Avatar billede ninh Nybegynder
21. maj 2006 - 22:30 Der er 4 kommentarer og
1 løsning

Hijackthis log

Vil I lige kigge min log igennem?

Logfile of HijackThis v1.99.1
Scan saved at 22:20:00, on 21-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE
C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe
C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe
C:\Programmer\USB Storage RW\udsi.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\Support.com\bin\tgcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\Network Associates\VirusScan\mcshield.exe
C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Mette\LOKALE~1\Temp\NAV\NAVSetup.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Documents and Settings\Mette\Lokale indstillinger\Temporary Internet Files\Content.IE5\PAJDDEC2\hijackthis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.amews.dk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [KYE_UDSI] "C:\Programmer\USB Storage RW\udsi.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hcenter] "C:\Programmer\Support.com\bin\tgcmd.exe" /server /startmonitor
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [Jyve] C:\Program Files\Jyve\Jyve\Jyve.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Hurtig start.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - https://netsupport2.tdconline.dk/sdccommon/download/tgctlar.cab
O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} (Support.com SmartIssue) - https://netsupport2.tdconline.dk/sdccommon/download/tgctlsi.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
Avatar billede ejvindh Ekspert
22. maj 2006 - 09:40 #1
Kør Hijackthis, og fix disse 2 linier:

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Hent herefter Ewido herfra (14 dages version af plus-versionen)
http://www.spywarefri.dk/downloads1/ewido-setup.exe
Installer og kør Ewido - opdater programmet.

Hent Dr. Web, og gem det på skrivebordet:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Genstart til fejlsikret tilstand (tryk F8 under opstarten)

Kør en fuld scanning med Ewido. Programmet laver en lille log, som du skal kopiere herind i dit næste svar.

Dobbeltklik på drweb-cureit.exe, den vil køre en expressscan, det siger du ja til.
Når den skriver "Select object for Scanning" nederst til venstre, skal du klikke på Options->Change settings.
Skift til fanebladet Scan, fjern fluebenet ved Heuristic analysis.
Skift til fanebladet Actions, her skal alle punkter under Malware sættes til Rename.
Klik så på OK, for at komme ud til hovedmenuen igen.
Klik så på det eller de drev du vil have scannet, der kommer en rød prik for at vise det/de er valgt.

Klik så på den grønne pil ovre til højre på siden, så starter scanningen.
Første gang Dr.Web finder noget, klik "Yes to All", så fjerner den hvad den finder.
Klik så på Start->Søg, find filen CureIt.log kopier det nederste af teksten herind, startende med:
Scan statistics.
Avatar billede ninh Nybegynder
22. maj 2006 - 19:28 #2
---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            17:52:19, 22-05-2006
+ Rapport-Checksum:        11C4A126

+ Scanningsresultat:
    C:\Documents and Settings\Lise\Cookies\lise@adtech[2].txt -> TrackingCookie.Adtech : Renset med backup
    C:\Documents and Settings\Lise\Cookies\lise@atdmt[2].txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\Lise\Cookies\lise@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Renset med backup
    C:\Documents and Settings\Lise\Cookies\lise@doubleclick[1].txt -> TrackingCookie.Doubleclick : Renset med backup
    C:\Documents and Settings\Lise\Cookies\lise@serving-sys[2].txt -> TrackingCookie.Serving-sys : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@ad.adocean[1].txt -> TrackingCookie.Adocean : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@adtech[2].txt -> TrackingCookie.Adtech : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@advertising[1].txt -> TrackingCookie.Advertising : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@atdmt[2].txt -> TrackingCookie.Atdmt : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@casalemedia[1].txt -> TrackingCookie.Casalemedia : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@com[1].txt -> TrackingCookie.Com : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@data4.perf.overture[1].txt -> TrackingCookie.Overture : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@doubleclick[1].txt -> TrackingCookie.Doubleclick : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@ehg-warnerbrothers.hitbox[2].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@fastclick[2].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@hitbox[1].txt -> TrackingCookie.Hitbox : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@media.fastclick[2].txt -> TrackingCookie.Fastclick : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@mediaplex[1].txt -> TrackingCookie.Mediaplex : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@overture[2].txt -> TrackingCookie.Overture : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@perf.overture[1].txt -> TrackingCookie.Overture : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@qksrv[2].txt -> TrackingCookie.Qksrv : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@reduxads.valuead[2].txt -> TrackingCookie.Valuead : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@sel.as-eu.falkag[2].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@spylog[1].txt -> TrackingCookie.Spylog : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@statcounter[1].txt -> TrackingCookie.Statcounter : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@targetnet[2].txt -> TrackingCookie.Targetnet : Renset med backup
    C:\Documents and Settings\Mette\Cookies\mette@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Renset med backup
    C:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll -> Downloader.Small : Renset med backup


::Rapport slut


Scan statistics

Objects scanned: 209823
Infected objects found: 0
Objects with modifications found: 1
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 1
Objects ignored: 0
Scan speed: 350 Kb/s
Scan time: 01:14:21



Total session statistics

Objects scanned: 210077
Infected objects found: 0
Objects with modifications found: 1
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 1
Objects ignored: 0
Scan speed: 366 Kb/s
Scan time: 01:14:39
Avatar billede ejvindh Ekspert
22. maj 2006 - 20:16 #3
Det ser fornuftigt ud. Har du nogen problemer med computeren, som ikke er blevet løst endnu?
Avatar billede ninh Nybegynder
22. maj 2006 - 20:17 #4
Nej.. det er helt fint nu :D Tak for hjælpen ^^
Avatar billede ejvindh Ekspert
22. maj 2006 - 20:32 #5
Dejligt at høre. Jeg takker for point :-)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester