Hijackthis.log hjælp?

Kør Cwshredder: Cwshredder: http://www.spywareinfo.com/~merijn/downloads.html
Hvis det andet link ikke virker:
http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
Udpak, luk alle andre vinduer-fix

Og send en ny log

Sådan!

Logfile of HijackThis v1.97.7
Scan saved at 17:37:16, on 19-08-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\hrtcm.exe
C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Programmer\Symantec\pcAnywhere\awhost32.exe
C:\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [hrtcm] C:\WINNT\hrtcm.exe
O4 - HKLM\..\Run: [Ad-watch] "C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [svchost] C:\WINNT\svchost.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Opdater lige Hijackthis ,eller hent en nyere her: http://www.majorgeeks.com/download3155.html

Scan med Hijackthis, luk alle andre vinduer, sæt en vinge i nedenstående, og fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/new/
O4 - HKLM\..\Run: [hrtcm] C:\WINNT\hrtcm.exe

Genstart til fejlsikret tilstand F8
Find og slet denne fil-C:\WINNT\hrtcm.exe

Genstart og ny log
Find lige den fil her-egenskaber og se om det er en Microsoft fil- C:\WINNT\svchost.exe

Sådan!

Jeg har altså haft slettet C:\WINNT\hrtcm.exe, men jeg kan da godt se den stadig er der.

Logfile of HijackThis v1.98.2
Scan saved at 18:38:45, on 19-08-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmer\Symantec\pcAnywhere\awhost32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Ad-watch] "C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [svchost] C:\WINNT\svchost.exe
O4 - HKLM\..\Run: [hrtcm] C:\WINNT\hrtcm.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE

Vi prøver en anden måde. Gå i jobliste ctrl+alt+del og find:
hrtcm.exe høreklik på den- Afslut proces.
Hvad med den her: C:\WINNT\svchost.exe?
Den rigtige ligger i - C:\WINNT\system32\svchost.exe. den skal du ikke kigge efter!!

Genstart til fejlsikret tilstand
Scan med Hijackthis, luk alle andre vinduer, sæt en vinge i nedenstående, og fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://drusearch.com/new/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/new/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/new/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/new/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/new/
O4 - HKLM\..\Run: [hrtcm] C:\WINNT\hrtcm.exe

Find og slet denne fil-C:\WINNT\hrtcm.exe

Konfigurerer Adware  http://www.spywarefri.dk/tipsogtricks.htm#adaware       
Nu kører du en scanning med Ad-Aware og fjerner, hvad den finder.

Spybot: http://www.safer-networking.org/en/download/index.html
Installer, opdater, immuniser og kør. Fix alt, mærket med rød

Og denne scanner, tag et af de 7 øverste link, aktiver det hele i opsætningen
http://www.mwti.net/antivirus/free_utilities.asp

og ny log

-> magictouch

Puha det tog lang tid at scanne med den sidste.
Ved første øjekast så resultatet rigtig godt ud, men, men, men. Efter en genstart og IE start 2 var det hele tilbage.

Jeg har nu fået fat på Ad-aware 1.03 SE Pro og efter en scanning med den var den væk.
Jeg har tidligere scannet med Ad-aware 6.0.181 Pro uden held.

/Asger.

Godt det lykkedes for for dig;)

Tak for hjælpen alligevel.