Avatar billede kaarej Nybegynder
22. marts 2004 - 19:13 Der er 12 kommentarer

Tjek venligst denne logfil

Logfile of HijackThis v1.97.7
Scan saved at 19:12:01, on 22-03-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\essspk.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kenn\Dokumenter\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sharempeg.com/find/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-2003.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sharempeg.com/find/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.search-2003.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sharempeg.com/find/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.sharempeg.com/find/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.sharempeg.com/find/
O1 - Hosts: 198.65.164.171 ehttp.cc
O1 - Hosts: 198.65.164.168 winlink.biz
O1 - Hosts: 198.65.164.168 winlink.ws
O1 - Hosts: 198.65.164.168 ad45.com
O1 - Hosts: 198.65.164.168 www.ad45.com
O1 - Hosts: 198.65.164.168 ad77.com
O1 - Hosts: 198.65.164.168 www.ad77.com
O1 - Hosts: 198.65.164.168 ad86.com
O1 - Hosts: 198.65.164.168 www.ad86.com
O1 - Hosts: 198.65.164.168 ad25.com
O1 - Hosts: 198.65.164.168 www.ad25.com
O1 - Hosts: 198.65.164.168 00hq.com
O1 - Hosts: 198.65.164.168 www.00hq.com
O1 - Hosts: 198.65.164.168 8ad.com
O1 - Hosts: 198.65.164.168 www.8ad.com
O1 - Hosts: 198.65.164.168 searchv.com
O1 - Hosts: 198.65.164.168 www.searchv.com
O1 - Hosts: 198.65.164.168 008k.com
O1 - Hosts: 198.65.164.168 www.008k.com
O1 - Hosts: 198.65.164.170 achea.org
O1 - Hosts: 198.65.164.170 www.efinder.cc
O1 - Hosts: 198.65.164.170 lop.com
O1 - Hosts: 198.65.164.170 finder2003.com
O1 - Hosts: 198.65.164.170 www.search-aid.com
O1 - Hosts: 198.65.164.170 www.search2004.net
O1 - Hosts: 198.65.164.170 www.hugesearch.net
O1 - Hosts: 198.65.164.170 luckyfinder.com
O1 - Hosts: 198.65.164.170 luckysearch.net
O1 - Hosts: 198.65.164.170 kitasearch.com
O1 - Hosts: 198.65.164.170 www.orbitexplorer.com
O1 - Hosts: 198.65.164.170 www.sqwire.com
O1 - Hosts: 198.65.164.170 www.traffichog.com
O1 - Hosts: 198.65.164.170 allneedsearch.com
O1 - Hosts: 198.65.164.170 www.yellow500.com
O1 - Hosts: 198.65.164.170 www.008i.com
O1 - Hosts: 198.65.164.170 www.opsex.com
O1 - Hosts: 198.65.164.170 www.onlysex.ws
O1 - Hosts: 198.65.164.170 www.7days.ws
O1 - Hosts: 198.65.164.170 www.xsex.ws
O1 - Hosts: 198.65.164.170 www.6o9.com
O1 - Hosts: 198.65.164.170 search-company.com
O1 - Hosts: 198.65.164.170 www.700k.com
O1 - Hosts: 198.65.164.170 www.hotbookmark.com
O1 - Hosts: 198.65.164.170 www.runsearch.com
O1 - Hosts: 198.65.164.170 runsearch.com
O1 - Hosts: 198.65.164.170 www.search-about.net
O1 - Hosts: 198.65.164.170 go-all.com
O1 - Hosts: 198.65.164.170 go-acct.com
O1 - Hosts: 198.65.164.170 get-faster.com
O1 - Hosts: 198.65.164.170 get-data.net
O1 - Hosts: 198.65.164.170 get-certified.net
O1 - Hosts: 198.65.164.170 get-access.com
O1 - Hosts: 198.65.164.170 000info.com
O1 - Hosts: 198.65.164.170 0-days.net
O1 - Hosts: 198.65.164.170 0-2u.com
O1 - Hosts: 198.65.164.170 0-29.com
O1 - Hosts: 198.65.164.170 alfaporn.com
O1 - Hosts: 198.65.164.170 i-lookup.com
O1 - Hosts: 198.65.164.170 www.alfa-search.com
O1 - Hosts: 198.65.164.170 www.dotcomtoolbar.com
O1 - Hosts: 198.65.164.170 toteen.com
O1 - Hosts: 198.65.164.170 www.find-itnow.com
O1 - Hosts: 198.65.164.170 www.mixedporno.com
O1 - Hosts: 198.65.164.170 eliteteensites.com
O1 - Hosts: 198.65.164.170 newsexgate.com
O1 - Hosts: 198.65.164.170 www.newsexgate.com
O1 - Hosts: 198.65.164.170 uuporn.com
O1 - Hosts: 198.65.164.170 www.uuporn.com
O1 - Hosts: 198.65.164.170 hardcorevibe.com
O1 - Hosts: 198.65.164.170 www.hardcorevibe.com
O1 - Hosts: 198.65.164.170 overmix.com
O1 - Hosts: 198.65.164.170 www.overmix.com
O1 - Hosts: 198.65.164.170 theadultgate.com
O1 - Hosts: 198.65.164.170 www.theadultgate.com
O1 - Hosts: 198.65.164.170 hornygate.com
O1 - Hosts: 198.65.164.170 www.hornygate.com
O1 - Hosts: 198.65.164.170 sexxx-start.com
O1 - Hosts: 198.65.164.170 www.sexxx-start.com
O1 - Hosts: 198.65.164.170 logtoporn.com
O1 - Hosts: 198.65.164.170 www.logtoporn.com
O1 - Hosts: 198.65.164.170 3xpower.com
O1 - Hosts: 198.65.164.170 www.3xpower.com
O1 - Hosts: 198.65.164.170 start-search.com
O1 - Hosts: 198.65.164.170 www.lookfor.cc
O1 - Hosts: 198.65.164.170 www.hotsearchbox.com
O1 - Hosts: 198.65.164.170 ie-search.com
O1 - Hosts: 198.65.164.170 www.search-1.net
O1 - Hosts: 198.65.164.170 swift-look.com
O1 - Hosts: 198.65.164.170 www.swift-look.com
O1 - Hosts: 198.65.164.170 www.search2525.com
O1 - Hosts: 198.65.164.170 www.sureseeker.com
O1 - Hosts: 198.65.164.170 www.searchmeup.com
O1 - Hosts: 198.65.164.170 www.statblaster.com
O1 - Hosts: 198.65.164.170 www.day4sex.com
O1 - Hosts: 198.65.164.170 day4sex.com
O1 - Hosts: 198.65.164.170 www.seek-porn.com
O1 - Hosts: 198.65.164.170 seek-porn.com
O1 - Hosts: 198.65.164.170 freexxxplace.com
O1 - Hosts: 198.65.164.170 www.freexxxplace.com
O1 - Hosts: 198.65.164.170 worldmpeg.com
O1 - Hosts: 198.65.164.170 www.worldmpeg.com
O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Kenn\Application Data\winlink\winlink.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Dumb exit] C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
O4 - HKLM\..\Run: [host] C:\WINDOWS\system32\hosts.vbs
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede arlet Juniormester
22. marts 2004 - 19:14 #1
løber den igennem
Avatar billede arlet Juniormester
22. marts 2004 - 19:20 #2
Hent og kør dette program: http://www.arlet.dk/cwshredder.htm
genstart og ny hijackthis log
Avatar billede kaarej Nybegynder
22. marts 2004 - 19:30 #3
Nu ser den således.

Logfile of HijackThis v1.97.7
Scan saved at 19:28:37, on 22-03-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\essspk.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Kenn\Dokumenter\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Dumb exit] C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede arlet Juniormester
22. marts 2004 - 19:35 #4
Den gjorde sit arbejde godt..

Kender du denne her:
O4 - HKLM\..\Run: [Dumb exit] C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
Avatar billede kaarej Nybegynder
22. marts 2004 - 19:38 #5
nej jeg aner ikkke hvad det er for en!
Avatar billede arlet Juniormester
22. marts 2004 - 19:46 #6
Fix i hijackthis:
O4 - HKLM\..\Run: [Dumb exit] C:\PROGRA~1\64 htm curb\WIPE README FREE.exe

find og slet:
C:\PROGRA~1\64 htm curb\WIPE README FREE.exe

genstart og ny log
Avatar billede kaarej Nybegynder
22. marts 2004 - 19:49 #7
Logfile of HijackThis v1.97.7
Scan saved at 19:48:50, on 22-03-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\essspk.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Programmer\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kenn\Dokumenter\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede bredker Nybegynder
22. marts 2004 - 19:52 #8
du mangler stadig denne
du skal i fejlsikker for at slette den
C:\PROGRA~1\64 htm curb\WIPE README FREE.exe
Avatar billede bredker Nybegynder
22. marts 2004 - 19:56 #9
glæmte lige
du skal også deaktivere din systemgendannelse
Avatar billede kaarej Nybegynder
22. marts 2004 - 20:17 #10
Logfile of HijackThis v1.97.7
Scan saved at 20:11:28, on 22-03-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Kenn\Dokumenter\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe" /WinStart
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede bredker Nybegynder
22. marts 2004 - 20:21 #11
flot , nu er den ren og du kan slå systemgendannelse til igen
sørg for at hente og instalere SP , den er vigtig
kik også på denne side , der er nogle ret gode programmer til at holde den ren
http://www.spywarefri.dk/pakken.htm
Avatar billede kaarej Nybegynder
22. marts 2004 - 20:34 #12
Mange tak for hjælpen.. begge to!
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester