Avatar billede stign Nybegynder
01. april 2005 - 17:10 Der er 4 kommentarer og
2 løsninger

Hjælp til HiJackThis log

Hej med jer,

Min PC er begyndt at sløve lidt på den. Jeg har lavet en log via HiJackThis, er der nogen der kan tjekke om jeg er ok. Jeg benytter ZoneAlarm firewall, burde det ikke være ok?

Logfile of HijackThis v1.99.1
Scan saved at 17:07:15, on 01-04-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
C:\WINDOWS\System32\NVAREM.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\BRMFRSMG.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\x10nets.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Stig & Soren\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WINSCHEDULER] C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] NVAREM.EXE /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://static.35mb.com/applet/applet_y.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\System32\x10nets.exe
Avatar billede arlet Juniormester
01. april 2005 - 17:10 #1
tjekker den nu
Avatar billede arlet Juniormester
01. april 2005 - 17:12 #2
Den er ren...

APRILSNAR!!!!!!! *GH*

Der er lidt snavs i den, 5 min, så er jeg klar med procedure
Avatar billede arlet Juniormester
01. april 2005 - 17:16 #3
Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe

--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

--------------------------------------------------------------------

Find og slet manuelt i fejlsikret(f8 ved opstart):


c:\program files\180solutions\sais.exe
C:\PROGRA~1\COMMON~1\tsa\tsl2.exe



------------------------------------------------

Hent og kør spybot herfra: http://www.arlet.dk/spywarescanner.htm
scan hele computeren og slet alt hvad den finder

----------------------------------------------------------

Hent og kør denne scanner fra Kaspersky : http://www.spywareinfo.dk/download/mwav.exe
Sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files
Og så trykker du på Scan Clean
Det tager lidt over en time at scanne
Der kommer en rapport til sidst, den vil jeg gerne se..

----------------------------------------------------------

Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Avatar billede stign Nybegynder
01. april 2005 - 20:35 #4
Hej Arlet,

Så er det klaret.

Det du bad mig om at slette i fejlsikret tilstand var der ikke.

Spybot fandt ingenting under scan.

Her er den logfil fra Kaspersky du bad om. Nu Genstarter jeg og laver en ny HiJackThis log og sender til dig

