tak for hjælpen...her er der nye hijack
Logfile of HijackThis v1.99.1
Scan saved at 00:26:57, on 25-09-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Programmer\Sygate\SPF\smc.exe
F:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\System32\igfxtray.exe
F:\WINDOWS\System32\hkcmd.exe
F:\Programmer\iTunes\iTunesHelper.exe
F:\Programmer\QuickTime\qttask.exe
F:\Programmer\DAEMON Tools\daemon.exe
F:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
F:\Programmer\Creative\SBLive2k\Launcher\CTLauncher.exe
F:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
F:\Programmer\Creative\SBLive2k\Program\CTAvTray.EXE
F:\PROGRA~1\PRINTV~1\pvmodule.exe
F:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
F:\WINDOWS\system32\devldr32.exe
F:\Programmer\MSN Messenger\MsnMsgr.Exe
F:\Programmer\Messenger\msmsgs.exe
F:\Programmer\Creative\SBLive2k\Launcher\TaskGuide\updtray.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Programmer\ewido\security suite\ewidoctrl.exe
F:\Programmer\ewido\security suite\ewidoguard.exe
F:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\mdm.exe
F:\Programmer\Norton AntiVirus\navapsvc.exe
F:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
F:\WINDOWS\system32\spupdsvc.exe
F:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\MsPMSPSv.exe
F:\Programmer\Canon\CAL\CALMAIN.exe
F:\Programmer\iPod\bin\iPodService.exe
F:\WINDOWS\system32\spnpinst.exe
F:\WINDOWS\system32\Sysocmgr.exe
F:\Programmer\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\system32\wscntfy.exe
G:\Download\Programmer\hjt.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.dk/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://g.msn.dk/0SEDADK/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {17F22F6E-BEDB-453A-BC3E-2D7B7CBF6411} - F:\WINDOWS\system32\ddabb.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - F:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - F:\WINDOWS\system32\wupnwshf.dll (file missing)
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Programmer\Norton AntiVirus\NavShExt.dll
O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - F:\PROGRA~1\PRINTV~1\PRINTH~1.DLL
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] F:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] F:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "F:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Disc Detector] F:\Creative\ShareDLL\ctnotify.exe
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [Creative Launcher] F:\Programmer\Creative\SBLive2k\Launcher\CTLauncher.exe
O4 - HKLM\..\Run: [AudioHQ] F:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [NewsUpd] F:\Programmer\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [CTAvTray] F:\Programmer\Creative\SBLive2k\Program\CTAvTray.EXE
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PVModule] F:\PROGRA~1\PRINTV~1\pvmodule.exe
O4 - HKLM\..\Run: [ccApp] F:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] F:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Advanced Tools Check] F:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Anti Trojan Elite] F:\Programmer\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\RunOnce: [CTAVTray] F:\Programmer\Creative\SBLive2k\Program\CTAvStub.EXE EAX.AVI
O4 - HKCU\..\Run: [MsnMsgr] "F:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "F:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = F:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &MSN Search -
res://F:\Programmer\MSN Toolbar Suite\TB\02.05.0000.1105\da-dk\msntb.dll/search.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel -
res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: E&xport to Microsoft Excel -
res://F:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000O8 - Extra context menu item: Åbn på ny baggrundsfane -
res://F:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/229?2061e14f5c2141909944fcbed638a920
O8 - Extra context menu item: Åbn på ny forgrundsfane -
res://F:\Programmer\MSN Toolbar Suite\TAB\02.05.0000.1105\da-dk\msntabres.dll/230?2061e14f5c2141909944fcbed638a920
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154339980578O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - F:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: wingdm32 - wingdm32.dll (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Programmer\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - F:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - F:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - F:\Programmer\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - F:\Programmer\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
og indholdet af F:\vundofix.txt
VundoFix V6.1.6
Checking Java version...
Sun Java not detected
Scan started at 23:00:21 24-09-2006
Listing files found while scanning....
F:\WINDOWS\system32\awvvu.dll
F:\WINDOWS\system32\uvvwa.ini
F:\WINDOWS\system32\ddabb.dll
F:\WINDOWS\system32\bbadd.ini
F:\WINDOWS\system32\bbadd.bak1
F:\WINDOWS\system32\bbadd.bak2
F:\Programmer\Fælles filer\{1C5220F7-0A27-1030-0826-04122920002d}\services.dll
Beginning removal...
Attempting to delete F:\WINDOWS\system32\awvvu.dll
F:\WINDOWS\system32\awvvu.dll Has been deleted!
Attempting to delete F:\WINDOWS\system32\uvvwa.ini
F:\WINDOWS\system32\uvvwa.ini Has been deleted!
Attempting to delete F:\WINDOWS\system32\ddabb.dll
F:\WINDOWS\system32\ddabb.dll Could not be deleted.
Attempting to delete F:\WINDOWS\system32\bbadd.ini
F:\WINDOWS\system32\bbadd.ini Has been deleted!
Attempting to delete F:\WINDOWS\system32\bbadd.bak1
F:\WINDOWS\system32\bbadd.bak1 Has been deleted!
Attempting to delete F:\WINDOWS\system32\bbadd.bak2
F:\WINDOWS\system32\bbadd.bak2 Has been deleted!
Attempting to delete F:\Programmer\Fælles filer\{1C5220F7-0A27-1030-0826-04122920002d}\services.dll
F:\Programmer\Fælles filer\{1C5220F7-0A27-1030-0826-04122920002d}\services.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.1.6
Checking Java version...
Sun Java not detected
Scan started at 00:13:20 25-09-2006
Listing files found while scanning....
F:\WINDOWS\system32\ddabb.dll
Beginning removal...
Attempting to delete F:\WINDOWS\system32\ddabb.dll
F:\WINDOWS\system32\ddabb.dll Has been deleted!
Performing Repairs to the registry.
Done!