spybot, och den lägger fullt med skit på min dator. Jag läste om någon som haft samma problem för en månad sedan ungefär (som fick hjälp av Die Hard), och jag har hijackthis, men jag vet inte hur jag ska göra med loggen. Jag tänkte att någon kanske kunde hjälpa mig? Det här äter upp hela min hårddisk, jag kan inte ens köra norton nu. Känner mig smått desperat.

1 december, 2004

kopiera och klistra in loggen här så kanske ngn kan hjälpa dig.

1 december, 2004

Ta hem senaste AdAware och kör en full system scan och ta bort det programmet hittar.

http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10319876.html?tag=lst-0-1

Placera HiJackThis i en egen mapp och scanna och tryck sedan save scan. Kopiera sedan loggen och klistra in den här.

1 december, 2004

Okej, här kommer loggen.

Logfile of HijackThis v1.98.2

Scan saved at 13:07:25, on 2004-12-01

Platform: Windows ME (Win9x 4.90.3000)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\IPQV32.EXE

C:\WINDOWS\SYSTEM\JAVAOA32.EXE

C:\WINDOWS\WINHC32.EXE

C:\WINDOWS\JAVANX.EXE

C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE

C:\WINDOWS\SYSTEM\NTHF32.EXE

C:\WINDOWS\SYSTEM\IEAN32.EXE

C:\WINDOWS\SYSTEM\APIWJ32.EXE

C:\WINDOWS\SYSAU.EXE

C:\WINDOWS\SYSTEM\JAVAEA32.EXE

C:\WINDOWS\IEYD32.EXE

C:\WINDOWS\IPJK.EXE

C:\WINDOWS\SYSTEM\CRJB.EXE

C:\WINDOWS\SYSTEM\ADDFT.EXE

C:\WINDOWS\SYSTEM\ADDWK32.EXE

C:\WINDOWS\D3RJ.EXE

C:\WINDOWS\SYSDD.EXE

C:\WINDOWS\MFCJF32.EXE

C:\WINDOWS\NTVX.EXE

C:\WINDOWS\WINPD32.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\D3HM.EXE

C:\WINDOWS\SYSTEM\NETVZ.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\NTTX.EXE

C:\WINDOWS\SYSSG.EXE

C:\WINDOWS\SYSTEM\APPPX32.EXE

C:\WINDOWS\SYSTEM\NTMS.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\MFCHV32.EXE

C:\WINDOWS\IEOB32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\IPOB.EXE

C:\WINDOWS\NTTX.EXE

C:\WINDOWS\SYSTEM\ADDSU32.EXE

C:\WINDOWS\SYSTEM\SDKOW32.EXE

C:\WINDOWS\SYSTEM\SYSPR32.EXE

C:\WINDOWS\SYSTEM\APICK.EXE

C:\WINDOWS\NTGT32.EXE

C:\WINDOWS\SYSTEM\IEER.EXE

C:\WINDOWS\SYSTEM\ADDGG32.EXE

C:\WINDOWS\MFCOR32.EXE

C:\WINDOWS\D3OZ32.EXE

C:\WINDOWS\SYSTEM\ATLDX.EXE

C:\WINDOWS\SYSTEM\NETTG.EXE

C:\WINDOWS\SYSTEM\MSSN32.EXE

C:\WINDOWS\ADDQU32.EXE

C:\WINDOWS\SYSTEM\ATLKT32.EXE

C:\WINDOWS\SYSTEM\SDKNF32.EXE

C:\WINDOWS\ATLFV.EXE

C:\WINDOWS\IEHK32.EXE

C:\WINDOWS\SYSTEM\ATLZG32.EXE

C:\WINDOWS\SYSTEM\ATLXF32.EXE

C:\WINDOWS\MSAQ.EXE

C:\WINDOWS\SYSTEM\APPLM32.EXE

C:\WINDOWS\D3JX.EXE

C:\WINDOWS\NTBQ32.EXE

C:\WINDOWS\APIKB32.EXE

C:\WINDOWS\SYSTEM\APPYG.EXE

C:\WINDOWS\SYSTEM\SDKEV32.EXE

C:\WINDOWS\SYSTEM\APIDH.EXE

C:\WINDOWS\SYSTEM\CRLQ32.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\WINPD32.EXE

C:\WINDOWS\MFCOR32.EXE

C:\WINDOWS\SYSTEM\SYSGM.EXE

C:\PROGRAM FILES\WINZIP\WINZIP32.EXE

C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\txwqo.dll/sp.html#23648

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://txwqo.dll/index.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://txwqo.dll/index.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\txwqo.dll/sp.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\txwqo.dll/sp.html#23648

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://txwqo.dll/index.html#23648

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;

R3 - Default URLSearchHook is missing

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL (file missing)

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: Class - {258C6BEA-30E1-964B-485D-EA91AE626212} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {515F2532-F78B-0F59-7739-1DEB7D815E36} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {0B92D846-3AEE-B345-0082-5DF762003E37} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {7FD445FB-F6BB-197E-FEBA-C10F23E6515C} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {E4C5AC12-7B8A-04F6-405B-B3E5D10FD308} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {FDF2EE69-D9E0-BD79-7E65-29095A964793} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {649097E1-E713-683D-C12E-FA824B2B4E37} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {729D481A-8741-6BA2-4453-EBB33E843237} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: Class - {B90BB54E-72B6-78D4-04FA-ABFDF525AD27} - C:\WINDOWS\SYSTEM\D3GF.DLL (file missing)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)

O2 - BHO: Class - {652D9908-DFFD-9FD2-B5D2-5058D5768490} - C:\WINDOWS\SYSTEM\IELH.DLL (file missing)

O2 - BHO: Class - {0B7CF0C1-AE5A-B428-6229-E649815FF71C} - C:\WINDOWS\MFCMZ32.DLL (file missing)

O2 - BHO: Class - {827E1FE8-9C39-95A4-CA3E-FEC6A5DF8173} - C:\WINDOWS\SDKUX32.DLL

O2 - BHO: Class - {64830A97-02DE-7E21-600B-1232F97CB535} - C:\WINDOWS\SYSTEM\NTIH.DLL (file missing)

O2 - BHO: Class - {0F1C3739-CC5D-6992-6F47-EE686EE4D193} - C:\WINDOWS\IECL.DLL (file missing)

O2 - BHO: Class - {CF570560-001C-5449-F0D8-6CB6DF76226F} - C:\WINDOWS\SYSTEM\APILN32.DLL (file missing)

O2 - BHO: Class - {D02FAF17-CBFC-366B-3800-802ABB60B4EB} - C:\WINDOWS\NETOB.DLL (file missing)

O2 - BHO: Class - {19A73732-1F85-26F6-C172-27E2A9BAC68E} - C:\WINDOWS\CRNK.DLL (file missing)

O2 - BHO: Class - {FDD4FBB4-1A6E-F986-21EA-95A477FBA69C} - C:\WINDOWS\ADDQC.DLL (file missing)

O2 - BHO: Class - {43F180D7-BEB2-9D82-0058-EBDBF43E7CDD} - C:\WINDOWS\MFCOR.DLL (file missing)

O2 - BHO: Class - {FFCF604D-210A-9317-A8C5-80208D4AD348} - C:\WINDOWS\ATLJL.DLL (file missing)

O2 - BHO: Class - {130153C6-D795-FD32-8174-83EABD9A94BC} - C:\WINDOWS\SYSTEM\MFCMH.DLL (file missing)

O2 - BHO: Class - {C092BF96-AD27-8A9E-E146-A21BCEAC4EC3} - C:\WINDOWS\APPCG.DLL (file missing)

O2 - BHO: Class - {F322AB0B-621C-11A3-B1AE-7A7FC2B40350} - C:\WINDOWS\MFCOC.DLL (file missing)

O2 - BHO: Class - {C91EDBB2-8C5D-DECD-E91F-6006DF80FA5D} - C:\WINDOWS\CRDG.DLL (file missing)

O2 - BHO: Class - {E5D13241-347A-AD1E-CA3A-5AC44FA5C088} - C:\WINDOWS\SYSTEM\D3BU32.DLL

O2 - BHO: Class - {C7F1F514-C22B-1A47-60E2-4A74FEB1C8A4} - C:\WINDOWS\MSWU.DLL (file missing)

O2 - BHO: Class - {C8F7745A-EDC7-09F6-2A66-3DBD317341D5} - C:\WINDOWS\ADDUU.DLL (file missing)

O2 - BHO: Class - {D30D7712-2A65-35DC-A66B-35E5622933A7} - C:\WINDOWS\MSTG32.DLL (file missing)

O2 - BHO: Class - {44C0FE85-92B4-3370-E7FB-9A71B6FCAC45} - C:\WINDOWS\JAVAIR.DLL (file missing)

O2 - BHO: Class - {3DD18F99-F4B2-E2CE-4499-B56B124A4263} - C:\WINDOWS\SYSTEM\APPIB.DLL

O2 - BHO: Class - {47F1A18E-4D68-80F1-6BBB-16B984AC80ED} - C:\WINDOWS\WINWD32.DLL (file missing)

O2 - BHO: Class - {4ABF050C-DD0D-52FF-DD7A-B315E8F9B10E} - C:\WINDOWS\D3SV.DLL (file missing)

O2 - BHO: Class - {78D32403-C993-B552-A98C-01511980B33D} - C:\WINDOWS\APISN32.DLL

O2 - BHO: Class - {9B936827-936D-A301-874F-BB34B7DB33C5} - C:\WINDOWS\CRSH32.DLL (file missing)

O2 - BHO: Class - {13DFB118-71F3-4EFC-94D7-F572DB1F1A51} - C:\WINDOWS\SYSTEM\APILV32.DLL (file missing)

O2 - BHO: Class - {CC5AE66A-1C52-B62A-D032-EC2DB2630092} - C:\WINDOWS\NTBF32.DLL

O2 - BHO: Class - {9437408B-D5FD-DD59-F300-D15AA010E64A} - C:\WINDOWS\ADDUZ.DLL (file missing)

O2 - BHO: Class - {10AA115E-9874-17AF-147C-C424D9FA21F0} - C:\WINDOWS\IPHF32.DLL (file missing)

O2 - BHO: Class - {5E4FAFEB-6671-6BD8-FDD1-95B62936A37D} - C:\WINDOWS\IEZV.DLL (file missing)

O2 - BHO: Class - {C4012D49-A194-A75E-2913-A6B0116BD90C} - C:\WINDOWS\IECT32.DLL

O2 - BHO: Class - {19928794-F8F3-75C5-C430-063E85E2B540} - C:\WINDOWS\SYSTEM\D3GE.DLL (file missing)

O2 - BHO: Class - {1DF76261-D0F9-959A-0320-7721490AEDC9} - C:\WINDOWS\SYSTEM\D3PM32.DLL (file missing)

O2 - BHO: Class - {FE085492-8FA7-A758-02DC-5ACA50A28BEB} - C:\WINDOWS\APIPL32.DLL (file missing)

O2 - BHO: Class - {1F6F53C4-ACAF-D9FE-429E-AA47DE088F82} - C:\WINDOWS\SYSTEM\JAVADU32.DLL (file missing)

O2 - BHO: Class - {C97FC81F-312D-8D25-B32E-F25738736548} - C:\WINDOWS\SYSTEM\NTYH32.DLL (file missing)

O2 - BHO: Class - {80EFFCE8-0785-EFC8-C0FD-33F77A98418B} - C:\WINDOWS\SYSTEM\APPKJ.DLL (file missing)

O2 - BHO: Class - {372C3DC8-16B4-F566-1386-258500A8957F} - C:\WINDOWS\ATLHE.DLL (file missing)

O2 - BHO: Class - {1793507C-8F6D-13BB-3D03-0C15FBBFCB80} - C:\WINDOWS\SYSTEM\ATLBK32.DLL (file missing)

O2 - BHO: Class - {44D535F2-FECD-125A-C19F-C5AAC1173651} - C:\WINDOWS\NTNX32.DLL (file missing)

O2 - BHO: Class - {74A509FE-F00A-89C1-FD2A-372C9375F327} - C:\WINDOWS\SYSTEM\APPNQ.DLL (file missing)

O2 - BHO: Class - {ECF3E959-3C16-6510-2542-94E05BB2E685} - C:\WINDOWS\SDKBQ32.DLL (file missing)

O2 - BHO: Class - {A2D58F5F-FDD4-A3C2-E881-7146EE2CC672} - C:\WINDOWS\IPTE.DLL (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL (file missing)

O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe"

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [system Service] C:\WINDOWS\SYSTEM\MSREXE.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [APPPX32.EXE] C:\WINDOWS\SYSTEM\APPPX32.EXE

O4 - HKLM\..\Run: [iCQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [schedulingAgent] mstask.exe

O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe

O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

O4 - HKLM\..\RunServices: [scriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

O4 - HKLM\..\RunServices: [JAVAOA32.EXE] C:\WINDOWS\SYSTEM\JAVAOA32.EXE

O4 - HKLM\..\RunServices: [WINHC32.EXE] C:\WINDOWS\WINHC32.EXE

O4 - HKLM\..\RunServices: [JAVANX.EXE] C:\WINDOWS\JAVANX.EXE

O4 - HKLM\..\RunServices: [iPQV32.EXE] C:\WINDOWS\SYSTEM\IPQV32.EXE

O4 - HKLM\..\RunServices: [NTHF32.EXE] C:\WINDOWS\SYSTEM\NTHF32.EXE

O4 - HKLM\..\RunServices: [iEAN32.EXE] C:\WINDOWS\SYSTEM\IEAN32.EXE

O4 - HKLM\..\RunServices: [APIWJ32.EXE] C:\WINDOWS\SYSTEM\APIWJ32.EXE

O4 - HKLM\..\RunServices: [JAVAEA32.EXE] C:\WINDOWS\SYSTEM\JAVAEA32.EXE

O4 - HKLM\..\RunServices: [sYSAU.EXE] C:\WINDOWS\SYSAU.EXE

O4 - HKLM\..\RunServices: [iEYD32.EXE] C:\WINDOWS\IEYD32.EXE

O4 - HKLM\..\RunServices: [iPJK.EXE] C:\WINDOWS\IPJK.EXE

O4 - HKLM\..\RunServices: [CRJB.EXE] C:\WINDOWS\SYSTEM\CRJB.EXE

O4 - HKLM\..\RunServices: [ADDFT.EXE] C:\WINDOWS\SYSTEM\ADDFT.EXE

O4 - HKLM\..\RunServices: [ADDWK32.EXE] C:\WINDOWS\SYSTEM\ADDWK32.EXE

O4 - HKLM\..\RunServices: [sYSDD.EXE] C:\WINDOWS\SYSDD.EXE

O4 - HKLM\..\RunServices: [D3RJ.EXE] C:\WINDOWS\D3RJ.EXE

O4 - HKLM\..\RunServices: [MFCJF32.EXE] C:\WINDOWS\MFCJF32.EXE

O4 - HKLM\..\RunServices: [NTVX.EXE] C:\WINDOWS\NTVX.EXE

O4 - HKLM\..\RunServices: [WINPD32.EXE] C:\WINDOWS\WINPD32.EXE

O4 - HKLM\..\RunServices: [NETVZ.EXE] C:\WINDOWS\SYSTEM\NETVZ.EXE

O4 - HKLM\..\RunServices: [D3HM.EXE] C:\WINDOWS\SYSTEM\D3HM.EXE

O4 - HKLM\..\RunServices: [NTTX.EXE] C:\WINDOWS\NTTX.EXE

O4 - HKLM\..\RunServices: [sYSSG.EXE] C:\WINDOWS\SYSSG.EXE

O4 - HKLM\..\RunServices: [NTMS.EXE] C:\WINDOWS\SYSTEM\NTMS.EXE

O4 - HKLM\..\RunServices: [MFCHV32.EXE] C:\WINDOWS\MFCHV32.EXE

O4 - HKLM\..\RunServices: [iEOB32.EXE] C:\WINDOWS\IEOB32.EXE

O4 - HKLM\..\RunServices: [iPOB.EXE] C:\WINDOWS\SYSTEM\IPOB.EXE

O4 - HKLM\..\RunServices: [ADDSU32.EXE] C:\WINDOWS\SYSTEM\ADDSU32.EXE

O4 - HKLM\..\RunServices: [sDKOW32.EXE] C:\WINDOWS\SYSTEM\SDKOW32.EXE

O4 - HKLM\..\RunServices: [sYSPR32.EXE] C:\WINDOWS\SYSTEM\SYSPR32.EXE

O4 - HKLM\..\RunServices: [APICK.EXE] C:\WINDOWS\SYSTEM\APICK.EXE

O4 - HKLM\..\RunServices: [NTGT32.EXE] C:\WINDOWS\NTGT32.EXE

O4 - HKLM\..\RunServices: [iEER.EXE] C:\WINDOWS\SYSTEM\IEER.EXE

O4 - HKLM\..\RunServices: [ADDGG32.EXE] C:\WINDOWS\SYSTEM\ADDGG32.EXE

O4 - HKLM\..\RunServices: [MFCOR32.EXE] C:\WINDOWS\MFCOR32.EXE

O4 - HKLM\..\RunServices: [D3OZ32.EXE] C:\WINDOWS\D3OZ32.EXE

O4 - HKLM\..\RunServices: [ATLDX.EXE] C:\WINDOWS\SYSTEM\ATLDX.EXE

O4 - HKLM\..\RunServices: [NETTG.EXE] C:\WINDOWS\SYSTEM\NETTG.EXE

O4 - HKLM\..\RunServices: [MSSN32.EXE] C:\WINDOWS\SYSTEM\MSSN32.EXE

O4 - HKLM\..\RunServices: [ADDQU32.EXE] C:\WINDOWS\ADDQU32.EXE

O4 - HKLM\..\RunServices: [ATLKT32.EXE] C:\WINDOWS\SYSTEM\ATLKT32.EXE

O4 - HKLM\..\RunServices: [sDKNF32.EXE] C:\WINDOWS\SYSTEM\SDKNF32.EXE

O4 - HKLM\..\RunServices: [ATLFV.EXE] C:\WINDOWS\ATLFV.EXE

O4 - HKLM\..\RunServices: [iEHK32.EXE] C:\WINDOWS\IEHK32.EXE

O4 - HKLM\..\RunServices: [ATLZG32.EXE] C:\WINDOWS\SYSTEM\ATLZG32.EXE

O4 - HKLM\..\RunServices: [ATLXF32.EXE] C:\WINDOWS\SYSTEM\ATLXF32.EXE

O4 - HKLM\..\RunServices: [MSAQ.EXE] C:\WINDOWS\MSAQ.EXE

O4 - HKLM\..\RunServices: [APPLM32.EXE] C:\WINDOWS\SYSTEM\APPLM32.EXE

O4 - HKLM\..\RunServices: [D3JX.EXE] C:\WINDOWS\D3JX.EXE

O4 - HKLM\..\RunServices: [NTBQ32.EXE] C:\WINDOWS\NTBQ32.EXE

O4 - HKLM\..\RunServices: [APIKB32.EXE] C:\WINDOWS\APIKB32.EXE

O4 - HKLM\..\RunServices: [APPYG.EXE] C:\WINDOWS\SYSTEM\APPYG.EXE

O4 - HKLM\..\RunServices: [sDKEV32.EXE] C:\WINDOWS\SYSTEM\SDKEV32.EXE

O4 - HKLM\..\RunServices: [APIDH.EXE] C:\WINDOWS\SYSTEM\APIDH.EXE

O4 - HKLM\..\RunServices: [CRLQ32.EXE] C:\WINDOWS\SYSTEM\CRLQ32.EXE

O4 - HKLM\..\RunServices: [sYSGM.EXE] C:\WINDOWS\SYSTEM\SYSGM.EXE

O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE (file missing)

O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620/qtinstall.info.apple.com/qt502/us/win/QuickTimeInstaller.exe

1 december, 2004

Jisses vad skit du har i datorn, det är ett under att du ens får igång den.

Om jag får ge dig ett råd, gör backup på dina viktigaste dokument och program och formattera sedan om hela hårddisken.

Vil du inte göra det så skall det väl gå att få bort det manuellt...

Börja med att lägga HiJackThis i en egen mapp på C, t.ex. C:\HJT\HiJackThis och posta sedan en ny logg.

[inlägget ändrat 2004-12-01 13:45:31 av Metalmaid]

1 december, 2004

Här var det mycket skräp.

Pröva att först göra en grovrensning.

Ladda ner AboutBuster

http://www.bleepingcomputer.com/files/spyware/AboutBuster.zip

Unzippa på skrivbordet i en ny mapp.

Öppna sen AboutBuster och kolla om det finns uppdateringar till programmet.

Stäg AboutBuster sen.

Starta sen i felsäkert läge och pusta med AboutBuster 2 gånger.

Starta sen normalt och skicka en ny Hijack logg.

1 december, 2004

Jag har gjort en backup för säkerhets skull, men jag vill helst inte formatera om jag slipper.

Såhär ser det ut nu, jag har tagit bort lite extra skräp så gott jag kunde med spybot, men jag kan alltså inte ladda hem några program, för jag kan knappt ha igång explorer. Jag har försökt slänga saker, men det är liksom ingen idé.

Logfile of HijackThis v1.98.2

Scan saved at 20:08:57, on 2004-12-01

Platform: Windows ME (Win9x 4.90.3000)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\WINDOWS\SYSTEM\IEAN32.EXE

C:\WINDOWS\WINHC32.EXE

C:\WINDOWS\SYSTEM\JAVAOA32.EXE

C:\WINDOWS\JAVANX.EXE

C:\WINDOWS\SYSTEM\IPQV32.EXE

C:\WINDOWS\SYSTEM\NTHF32.EXE

C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE

C:\WINDOWS\IPJK.EXE

C:\WINDOWS\SYSTEM\APIWJ32.EXE

C:\WINDOWS\IEYD32.EXE

C:\WINDOWS\SYSTEM\CRJB.EXE

C:\WINDOWS\SYSTEM\ADDFT.EXE

C:\WINDOWS\SYSAU.EXE

C:\WINDOWS\SYSTEM\JAVAEA32.EXE

C:\WINDOWS\SYSDD.EXE

C:\WINDOWS\SYSTEM\ADDWK32.EXE

C:\WINDOWS\D3RJ.EXE

C:\WINDOWS\NTVX.EXE

C:\WINDOWS\MFCJF32.EXE

C:\WINDOWS\SYSTEM\D3HM.EXE

C:\WINDOWS\SYSSG.EXE

C:\WINDOWS\SYSTEM\NETVZ.EXE

C:\WINDOWS\NTTX.EXE

C:\WINDOWS\MFCHV32.EXE

C:\WINDOWS\WINPD32.EXE

C:\WINDOWS\SYSTEM\NTMS.EXE

C:\WINDOWS\IEOB32.EXE

C:\WINDOWS\SYSTEM\IPOB.EXE

C:\WINDOWS\SYSTEM\SYSPR32.EXE

C:\WINDOWS\SYSTEM\SDKOW32.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\APICK.EXE

C:\WINDOWS\SYSTEM\ADDSU32.EXE

C:\WINDOWS\NTGT32.EXE

C:\WINDOWS\SYSTEM\IEER.EXE

C:\WINDOWS\SYSTEM\ADDGG32.EXE

C:\WINDOWS\MFCOR32.EXE

C:\WINDOWS\D3OZ32.EXE

C:\WINDOWS\SYSTEM\NETTG.EXE

C:\WINDOWS\SYSTEM\ATLDX.EXE

C:\WINDOWS\SYSTEM\MSSN32.EXE

C:\WINDOWS\ADDQU32.EXE

C:\WINDOWS\IEHK32.EXE

C:\WINDOWS\SYSTEM\ATLZG32.EXE

C:\WINDOWS\SYSTEM\ATLKT32.EXE

C:\WINDOWS\ATLFV.EXE

C:\WINDOWS\SYSTEM\SDKNF32.EXE

C:\WINDOWS\MSAQ.EXE

C:\WINDOWS\SYSTEM\APPLM32.EXE

C:\WINDOWS\APIKB32.EXE

C:\WINDOWS\SYSTEM\ATLXF32.EXE

C:\WINDOWS\D3JX.EXE

C:\WINDOWS\NTBQ32.EXE

C:\WINDOWS\SYSTEM\APPYG.EXE

C:\WINDOWS\SYSTEM\SYSGM.EXE

C:\WINDOWS\SYSTEM\APIDH.EXE

C:\WINDOWS\SYSTEM\SDKEV32.EXE

C:\WINDOWS\SYSTEM\CRLQ32.EXE

C:\WINDOWS\SYSTEM\SDKKV.EXE

C:\WINDOWS\SYSTEM\IESB.EXE

C:\WINDOWS\NETNJ.EXE

C:\WINDOWS\SDKDS.EXE

C:\WINDOWS\SYSTEM\ADDLI.EXE

C:\WINDOWS\SYSTEM\MSCX.EXE

C:\WINDOWS\JAVAAV32.EXE

C:\WINDOWS\SYSTEM\NTYG32.EXE

C:\WINDOWS\MFCWV.EXE

C:\WINDOWS\SYSTEM\IPTP.EXE

C:\WINDOWS\ADDQW.EXE

C:\WINDOWS\SYSTEM\MFCDV32.EXE

C:\WINDOWS\SYSTEM\SDKKG32.EXE

C:\WINDOWS\APPJI.EXE

C:\WINDOWS\SDKJA32.EXE

C:\WINDOWS\MFCBX.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\SYSTEM\APPPX32.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\IPTP.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\SYSTEM\MSCX.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\SYSTEM\JAVAEA32.EXE

C:\WINDOWS\SDKRE32.EXE

C:\WINDOWS\JAVART32.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ahzaj.dll/sp.html#23648

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://ahzaj.dll/index.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://ahzaj.dll/index.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ahzaj.dll/sp.html#23648

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ahzaj.dll/sp.html#23648

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://ahzaj.dll/index.html#23648