Free Phone Names?

uden at være ekspert, og selv have haft og har problemer med det, vil jeg anbefale et besøg på www.arlet.dk, download spybot og hijackthis og kør så spybot til den siger at det er clean. Og bagefter brug HJT, men slet ikke noget i HJT uden kyndig hjælp... evt herinde.


Du har et spyware problem når den gør sådan...

Hej!

Ja jeg ved det, men jeg har kørt alle programmerne, og kan umiddelbart ikke se nogle syndere i HiJackThis.

Men okay, laver lige en log..

Noget at mistænke? :)

Logfile of HijackThis v1.97.7
Scan saved at 23:25:18, on 04-01-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
C:\WINDOWS\System32\STDSB.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\CA\eTrust Antivirus\InoRT.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\CA\eTrust Antivirus\InoTask.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programmer\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver\RtlWake.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HP\Digital Imaging\bin\hpqgalry.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Mia Blichfeldt\Dokumenter\Virus Tjek\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.biobooking.dk/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\System32\STDSB.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UpdateManager] "c:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmer\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Hurtig start.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RtlWake.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

mmm du har brug for mere kvalificeret hjælp end mig hehe, jeg har lige postet min egen log i håb om at nogen klogere personer vil forbarme sig.

:)

Det okay.. God nat..

Nu skal jeg lige se på den -5. min.

Disse linier skal fixes i hijackthis – markér og vælg fix checked:
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.biobooking.dk/
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" –osboot


Kør så cwshredder
http://downloads-zdnet.com.com/CWShredder/3000-8022_2-10349879.html?tag=lst-0-1

tøm dine midlertidige internet filer - alt offline indhold og din temp mappe:
C:\Documents and Settings\Brugernavn?\Local Settings\Temp

hjalp det?

Du behøver ikke fixe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.biobooking.dk/

Hej Dannyboyd! Beklager sent svar..

Det virker desværre ikke endnu.. Det fungerer således, at hvis jeg indtaster eksempelvis kdjfkdjfkdjfkdjfkdjfjfkdjf.dk, så går browseren over på www.freephonenames.com.

Min log ser nu således ud.

Logfile of HijackThis v1.97.7
Scan saved at 12:52:56, on 05-01-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
C:\WINDOWS\System32\STDSB.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver\RtlWake.exe
C:\Programmer\CA\eTrust Antivirus\InoRT.exe
C:\Programmer\CA\eTrust Antivirus\InoTask.exe
C:\Programmer\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Mia Blichfeldt\Dokumenter\Virus Tjek\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.biobooking.dk/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\System32\STDSB.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UpdateManager] "c:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmer\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Hurtig start.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RtlWake.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


Og tak fordi du vil hjælpe :)

Nu går u i kør og skriver Regedit :
Her browser du til: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Find alle med freephonenames og slet dem.

Hent nyeste version af hijackthis og kom eså med en ny log:
http://www.spywarefri.dk/vaerktoj.htm#hijackthis

Hej Dannyboyd!

Mange tak for hjælpen, og igen sorry jeg ikke lige har fået svaret tilbage så hurtigt. Sidder jo fast ude på kontoret indtil 20 hver dag :)

Anyways, jeg har fået fjernet det unødvendige, men der var desværre ikke noget med FreePhoneNames i regedit.

Imidlertid blev jeg viderestillet igen til noget der hedder www.com.org, og der stod der følgende vejledning:

Occasionally we receive inquiries from users who do not understand why they have accessed our site. Please be advised that you are not reaching our site as a result of spyware. We are not exactly sure why you have been directed here, however, we believe it is a result of the autosearch feature of Internet Explorer. If a site entered into the address bar cannot be accessed, Explorer apparently appends ".com" to the name and then tries to access that site. In the case of a search ending in .org, Explorer thus accesses our domain, "org.com." If you wish to turn off this behavior, we think it can be successfully accomplished by doing the following:

1. From the "Tools" menu, select "Internet Options".
2. Click on the "Advanced" tab.
3. Under "Search from the Address Bar", select "Do not search from the Address bar".
4. Click "OK".
5. You may need to restart your computer.

Please note that this does not solve the problem of why you could not access the original search term, and if that site is still not accessible (due to DNS problems, a server being down, network problems, a typographical error, etc.) you should now receive an error that the page cannot be displayed.


Tak for hjælpen denne gang :)

ok , men virker det så nu?

Hej Dannyboyd..

Ja nu fungerer det, som det burde :)

Tak for feedback så