hjælp til fjernelse af uoeen.dll

Hent Hijackthis, og læg en log fil herind

http://www.spywarefri.dk/vaerktoj.htm#hijackthis

Logfile of HijackThis v1.97.7
Scan saved at 03:13:00, on 26-06-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\ntlv.exe
C:\Programmer\Microsoft IntelliType Pro\type32.exe
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\Programmer\D-Tools\daemon.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\programmer\steam\steam.exe
C:\Programmer\TGTSoft\StyleXP\StyleXP.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\3Com\Launcher.exe
C:\Programmer\Fælles filer\3Com\LanSupportService.exe
C:\Programmer\Fælles filer\3Com\AllWirelessLansService.exe
C:\PROGRA~1\3Com\WLANMA~1\Activate.exe
C:\Programmer\Messenger Plus! 3\MsgPlus.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\javalq32.exe
C:\PROGRA~1\MICROS~4\OFFICE11\OUTLOOK.EXE
C:\Programmer\Microsoft Office\OFFICE11\WINWORD.EXE
C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\Documents and Settings\-_- TrippLoc -_-\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kaoeo.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaoeo.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaoeo.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kaoeo.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://kaoeo.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\kaoeo.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.newz.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.newz.dk"); (C:\Documents and Settings\-_- TrippLoc -_-\Application Data\Mozilla\Profiles\default\hg7gqtau.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\-_- TrippLoc -_-\Application Data\Mozilla\Profiles\default\hg7gqtau.slt\prefs.js)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AADFB291-907E-B543-8BB5-06575F4D4539} - C:\WINDOWS\system32\mfcdh32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [type32] "C:\Programmer\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmer\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RivaTunerOverclocker] C:\Upload\RivaTuner20RC10\RivaTuner.exe /O
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [javalq32.exe] C:\WINDOWS\system32\javalq32.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\bridge.dll",Load
O4 - HKCU\..\Run: [Steam] "c:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [STYLEXP] C:\Programmer\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmer\Messenger Plus! 3\" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programmer\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKLM\..\RunOnce: [ntlv.exe] C:\WINDOWS\system32\ntlv.exe
O4 - HKLM\..\RunOnce: [ipxp.exe] C:\WINDOWS\system32\ipxp.exe
O4 - HKLM\..\RunOnce: [iexa.exe] C:\WINDOWS\system32\iexa.exe
O4 - HKLM\..\RunOnce: [apiau32.exe] C:\WINDOWS\apiau32.exe
O4 - HKLM\..\RunOnce: [winja32.exe] C:\WINDOWS\system32\winja32.exe
O4 - HKLM\..\RunOnce: [d3gc.exe] C:\WINDOWS\system32\d3gc.exe
O4 - HKLM\..\RunOnce: [ntyb32.exe] C:\WINDOWS\ntyb32.exe
O4 - HKLM\..\RunOnce: [apipl.exe] C:\WINDOWS\system32\apipl.exe
O4 - Global Startup: 3Com Launcher.lnk = C:\Programmer\3Com\Launcher.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {1230CB21-C88D-11CF-B347-000000000000} - http://www.eingang69.de/EroticAccess/Cabs/1848000.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/da/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {91BE8DAC-957E-416C-B735-E2B63CDB915B} (MyEMessengerSetup Control) - http://www.myemessenger.com/activex/MyEMessengerSetupProject.cab
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - http://static.flingstone.com/cab/2000XP/CDTInc/bridge.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37999.1289467593
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -
O16 - DPF: {AE609930-A6EB-4A78-B7DA-B3200705FEBD} (Mophun Control) - http://www.mophun.com/codebase/mophun.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/chedownzip.cab

men imens jeg har ventet på svar herinde har den allerede heddet 3 navne.. nu hedder den kaoeo.dll

Bliv opdateret allerførst: http://v4.windowsupdate.microsoft.com/da/default.asp

Havde samme som dig - fandt et værktøj der ser ud til at være lavet specielt til denne - http://hsremove.bravehost.com

rasman... 1000 tak.. det var lige det jeg ledte efter!! :P

hvorn gir jeg dig de point???

Ved ikke - Jeg har aldrig prøvet at stille spørgsmål her

hmm... men tak for svaret i hvert fald... *bukker*

<<CLOSED>><<CLOSED>><<CLOSED>><<CLOSED>><<CLOSED>><<CLOSED>>

Rasman du lægger bare en ny kommentar som et svar.
Så markerer etal dig i en box ude til venstre og accepterer dit svar
Thats it ;O)

etal> har du lyst til at lægge din log fil herud, der kunne være mere snavs i den. Og nej, jeg skal ikke ha´point.

For din første log er fyldt af snavs;(

Ja jeg er også lidt mystificeret, fordi det link som rasman lægger er under konstruktion. Der ligger intet program der.....
Hvordan hænger det sammen?

etal >> vi vil meget gerne se en ny log fra HijackThis – tak.

andersenPH - det lader til siden har problemer - se evt http://www.hsremove.com

En rigtig god ven af mig har lige testet com side som rasman linker til med spysweeper og den kommer op med alarm.
Det er en hijackerside åbenbart og det kan kun frarådes at hoppe derind.

HTML på siden er ren

Ja den er lige blevet godkendt, så der var tale om falsk alarm :O)

fint fint... min problem er væk i hvert fald!!!