Avatar billede nicebabe Nybegynder
31. august 2006 - 17:48 Der er 6 kommentarer og
1 løsning

hijack this log?

hej,
der dukker hele tiden en hjemmeside op der har adressen:
http://dk.errorsafe.com/download/2006/index.php?aid=valu2002_dk_da_lng_ed2&lid=intl&ex=1&ax=1

jeg har scannet min computer, men selvom at jeg sletter den, bliver den alligevel ved med at dukke op.

min hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 17:44:59, on 31-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Canon\CAL\CALMAIN.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmer\ASUS\ASUS Live Update\ALU.exe
C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe
C:\Programmer\Wireless Console 2\wcourier.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jenny Trinh\Dokumenter\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tv2.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Programmer\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Programmer\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Wireless Console 2] C:\Programmer\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "c:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmer\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google-søgning - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Oversæt engelsk ord - res://C:\Programmer\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Programmer\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Lignende sider - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Tilbage via links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Programmer\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Programmer\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Programmer\Yahoo!\Common/ycsms.htm
O8 - Extra context menu item: Øjebliksbillede af side i cache - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Programmer\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programmer\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programmer\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmer\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148242933828
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Programmer\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Programmer\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe

Håber I kan hjælpe.
mvh
jenny
Avatar billede levich Nybegynder
31. august 2006 - 17:57 #1
øjeblik, så ser jeg på loggen.
Avatar billede levich Nybegynder
31. august 2006 - 18:08 #2
Jeg kan ikke se noget i loggen, men prøv dette:

Hent http://www.spywarefri.dk/vaerktoj.htm#spybot (Spybot).
Start programmet og opdater.

Opdater Ewido, som jeg kan se du allerede har installeret.

Genstart computeren i fejlsikret tilstand.

Scan med spybot og slet linjerne med rød tekst.

Scan med ewido og gem loggen.

Genstart computeren normalt og smid loggen har Ewido herind.
Avatar billede levich Nybegynder
31. august 2006 - 18:09 #3
... nå ja, mens du er i fejlsikret tilstand, så tag lige og scan computeren med AntiVir også.
Avatar billede nicebabe Nybegynder
31. august 2006 - 22:51 #4
mange tak for dine råd :) jeg er nu blevet færdig med at scanne og min log fra ewido ser således ud:

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            22:42:03, 31-08-2006
+ Rapport-Checksum:        BADB1A84

+ Scanningsresultat:
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@adtech[1].txt -> TrackingCookie.Adtech : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@vdn.valuead[2].txt -> TrackingCookie.Valuead : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@statcounter[2].txt -> TrackingCookie.Statcounter : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@www.etracker[1].txt -> TrackingCookie.Etracker : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@image.masterstats[1].txt -> TrackingCookie.Masterstats : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@www.burstnet[1].txt -> TrackingCookie.Burstnet : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@com[2].txt -> TrackingCookie.Com : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@citi.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@overture[2].txt -> TrackingCookie.Overture : Renset med backup
    C:\Documents and Settings\Jenny Trinh\Cookies\jenny trinh@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Renset med backup


::Rapport slut
Avatar billede levich Nybegynder
31. august 2006 - 23:10 #5
Ewido-loggen viser at der ikke er noget kritisk.
Hvordan kører computeren nu?
Avatar billede nicebabe Nybegynder
01. september 2006 - 11:44 #6
den kører fint :) mange tak for hjælpen. opret et svar, så giver jeg dig points ^^
Avatar billede levich Nybegynder
01. september 2006 - 13:14 #7
svar
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester