Kunne stadig ikke få avenger til at fungere.
Her er en VBG tekst og en frisk Hijackthislog.
Logfile of HijackThis v1.99.1
Scan saved at 19:53:25, on 15-03-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\standard\Lokale indstillinger\Temp\Midlertidig mappe 8 for hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.signon.stofanet.dk/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - C:\WINDOWS\system32\ursrp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel -
res://c:\PROGRA~1\MICROS~2\OFFICE10\EXCEL.EXE/3000O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ursrp - C:\WINDOWS\SYSTEM32\ursrp.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
[03/15/2006, 19:39:23] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\standard\Skrivebord\VirtumundoBeGone.exe" )
[03/15/2006, 19:39:34] - Detected System Information:
[03/15/2006, 19:39:34] - Windows Version: 5.1.2600, Service Pack 1
[03/15/2006, 19:39:34] - Current Username: standard (Admin)
[03/15/2006, 19:39:34] - Windows is in NORMAL mode.
[03/15/2006, 19:39:34] - Searching for Browser Helper Objects:
[03/15/2006, 19:39:34] - BHO 1: {20D57A66-F7DF-467d-907B-9B7F4A118AB7} ()
[03/15/2006, 19:39:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/15/2006, 19:39:34] - Checking for HKLM\...\Winlogon\Notify\ursrp
[03/15/2006, 19:39:34] - Found: HKLM\...\Winlogon\Notify\ursrp - This is probably Virtumundo.
[03/15/2006, 19:39:34] - Assigning {20D57A66-F7DF-467d-907B-9B7F4A118AB7} MSEvents Object
[03/15/2006, 19:39:34] - BHO list has been changed! Starting over...
[03/15/2006, 19:39:34] - BHO 1: {20D57A66-F7DF-467d-907B-9B7F4A118AB7} (MSEvents Object)
[03/15/2006, 19:39:34] - ALERT: Found MSEvents Object!
[03/15/2006, 19:39:34] - Finished Searching Browser Helper Objects
[03/15/2006, 19:39:34] - *** Detected MSEvents Object
[03/15/2006, 19:39:34] - Trying to remove MSEvents Object...
[03/15/2006, 19:39:35] - Terminating Process: IEXPLORE.EXE
[03/15/2006, 19:39:35] - Terminating Process: RUNDLL32.EXE
[03/15/2006, 19:39:35] - Disabling Automatic Shell Restart
[03/15/2006, 19:39:35] - Terminating Process: EXPLORER.EXE
[03/15/2006, 19:39:36] - Suspending the NT Session Manager System Service
[03/15/2006, 19:39:36] - Terminating Windows NT Logon/Logoff Manager
[03/15/2006, 19:39:36] - Re-enabling Automatic Shell Restart
[03/15/2006, 19:39:36] - File to disable: C:\WINDOWS\system32\ursrp.dll
[03/15/2006, 19:39:36] - Renaming C:\WINDOWS\system32\ursrp.dll -> C:\WINDOWS\system32\ursrp.dll.vir
[03/15/2006, 19:39:36] - ! File rename was unsucessful.
[03/15/2006, 19:39:36] - Attempting to Deny Access to C:\WINDOWS\system32\ursrp.dll
[03/15/2006, 19:39:36] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[03/15/2006, 19:39:36] - ERROR: Der blev ikke udført nogen afbildning mellem kontonavne og sikkerheds-id.
[03/15/2006, 19:39:36] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[03/15/2006, 19:39:36] - Removing HKLM\...\Browser Helper Objects\{20D57A66-F7DF-467d-907B-9B7F4A118AB7}
[03/15/2006, 19:39:36] - Removing HKCR\CLSID\{20D57A66-F7DF-467d-907B-9B7F4A118AB7}
[03/15/2006, 19:39:36] - Adding Kill Bit for ActiveX for GUID: {20D57A66-F7DF-467d-907B-9B7F4A118AB7}
[03/15/2006, 19:39:36] - Deleting ATLEvents/MSEvents Registry entries
[03/15/2006, 19:39:36] - Removing HKLM\...\Winlogon\Notify\ursrp
[03/15/2006, 19:39:36] - Searching for Browser Helper Objects:
[03/15/2006, 19:39:36] - BHO 1: {20D57A66-F7DF-467d-907B-9B7F4A118AB7} ()
[03/15/2006, 19:39:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/15/2006, 19:39:36] - No filename found. Continuing.
[03/15/2006, 19:39:36] - Finished Searching Browser Helper Objects
[03/15/2006, 19:39:36] - Finishing up...
[03/15/2006, 19:39:36] - A restart is needed.
[03/15/2006, 19:39:48] - Attempting to Restart via STOP error (Blue Screen!)
[03/15/2006, 19:41:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\standard\Skrivebord\VirtumundoBeGone.exe" )
[03/15/2006, 19:41:48] - User choose NOT to continue. Exiting...
Det var så det. hej og tak
Ny bruger
Nybegynder
Opret
Preview