File C:\WINDOWS\newpop446.exe tagged as not-a-virus:AdWare.MediaMotor.e. No Action Taken.
File C:\WINDOWS\unstall.exe tagged as not-a-virus:AdWare.MediaMotor.c. No Action Taken.
File C:\WINDOWS\System32\dun.exe tagged as not-a-virus:AdWare.DealHelper.x. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Targetsaver.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temp\GLF20GLF20.EXE infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temp\sahagent.exe tagged as not-a-virus:AdWare.Sahat.h. No Action Taken.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temp\targetsaver.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temp\tvmupdater.exe tagged as not-a-virus:AdWare.TotalVelocity.v. No Action Taken.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temporary Internet Files\Content.IE5\55AVCMZ9\targetsaver[1].exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temporary Internet Files\Content.IE5\HU7UY75R\ysb_prompt[2].php infected by "Exploit.HTML.CodeBaseExec" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Stig & Soren\Local Settings\Temporary Internet Files\Content.IE5\WTCTYFGX\ncase_new[1].exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\02F82D10 tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0F1F61E6 tagged as not-a-virus:AdWare.TotalVelocity.aa. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\260F5713 infected by "Trojan-Downloader.Win32.IstBar.hp" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A676742 tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\31BC556E infected by "Trojan-Downloader.Win32.IstBar.gz" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\31BF7F6A tagged as not-a-virus:AdWare.WebRebates.g. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\337618CA tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\337942C7 tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\33866AB8 infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\3D304F10 tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\495703E7 tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\49913374 tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4F975EC1 tagged as not-a-virus:AdWare.MediaMotor.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\62E97C5F tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\62F27A55 tagged as not-a-virus:AdWare.MDH.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\63034C43 tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6E9D5E88 tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6EA00885 infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\6EA43281 tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\702F4541 tagged as not-a-virus:AdWare.ToolBar.YourSiteBar.c. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\71DB42CB infected by "Trojan-Downloader.Win32.IstBar.gz" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0005778.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0005779.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006679.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006680.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006708.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006709.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006732.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006733.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006768.dll tagged as not-a-virus:AdWare.WebSearch.l. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006769.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006770.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP43\A0006771.dll tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP47\A0007142.EXE tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP47\A0007143.exe tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP47\A0007144.DLL tagged as not-a-virus:AdWare.F1Organizer.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP47\A0007147.EXE tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007175.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007180.EXE tagged as not-a-virus:AdWare.ShopAtHome.b. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007187.exe tagged as not-a-virus:AdWare.Sahat.i. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007188.exe tagged as not-a-virus:AdWare.Sahat.i. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007189.exe tagged as not-a-virus:AdWare.ShopAtHome.b. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007216.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007341.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007342.exe tagged as not-a-virus:AdWare.TotalVelocity.aa. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007343.dll tagged as not-a-virus:AdWare.TotalVelocity.aa. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007344.dll tagged as not-a-virus:AdWare.TotalVelocity.aa. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007351.exe tagged as not-a-virus:AdWare.WebSearch.f. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007360.DLL tagged as not-a-virus:AdWare.F1Organizer.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007369.exe tagged as not-a-virus:AdWare.WebSearch.f. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007370.dll tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007374.exe tagged as not-a-virus:AdWare.DealHelper.x. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007375.exe tagged as not-a-virus:AdWare.DealHelper.v. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007377.exe tagged as not-a-virus:AdWare.WebSearch.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007378.exe tagged as not-a-virus:AdWare.WebSearch.n. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007379.dll tagged as not-a-virus:AdWare.WebSearch.l. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP48\A0007380.exe tagged as not-a-virus:AdWare.Wintol.t. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP54\A0007612.dll tagged as not-a-virus:AdWare.Suggestor.g. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP54\A0007613.EXE tagged as not-a-virus:AdWare.Suggestor.g. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP55\A0007619.exe tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP55\A0007620.exe tagged as not-a-virus:AdWare.MediaMotor.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP55\A0007622.exe tagged as not-a-virus:AdWare.MDH.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP60\A0007878.dll tagged as not-a-virus:AdWare.BHO.MegaSearch.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP62\A0015560.exe tagged as not-a-virus:AdWare.MediaMotor.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP67\A0015754.exe tagged as not-a-virus:AdWare.MediaMotor.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP70\A0015838.exe tagged as not-a-virus:AdWare.PowerScan.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP70\A0015872.exe tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP70\A0015882.exe tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015884.exe tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015892.dll tagged as not-a-virus:AdWare.F1Organizer.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015893.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015894.exe infected by "Trojan-Downloader.Win32.IstBar.he" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015895.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015896.exe infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015897.dll tagged as not-a-virus:AdWare.TotalVelocity.v. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015898.dll tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015899.exe tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015900.dll tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015901.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015907.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015913.exe tagged as not-a-virus:AdWare.MediaMotor.e. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015915.exe infected by "Trojan-Downloader.Win32.IstBar.hh" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0015929.exe infected by "Trojan-Dropper.Win32.Mudrop.o" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016333.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016334.dll tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016339.exe infected by "Trojan-Downloader.Win32.IstBar.hh" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016340.exe infected by "Trojan-Downloader.Win32.IstBar.he" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016342.dll tagged as not-a-virus:AdWare.BHO.MegaSearch.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016343.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016344.dll tagged as not-a-virus:AdWare.ToolBar.SideFind. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016345.exe infected by "Trojan-Downloader.Win32.IstBar.eo" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016352.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016353.dll tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016354.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016355.exe tagged as not-a-virus:AdWare.WebRebates.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016356.EXE tagged as not-a-virus:AdWare.WebRebates.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016476.dll infected by "Trojan-Downloader.Win32.IstBar.hf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016478.EXE tagged as not-a-virus:AdWare.WebRebates.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016479.EXE tagged as not-a-virus:AdWare.InstaFinder.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016480.EXE infected by "Trojan-Downloader.NSIS.Gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016482.DLL tagged as not-a-virus:AdWare.F1Organizer.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016483.dll tagged as not-a-virus:AdWare.TotalVelocity.v. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016484.dll tagged as not-a-virus:AdWare.TotalVelocity.ai. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016485.exe tagged as not-a-virus:AdWare.F1Organizer.h. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016486.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP71\A0016487.dll tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP73\A0018557.exe tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP78\A0018918.dll infected by "Trojan-Downloader.Win32.IstBar.hf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP78\A0018921.EXE tagged as not-a-virus:AdWare.InstaFinder.a. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP78\A0018922.EXE infected by "Trojan-Downloader.NSIS.Gen" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP78\A0018964.EXE tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP85\A0019262.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP85\A0019268.exe tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP85\A0019269.exe tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP85\A0019270.exe tagged as not-a-virus:AdWare.MediaMotor.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP86\A0019425.EXE tagged as not-a-virus:AdWare.PowerScan.d. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP86\A0019451.EXE tagged as not-a-virus:AdWare.180Solutions. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP86\A0019459.dll tagged as not-a-virus:AdWare.ToolBar.YourSiteBar.c. No Action Taken.
File C:\System Volume Information\_restore{931A5F32-3146-4458-AC94-77DCD040EF35}\RP88\A0019588.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\newpop446.exe tagged as not-a-virus:AdWare.MediaMotor.e. No Action Taken.
File C:\WINDOWS\system32\dun.exe tagged as not-a-virus:AdWare.DealHelper.x. No Action Taken.
File C:\WINDOWS\unstall.exe tagged as not-a-virus:AdWare.MediaMotor.c. No Action Taken.
Avatar billede stign Nybegynder
01. april 2005 - 20:40 #5
....og den kommer her:

Logfile of HijackThis v1.99.1
Scan saved at 20:39:48, on 01-04-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
C:\WINDOWS\System32\NVAREM.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\BRMFRSMG.EXE
C:\WINDOWS\System32\x10nets.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE
C:\Documents and Settings\Stig & Soren\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WINSCHEDULER] C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] NVAREM.EXE /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://static.35mb.com/applet/applet_y.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\System32\x10nets.exe
Avatar billede arlet Juniormester
01. april 2005 - 21:31 #6
Så er din log ren.

Efter sådan en tur er det altid en god ide og rydde op i dine systemgendannelses filerne.
Deaktiver systemgendannelse ( http://www.arlet.dk/systemgendannelsen.htm ) - genstart din computer - aktiver systemgendannelse.
Og så skal du også lige skjule dine filer og mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil.
Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

Meget vigtigt:
Hent og installer Sp1 eller Sp2 til Windows og IE her:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester