Avatar billede ingi76 Nybegynder
11. april 2005 - 22:36 Der er 5 kommentarer og
1 løsning

Hijack this log, venligst hjælp

Her er loggen, hvis i gider at kigge på og sige til hvad jeg skal gøre, på forhånd tak:

Logfile of HijackThis v1.99.1
Scan saved at 20:23:55, on 11.4.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVG7avgamsvr.exe
C:PROGRA~1GrisoftAVG7avgupsvc.exe
C:WINDOWSSystem32cisvc.exe
C:WINDOWSSystem32HPConfig.exe
C:WINDOWSSystem32igfxtray.exe
C:WINDOWSSystem32hkcmd.exe
C:WINDOWSessspk.exe
C:Program FilesHewlett-PackardHP Display Settingshpdisply.exe
C:Program FilesSynapticsSynTPSynTPLpr.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:PROGRA~1HPONE-~1OneTouch.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesiTunesiTunesHelper.exe
C:PROGRA~1GrisoftAVG7avgcc.exe
C:Program FilesMedia AccessMediaAccK.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:WINDOWSSystem32MSOICONS.EXE
C:WINDOWSSystem32wtta.exe
C:Program FilesMedia AccessMediaAccess.exe
C:Program FilesiPodbiniPodService.exe
C:WINDOWSSystem32wuauclt.exe
C:WINDOWSsystem32m?dtc.exe
C:WINDOWSSystem32cidaemon.exe
C:Documents and SettingsHeiðaLocal SettingsTempTemporary Directory 1 for hijackthis[1].zipHijackThis.exe
C:Program FilesInternet Exploreriexplore.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.leit.is/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.hp.com/notebooks/pavilion/home
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = proxy.hi.is:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 - BHO: (no name) - {09F34884-DA63-DCE2-4336-DE38723B96CB} - C:WINDOWSSystem32jolbo.dll
O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:Program FilesShopperReportsBin1.0.0.1SmrtShpr.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesMSN AppsMSN Toolbar1.02.2001.0001en-usmsntb.dll
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:Program FilesISTbaristbarcm.dll (file missing)
O4 - HKLM..Run: [IgfxTray] C:WINDOWSSystem32igfxtray.exe
O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe
O4 - HKLM..Run: [EssSpkPhone] essspk.exe
O4 - HKLM..Run: [HP Display Settings] C:Program FilesHewlett-PackardHP Display Settingshpdisply.exe /s
O4 - HKLM..Run: [SynTPLpr] C:Program FilesSynapticsSynTPSynTPLpr.exe
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [CP4HPOT] C:PROGRA~1HPONE-~1OneTouch.EXE
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] C:Program FilesiTunesiTunesHelper.exe
O4 - HKLM..Run: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKLM..Run: [ap9h4qmo] C:WINDOWSSystem32ap9h4qmo.exe
O4 - HKLM..Run: [MrX7] C:WINDOWSraukwsbu.exe
O4 - HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP
O4 - HKLM..Run: [Media Access] C:Program FilesMedia AccessMediaAccK.exe
O4 - HKLM..RunServices: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - HKCU..Run: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKCU..Run: [rzwf] C:PROGRA~1COMMON~1rzwfrzwfm.exe
O4 - HKCU..Run: [Notn] C:WINDOWSSystem32wtta.exe
O4 - HKCU..Run: [Jofqg] C:WINDOWSSystem32m?dtc.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE
O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com/notebooks/pavilion/home
O15 - Trusted Zone: http://www.einkamal.is
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c6.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/website.ocx
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=3655
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C7B05B62-C8D7-438C-840B-4994DAAA8EEE} - http://webpdp.gator.com/4/download/pdpplugin_5094_bundle3v0p10.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVG7avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVG7avgupsvc.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:WINDOWSSystem32HPConfig.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:Program FilesiPodbiniPodService.exe
O23 - Service: ZESOFT - Unknown owner - C:WINDOWSzeta.exe (file missing)
Avatar billede kalp Novice
11. april 2005 - 22:38 #1
ser på den
Avatar billede kalp Novice
11. april 2005 - 22:47 #2
Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.

Afinstaller disse mapper eller slet dem

C:Program Files\Media Access\
C:Program Files\ISTsvc

Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelt tjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

O2 - BHO: (no name) - {09F34884-DA63-DCE2-4336-DE38723B96CB} - C:WINDOWSSystem32jolbo.dll
O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:Program FilesShopperReportsBin1.0.0.1SmrtShpr.dll (file missing)
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:Program FilesISTbaristbarcm.dll (file missing)
O4 - HKLM..Run: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKLM..Run: [ap9h4qmo] C:WINDOWSSystem32ap9h4qmo.exe
O4 - HKLM..Run: [MrX7] C:WINDOWSraukwsbu.exe
O4 - HKLM..Run: [IST Service] C:Program FilesISTsvcistsvc.exe
O4 - HKLM..Run: [Media Access] C:Program FilesMedia AccessMediaAccK.exe
O4 - HKLM..RunServices: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKCU..Run: [Microsoft Update Machine] MSOICONS.EXE
O4 - HKCU..Run: [rzwf] C:PROGRA~1COMMON~1rzwfrzwfm.exe
O4 - HKCU..Run: [Notn] C:WINDOWSSystem32wtta.exe
O4 - HKCU..Run: [Jofqg] C:WINDOWSSystem32m?dtc.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c6.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/website.ocx
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=3655
O23 - Service: ZESOFT - Unknown owner - C:WINDOWSzeta.exe (file missing)

Denne skal fikses hvis ikke du kender den... for det meste er de okay.
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = proxy.hi.is:8080

Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Find og slet (Kig godt efter!!.. Det du ikke finder har hijackthis nok fjernet!)

Filerne

C:WINDOWS\System32\MSOICONS.EXE
C:WINDOWS\System32\wtta.exe
C:WINDOWS\System32\m?dtc.exe
C:WINDOWS\System32\jolbo.dll

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Genstart normalt og kopir en ny log herind så jeg kan se om vi fik ramt på det hele eller om noget er blevet overset:)
Avatar billede ingi76 Nybegynder
12. april 2005 - 02:09 #3
ok her kommer er fersk log nu:

Logfile of HijackThis v1.99.1
Scan saved at 00:04:09, on 12.4.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVG7avgamsvr.exe
C:PROGRA~1GrisoftAVG7avgupsvc.exe
C:WINDOWSSystem32cisvc.exe
C:WINDOWSSystem32HPConfig.exe
C:WINDOWSSystem32igfxtray.exe
C:WINDOWSSystem32hkcmd.exe
C:WINDOWSessspk.exe
C:Program FilesHewlett-PackardHP Display Settingshpdisply.exe
C:Program FilesSynapticsSynTPSynTPLpr.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:PROGRA~1HPONE-~1OneTouch.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesiTunesiTunesHelper.exe
C:PROGRA~1GrisoftAVG7avgcc.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesiPodbiniPodService.exe
C:WINDOWSSystem32wuauclt.exe
C:Documents and SettingsHeiðaLocal SettingsTempTemporary Directory 2 for hijackthis.zipHijackThis.exe
C:WINDOWSSystem32cidaemon.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.leit.is/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.hp.com/notebooks/pavilion/home
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = proxy.hi.is:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesMSN AppsMSN Toolbar1.02.2001.0001en-usmsntb.dll
O4 - HKLM..Run: [IgfxTray] C:WINDOWSSystem32igfxtray.exe
O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe
O4 - HKLM..Run: [EssSpkPhone] essspk.exe
O4 - HKLM..Run: [HP Display Settings] C:Program FilesHewlett-PackardHP Display Settingshpdisply.exe /s
O4 - HKLM..Run: [SynTPLpr] C:Program FilesSynapticsSynTPSynTPLpr.exe
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [CP4HPOT] C:PROGRA~1HPONE-~1OneTouch.EXE
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] C:Program FilesiTunesiTunesHelper.exe
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE
O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com/notebooks/pavilion/home
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C7B05B62-C8D7-438C-840B-4994DAAA8EEE} - http://webpdp.gator.com/4/download/pdpplugin_5094_bundle3v0p10.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVG7avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVG7avgupsvc.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:WINDOWSSystem32HPConfig.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:Program FilesiPodbiniPodService.exe

er den god nok??
Avatar billede kalp Novice
12. april 2005 - 09:29 #4
den er ren ja
Avatar billede ingi76 Nybegynder
12. april 2005 - 16:30 #5
Jeg siger tusind tak for hjælpen Kalp, og du har selvfælig fået de 60 point for din hjælp og gode service.

Med Venlig Hilsen
Ingi
Avatar billede kalp Novice
12. april 2005 - 19:19 #6
Selv tak:))
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester