calc.exe og packager.exe starter automatisk
Hej.Jeg synes, min Internet Explorer er blevet lidt langsom. Jeg har kørt en masse af disse adware-away, spy-hunter, spyware-doctor, spy-bot osv.
Jeg har opdaget, at calc.exe og packager.exe skiftes til at dukke op i listen af kørende processer. Lommeregneren er IKKE synlig på skærmen og når jeg dræber processen, dukker den bare op igen på listen - eller også kommer packager.exe i stedet.
Det må være en virus/ad-ware, men hvordan får jeg den væk?
Herunder kan I se loggen fra HijackThis. Det meste genkender jeg (f.eks. Google searchbar).
Jeg ser desværre ikke jeres svar før i næste uge.
Håber, I kan hjælpe mig!
Morten
Logfile of HijackThis v1.99.0
Scan saved at 13:08:40, on 21-01-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PCD32\client32.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\PC-DUO~1\CLMETERSVC.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\windows\system32\bnwvbj.exe
C:\WINDOWS\system32\ntvdm.exe
C:\windows\system32\calc.exe
D:\Mortens filer\Diverse\Programmer2\Antivirus\Nye pr. 21 januar 2005\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///L:/_medarbejdermapper/mht/doc/start.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [PC-Duo System Snapshot] C:\PCD32\CLBOOT32.EXE
O4 - HKLM\..\Run: [Enterprise Client Startup] C:\PC-DUO~1\CLBOOT32.EXE
O4 - HKLM\..\Run: [LUGuard] C:\PC-DUO~1\LUGuard.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [CVPND_STOP] C:\WINDOWS\CVPND_ST.EXE
O4 - HKLM\..\Run: [bnwvbj] c:\windows\system32\bnwvbj.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\SETI@home.exe -min
O4 - Startup: Lotus Notes 6.lnk = C:\notes\notes.exe
O4 - Global Startup: BOINC.lnk = C:\Program Files\BOINC\boinc_gui.exe
O4 - Global Startup: Keyboard Express 95.lnk = C:\Program Files\keyexp\KEYEXP.EXE
O4 - Global Startup: Lotus QuickStart.lnk = ?
O4 - Global Startup: Lotus Suitestart.lnk = C:\lotus\smartctr\SUITEST.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = egdk.it-corp.net
O17 - HKLM\Software\..\Telephony: DomainName = egdk.it-corp.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = egdk.it-corp.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = egdk.it-corp.net
O23 - Service: Client32 - NetSupport Ltd - C:\PCD32\client32.exe
O23 - Service: iSeries Access for Windows Remote Command - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: LANutil32 Distribution Agent - Vector Networks Limited - C:\PC-DUO~1\CLDISTSVC.EXE
O23 - Service: LANutil32 Software Metering Agent - Vector Networks Limited - C:\PC-DUO~1\CLMETERSVC.EXE
O23 - Service: McAfee Framework Service - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Workstation NetLogon Service - Unknown - C:\WINDOWS\system32\ntta32.exe (file missing)
