Hu blir jag av med en irriterande toolbar med från

[Gäst idgadmin]

Nu e jag så himla less på en toolbar jag har fått på min dator från nåt som heter searchweb2.com.

Har testa´t alla möjliga remove program t.ex ad-aware, panda, och spybot men inget funkar. Har nu listat ut átt man kanske kan ta bort det med Hijack This och skickar följaktligen med loggen nedan.

 

Please finns den nån stjärna som kan hjälpa mej!!!!

 

 

Logfile of HijackThis v1.98.2

Scan saved at 23:21:57, on 2004-10-20

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program\Creative\ShareDLL\CtNotify.exe

C:\Program\Messenger Plus! 3\MsgPlus.exe

C:\Program\NORTON~1\navapw32.exe

C:\Program\QuickTime\qttask.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Skype\Phone\Skype.exe

C:\program\steam\steam.exe

C:\Program\MSN Messenger\msnmsgr.exe

c:\program\intern~1\iexplore.exe

C:\Program\Creative\ShareDLL\MediaDet.Exe

C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program\RealVNC\WinVNC\winvnc.exe

C:\Documents and Settings\Stefan\Skrivbord\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.aeqfyjtrcva.com/vC6uE1Bu9Wbc5zE8cQg2y05MCrkvnBwKws3SW/Nlfyjcru11yX8cCfq3nsCkuKsG.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tradera.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.se

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {0700CB12-C775-AB08-7AD3-2661948673DE} - C:\DOCUME~1\Stefan\APPLIC~1\MAILTO~1\jugs date.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe

O4 - HKLM\..\Run: [browse Body Tray Proc] C:\Documents and Settings\All Users\Application Data\grey deaf browse body\thirdadmin.exe

O4 - HKLM\..\Run: [Disc Detector] C:\Program\Creative\ShareDLL\CtNotify.exe

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program\Messenger Plus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [NAV Agent] C:\Program\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\Updreg.exe

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Dog up] C:\DOCUME~1\Stefan\APPLIC~1\ISODRI~1\move dupe sign.exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program\Messenger Plus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [steam] "c:\program\steam\steam.exe" -silent

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.msn.se

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/SU/ocx/CTSUEng.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple.com/qt505/se/win/QuickTimeInstaller.exe

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

 

 

Ser ni nåt annat skit man bör ta bort så blir jag ännu gladare

 

Mvh Bernst-Gunnar

 

[Zipp.]

Avinstallera MessengerPlus3 via Kontrollpanelen

 

 

Skippa inte detta

 

 

Skapa en ny mapp på C:/ och placera HijackThis.exe dit så C:/HjT/HijackThis.exe

 

 

Scanna med Hijack bocka i följande rader stäng Web-läsaren och alla andra öppna fönster och klicka FIX checked

 

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.aeqfyjtrcva.com/vC6uE1Bu9Wbc5zE8cQg2y05MCrkvnBwKws3SW/

Nlfyjcru11yX8cCfq3nsCkuKsG.asp

O2 - BHO: (no name) - {0700CB12-C775-AB08-7AD3-2661948673DE} - C:\DOCUME~1\Stefan\APPLIC~1\MAILTO~1\jugs date.exe

O4 - HKLM\..\Run: [browse Body Tray Proc] C:\Documents and Settings\All Users\Application Data\grey deaf browse body\thirdadmin.exe

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program\Messenger Plus! 3\MsgPlus.exe"

O4 - HKCU\..\Run: [Dog up] C:\DOCUME~1\Stefan\APPLIC~1\ISODRI~1\move dupe sign.exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program\Messenger Plus! 3\MsgPlus.exe" /WinStart

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple

.com/qt505/se/win/QuickTimeInstaller.exe

 

 

Starta sen i felsäkert läge sök och ta bort

 

C:\DOCUME~1\Stefan\APPLIC~1\MAILTO~1\jugs date.exe

- ta bort MAILTO~1 mappen

 

C:\Documents and Settings\All Users\Application Data\grey deaf browse body\thirdadmin.exe

- ta bort grey deaf browse body mappen

 

C:\Program\Messenger Plus! 3\MsgPlus.exe"

- ta bort Messenger Plus! 3 mappen

 

C:\DOCUME~1\Stefan\APPLIC~1\ISODRI~1\move dupe sign.exe

- ta bort ISODRI~1 mappen