Fjernelse af hijack
Jeg er desperart....og uden den store viden om computere og hijack problemer. Mit computer er blevet inficeret med hvad jeg har fået at vide kaldes en hijacker. Den har taget min browser så jeg har problemer med at komme ind på hjemmeside fordi den vender tilbage til en bestemt søgeside hele tiden, og samtidig popper den op med en masse vinduer... Jeg har forsøgt med programmet "hijackthis" og har dermed fået en lang liste som skal sortesres i. Mit problem er nu at få sorteret i den uden at slette ting der ikke skulle være slettet.Nedenfor ses listen. PLEASE HJÆLP MIG. Jeg er desparart da jeg sidder og skriver storopgave og virkelig behøver at mit internet virker. Håber der er nogen der har tid til at hjælpe en stakkels pige i nød.
Hilsen Marion
Logfile of HijackThis v1.99.0
Scan saved at 18:19:30, on 21-12-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\WEBSPE~1\backweb\7791805\Program\SERVIC~1.EXE
C:\Programmer\WebSpeed Sikkerhedspakke\Anti-Virus\fsgk32st.exe
C:\Programmer\WebSpeed Sikkerhedspakke\backweb\7791805\program\fsbwsys.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Anti-Virus\FSGK32.EXE
C:\Programmer\WebSpeed Sikkerhedspakke\backweb\7791805\Program\BackWeb-7791805.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Anti-Virus\fssm32.exe
C:\Programmer\WebSpeed Sikkerhedspakke\fswsclds.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\sdpasvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSMA32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSMB32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Lexmark X74-X75\lxbbbmgr.exe
C:\Programmer\Fælles filer\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\SM1BG.EXE
C:\Programmer\WebSpeed Sikkerhedspakke\Common\FCH32.EXE
C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSM32.EXE
C:\Programmer\Lexmark X74-X75\lxbbbmon.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Anti-Virus\fsav32.exe
C:\Programmer\WebSpeed Sikkerhedspakke\Common\FAMEH32.EXE
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Programmer\WebSpeed Sikkerhedspakke\DFW\Program\fsdfwd.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kim Ulrich Sørensen\Lokale indstillinger\Temporary Internet Files\Content.IE5\AP16ZQPK\hijackthis[1].exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.opasia.dk/start
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\KIMULR~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.thansen.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af TDC Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7B15D801-3CD4-41C8-8304-EB42B57F4523} - C:\WINDOWS\system32\fllnbaa.dll
O3 - Toolbar: AdwareFilter - {1028F737-81E7-452B-A860-E50CAD90A08C} - C:\Programmer\AdwareFilterToolBar\AdwareFilter.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Programmer\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [MicrosoftOEM] C:\WINDOWS\System32\smvss.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmer\WebSpeed Sikkerhedspakke\TNB\TNBUtil.exe" /CHECKALL
O4 - HKCU\..\Run: [Syslib] C:\WINDOWS\syslib.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmer\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\KODAK\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Påmindelser i Microsoft Works Kalender.lnk = ?
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.opasia.dk/start
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted IP range: 64.127.104.144
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O16 - DPF: {0556834E-F56C-4545-8FAD-4F0ED25999BE} (Jackie Control) - http://www.6jackpot.com/dialup/dk/jackie.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - http://www.dafolo.dk/dafolo/kommuner/version3/Codebase/FormCtl.cab
O16 - DPF: {1469FF24-47F6-11D2-8805-006008C537E3} (FormFlow Mail Control) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/ffmail.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://194.182.109.80/iNotes.cab
O16 - DPF: {1E69721D-9104-11D3-82D3-D06650C10000} (DafoloControl Class) - http://www.dafolo.dk/dafolo/kommuner/version3/Codebase/dafolo.CAB
O16 - DPF: {224F7DEA-B7C1-11D3-AB40-00902712A5C9} (PLSAddin Class) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/plsspeller.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://www.napster.com/client/setup.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://www.toolbar.google.dk/data/da/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {85D6F6C3-97FE-11D1-86CC-080009B6ACE6} (JetForm Image Filter (TIF)) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/imagetif.cab
O16 - DPF: {85D6F6C5-97FE-11D1-86CC-080009B6ACE6} (JetForm Image Filter (JPG)) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/imagejpg.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {EF2FB80F-0975-408E-A871-B00CC863478A} (FormFlow Soft Font Installer) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/fontinstaller.cab
O16 - DPF: {F4F6546F-FBA9-11D1-8AFB-080009ECFDC5} (FormFlow ListBox Control) - http://www.dafolo.dk/dafolo/kommuner/version3/codebase/listbox.cab
O18 - Filter: text/html - {6F240569-CA90-45E3-A726-1599CDC7F802} - C:\WINDOWS\system32\fllnbaa.dll
O18 - Filter: text/plain - {6F240569-CA90-45E3-A726-1599CDC7F802} - C:\WINDOWS\system32\fllnbaa.dll
O23 - Service: WebSpeed Sikkerhedspakke - Unknown - C:\PROGRA~1\WEBSPE~1\backweb\7791805\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Programmer\WebSpeed Sikkerhedspakke\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Authentication Agent - Unknown - C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSAA.EXE (file missing)
O23 - Service: fsbwsys - Unknown - C:\Programmer\WebSpeed Sikkerhedspakke\backweb\7791805\program\fsbwsys.exe
O23 - Service: F-Secure Distributed Firewall Daemon - F-Secure Corporation - C:\Programmer\WebSpeed Sikkerhedspakke\DFW\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\Programmer\WebSpeed Sikkerhedspakke\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service - F-Secure Corporation - C:\Programmer\WebSpeed Sikkerhedspakke\fswsclds.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SDPAUMS server service - Matsushita Electric Industrial Co.,Ltd. - C:\WINDOWS\System32\sdpasvc.exe
Tak for hjælpen.
