CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg

Log ind eller opret profil

Du kan også logge ind via nedenstående tjenester

thomas69 Nybegynder

12. august 2006 - 12:34 Der er 7 kommentarer og
2 løsninger

Hjælp til Hijackthis Log

Hejsa.
Først en mega kanon fed side der bliver holdt her. Det er da utroligt SÅ meget hjælp man kan få. Tak skal i have.

Mit problem er flg:

Har fået nogen mæekelige "virus warnings - hjælpe programmer - osv" men self. er der INTET af det som hjælper. Ved godt, at det er nogen "snyde" programmer :) Og jeg ved faktisk ikke helt hvordan jeg har fået dem i første omgang??.
Nåmen jeg har DL og kørt SUPERAntiSpyware - Dr.Web - HiJackThis, og de fandt da også en del. Jeg har nu gjort som jeg har læst mig frem til og vil gerne have hjælp til loggen her.

På forhånd tak.

Logfile of HijackThis v1.99.1
Scan saved at 12:23:25, on 12-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programmer\Windows Defender\MSASCui.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Installeret\Tweak-XP Pro\popup.exe
C:\Installeret\Tweak-XP Pro\AdBlocker.exe
C:\Programmer\Logitech\SetPoint\SetPoint.exe
C:\Programmer\Fælles filer\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Skrivebord\Download\Anti & spyprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.danskespil.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.danskespil.dk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Spillekrogens Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2E990487-A960-4D16-AFF8-72642DD70511} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmer\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Pop-Up-Blocker] "C:\Installeret\Tweak-XP Pro\popup.exe"
O4 - HKCU\..\Run: [BlockAds] "C:\Installeret\Tweak-XP Pro\AdBlocker.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmer\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programmer\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrkp32 - winrkp32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
mirc.#xe C:\Download\mIRC Program.mIRC.612 Renamed.
mirc.#xe C:\mIRC Program.mIRC.617 Renamed.
A0019430.#ll C:\System Volume Information\_restore{7FD72997-4A4D-4F38-9F6C-CC7ED642FD63}\RP156 Adware.FastSearch Renamed.
A0021978.#xe C:\System Volume Information\_restore{7FD72997-4A4D-4F38-9F6C-CC7ED642FD63}\RP172 Program.mIRC.612 Renamed.
SUPERAntiSpyware Scan Log
Generated 08/12/2006 at 12:14 PM

Core Rules Database Version : 3047
Trace Rules Database Version: 1097

Memory threats detected : 1
Registry threats detected : 39
File threats detected : 14

Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\MLLJK.DLL
C:\WINDOWS\SYSTEM32\MLLJK.DLL
HKLM\Software\Classes\CLSID\{2E990487-A960-4D16-AFF8-72642DD70511}
HKCR\CLSID\{2E990487-A960-4D16-AFF8-72642DD70511}
HKCR\CLSID\{2E990487-A960-4D16-AFF8-72642DD70511}\InprocServer32
HKCR\CLSID\{2E990487-A960-4D16-AFF8-72642DD70511}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E990487-A960-4D16-AFF8-72642DD70511}
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\mlljk

Browser Hijacker.BestSafetyGuide
HKLM\Software\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}
HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}\InprocServer32
HKCR\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4}\InprocServer32#ThreadingModel
C:\WINDOWS\system32\ixt0.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4}

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\thomas munkø@indexstats[1].txt
C:\Documents and Settings\Administrator\Cookies\thomas munkø@www.winantivirus[1].txt
C:\Documents and Settings\Administrator\Cookies\thomas munkø@stats1.reliablestats[1].txt
C:\Documents and Settings\Administrator\Cookies\thomas munkø@ad1.emediate[1].txt
C:\Documents and Settings\Administrator\Cookies\thomas munkø@dk.winantivirus[2].txt
C:\Documents and Settings\Administrator\Cookies\thomas munkø@winantivirus[1].txt

Trojan.WinAntiSpyware/WinAntiVirus 2006
C:\WINDOWS\system32\stera.job

Trojan.Security Toolbar
C:\Documents and Settings\Administrator\Foretrukne\Antivirus Test Online.url

Trojan.AtmClk
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#kernel32.dll [ C:\WINDOWS\system32\isnotify.exe ]

Malware.Notifier
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#ishost.exe [ ishost.exe ]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#issearch.exe [ issearch.exe ]
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\Prefetch\ISNOTIFY.EXE-2D5DE1A8.pf

Malware.AntiVirusGolden
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\CNihdgl
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Control
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\doFqRkrAyn
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\ftruhmJbBbmxj
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\InprocServer32
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\InprocServer32#ThreadingModel
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\MiscStatus
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\MiscStatus\1
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\ProgID
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Programmable
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\qSGdcA
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\ToolboxBitmap32
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\TypeLib
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\Version
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\VersionIndependentProgID
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\xczgjsdCTdipr
HKCR\CLSID\{C65C3770-598C-A2FD-DBAA-C7A45C50338E}\xoqxpqvXwL

Trojan.Malware
C:\Documents and Settings\Administrator\Skrivebord\Download\Anti & spyprogrammer\mw_install.exe

Trojan.Unknown Origin
C:\WINDOWS\system32\ot.ico

Dette er en kombitation af Dr.Web - SUPERAntiSpyware & HiJackThis.

Og lige PT. ser min PCèr ud til, at virke, for der er ikke noget der popper op eller noget.

Igen tusind tak for hjælpen.
Da jeg er ny her ved jeg ikke hvor mange point jeg skal give så er 100 nok????

Mvh Thomas

Synes godt om

forevernewbie Nybegynder

12. august 2006 - 14:12 #1

Vi rydder lige lidt op:

Kør en scanning med HijackThis, så du kan se alle filer. Luk alle vinduer, sæt flueben ved disse linier, og klik fix checked.

O2 - BHO: (no name) - {2E990487-A960-4D16-AFF8-72642DD70511} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O20 - Winlogon Notify: winrkp32 - winrkp32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)

Scannerne har gjort jobbet, men for en sikkerheds skyld, så kør lige dette fix igennem.

Hent og dobbeltklik på smitRem.exe

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

Programmet pakker sig ud til mappen smitRem.

Genstart i fejlsikret (tast f8 flere gange under opstart). Hvis du ikke kan, så kig her:

http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=110&PN=1

Åbn mappen smitRem, og dobbeltklik på RunThis.bat (Følg vejledningen i vinduet.)

Find smitfiles.txt via Start/Søg, og kopier den her ind.

Synes godt om

thomas69 Nybegynder

12. august 2006 - 15:00 #2

Hmmm når jeg skal til at DL det program siger den at den er fyldt med malware osv og kan derfor ikke DL det????

Mvh Thomas

Synes godt om

thomas69 Nybegynder

12. august 2006 - 15:24 #3

Ok fik det til og virke, jeg slog mit antivirus fra.
Det er kørt nu og ser sådan ud...

smitRem © log file
version 3.1

by noahdfear

Microsoft Windows XP [version 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\Administrator\Skrivebord\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key

WinHound.com key not present!

checking for drsmartload2 key

drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 892 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN! :)

Og ellers tak for hjælpen.... ser godt ud indtil videre..
Mvh Thomas

Synes godt om

forevernewbie Nybegynder

12. august 2006 - 16:00 #4

Den nuppede lige det sidste, så det ser fint ud.

Kom lige med en frisk Hijackthis, så jeg kan se om det hele er væk i loggen

Synes godt om

thomas69 Nybegynder

12. august 2006 - 16:39 #5

Hej igen.

Her er min hijack.

Logfile of HijackThis v1.99.1
Scan saved at 16:40:57, on 12-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Programmer\Windows Defender\MSASCui.exe
C:\Programmer\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Installeret\Tweak-XP Pro\popup.exe
C:\Installeret\Tweak-XP Pro\AdBlocker.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Skrivebord\Download\Anti & spyprogrammer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.danskespil.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.danskespil.dk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Spillekrogens Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmer\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Pop-Up-Blocker] "C:\Installeret\Tweak-XP Pro\popup.exe"
O4 - HKCU\..\Run: [BlockAds] "C:\Installeret\Tweak-XP Pro\AdBlocker.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmer\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programmer\google\GoogleToolbar1.dll/cmtrans.html
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe

mvh Thomas

Synes godt om

forevernewbie Nybegynder

12. august 2006 - 18:32 #6

Det ser godt ud. Så er din log ren.

Efter et virus/spyware angreb, er det altid en god ide at rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.

Hent ATF Cleaner her fra http://www.atribune.org/content/view/19/2/

Start ATF Cleaner. Sæt flueben i "Select all" (du kan undlade cookies, hvis du vil). Klik "Empty selected".

Link til sikring af din computer http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Synes godt om

thomas69 Nybegynder

13. august 2006 - 20:49 #7

Kanon, tusind tak for din prof. hjælp.... Det er sgu service.

Mvh Thomas

Synes godt om

forevernewbie Nybegynder

13. august 2006 - 22:41 #8

Velbekomme :)

Du kan lukke spørgsmålet ved at markere mit brugernavn og klikke accepter

Synes godt om

forevernewbie Nybegynder

15. august 2006 - 18:34 #9

Tak for point

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
Findes der mon et Antivirus program, som ikke, konstant, reklamerer, for at købe ? Af Ikke-ekspert i Virus	21	22/06/202419:22	23/06/202412:54
Anbefaling af antivirusprogram med firewall Af OnePlusFan i Virus	23	07/05/202421:02	13/05/202419:48
trusler Af gerhardpet i Virus	4	26/01/202410:02	27/01/202408:32
Kan ikke fjerne virus Af mik28 i Virus	16	09/01/202416:37	10/01/202419:59
virusscanning Af JetteD i Virus	2	10/11/202312:55	10/11/202316:36

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS