Maskinen er hijacket, hjælp
Maskinen er en Amitech Amd athlon 1200/128 mbDen er pludselig begyndt at køre meget langsomt.
Norton Firewall kan ikke startes.
Der er checket for hardware fejl.
Please hjælp mig
Logfile of HijackThis v1.97.7
Scan saved at 00:17:05, on 26-04-2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAMMER\NORTON INTERNET SECURITY\NISSERV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAMMER\NETROPA\TOUCH MANAGER\TOUCHMGR.EXE
C:\PROGRAMMER\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAMMER\NETROPA\TOUCH MANAGER\MEDIACTR.EXE
C:\PROGRAMMER\NORTON INTERNET SECURITY\IAMAPP.EXE
C:\PROGRAMMER\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMER\FæLLES FILER\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\TWAIN_32\SIPIX\SCBLINK2\BLINK2CC.EXE
C:\AMITECH\ONNOW.EXE
C:\PROGRAMMER\NETROPA\TOUCH MANAGER\MMUSBKB2.EXE
C:\PROGRAMMER\ICQLITE\ICQLITE.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAMMER\LEXMARK X74-X75\LXBBBMGR.EXE
C:\AMITECH\FORTRYD.EXE
C:\PROGRAMMER\LEXMARK X74-X75\LXBBBMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\DV SERIES\CONSOLE\WATCH.EXE
C:\PROGRAMMER\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 MY CUSTOM EDITION\CALCHECK.EXE
C:\PROGRAMMER\MOTOROLA\A920 DESKTOP SUITE\CONNMNGMNTBOX.EXE
C:\PROGRAMMER\MOTOROLA\A920 DESKTOP SUITE\ECTASKSCHEDULER.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAMMER\MOTOROLA\A920 DESKTOP SUITE\ELOGERR.EXE
C:\PROGRAMMER\INCREDIMAIL\BIN\IMAPP.EXE
C:\PROGRAMMER\INTUWAVE\SHARED\PRODUCT\MROUTERRUNTIME.EXE
C:\PROGRAMMER\MOTOROLA\A920 DESKTOP SUITE\BROADCASTPROXY.EXE
C:\PROGRAMMER\MOTOROLA\A920 DESKTOP SUITE\SCRFS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SKRIVEBORD\HIJACK\HJT.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lxeowl.t.muxa.cc/h.php?aid=20605 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lxeowl.t.muxa.cc/h.php?aid=20605 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://lxeowl.t.muxa.cc/s.php?aid=20605 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://lxeowl.t.muxa.cc/h.php?aid=20605 (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FÆLLES~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FÆLLES~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [nVidiaTV-OUT] Regedit /S C:\Windows\tvout.reg
O4 - HKLM\..\Run: [Touch Manager] C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
O4 - HKLM\..\Run: [Startup] C:\Amitech\Startup /START
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [iamapp] C:\Programmer\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BLINK2CC] C:\WINDOWS\twain_32\SiPix\SCBLINK2\BLINK2CC.exe
O4 - HKLM\..\Run: [USBPNP] C:\WINDOWS\twain_32\SiPix\SCBLINK2\USBPNP.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [CamMonitor] C:\Programmer\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Programmer\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [sys] regedit -s sys.reg
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmer\Fælles filer\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [nisserv] C:\Programmer\Norton Internet Security\NISSERV.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAMMER\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Watch.lnk = C:\Programmer\DV Series\Console\Watch.exe
O4 - Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = ?
O4 - Startup: A920 Connection Manager.lnk = C:\Programmer\Motorola\A920 Desktop Suite\ConnMngmntBox.exe
O4 - Startup: A920 Task Scheduler.lnk = C:\Programmer\Motorola\A920 Desktop Suite\ECTaskScheduler.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37969.5115740741
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/15887e9237810461cc23/netzip/RdxIE601.cab
O16 - DPF: {4B6015E7-3ABB-45DC-96B7-55A843751F28} (IntRuboskizo2 Class) - http://www.contenidospc.com/ruboskizo2.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
