Syncroad.exe + andre
hmm tror at det er en af de rigtig grimme, jeg kan i hvert fald ikke slippe af med denad-aware spybot S&D kan ikke fjerne den
spybot anbefaler spyblaster et eller andet, men hver gang jeg prøver at køre setuppen siger den at den er corupt.
anyways har manuelt været i regedit og slette alle oplysninger om den der, og derefter i msconfig og og forhindre opstart, men den starter op alligevel, den kan ikke lukkes i ctrl-alt-del under processer, den starter bare op igen efter et øjeblik
mappen til den ligger under "program files" og den vil heller ikke lade sig slette, den siger bare adgang nægtet
jeg kan se at der ligger noget lort, men hvor meget ved jeg ikke
en der har tid og lyst til at hjælpe lille mig endnu engang?
Logfile of HijackThis v1.98.2
Scan saved at 01:40:00, on 23-09-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\D-Tools\daemon.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Programmer\Pulse\Pulse.exe
C:\Program Files\Windows SyncroAd\WinSync.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\WINDOWS\System32\msiexec.exe
C:\Programmer\Internet Explorer\iexplore.exe
D:\ANTIVIRUSSPYADAWARE\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.svkmedical.se/DC/TNO/index.php?sid=9c148def5698ae19e85e1f26086ba19c
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKCU\..\Run: [Pulse] C:\Programmer\Pulse\Pulse.exe -splash
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=8c4f4634a6cb3563992c4afb91102a05d8cb6fabaea1d720dfb649ed4800f9e347d3b936bd4ef578beff3de5a7f1248299b0:61c349ac2c9d0346d02ce89775140bcf
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093397859968
spybot finder også en der hedder DSO Exploit
selvom at spybot siger at den er fixet, så når jeg kører søgningen igen lige efter, ja så er den der igen
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1 -5-1 8\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1 004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1 -5-21-842925246-261478967-839522115-1 003\Software\Microsoft\Windows\CurrentVersion\I nternet Settings\Zones\0\14!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1 -5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1 004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1 -5-1 9\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1 004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1 004!=W=3
Spybot - Search && Destroy version: 1.3
2004-08-11 Includes\Cookies.sbi
2004-08-30 Includes\Dialer.sbi
2004-08-30 Includes\Hijackers.sbi
2004-08-20 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-08-30 Includes\Malware.sbi
2004-08-12 I ncludes\Revision.sbi
2004-08-11 Includes\Security.sbi
2004-08-30 Includes\Spybots.sbi
2004-08-30 Includes\Tracks.uti
2004-08-30 Includes\Trojans.sbi
det er de oplysninger jeg har på den fra spybot
