log fra hijacker
Antal indlæg: 25

en log til gennemsyn….....

Logfile of HijackThis v1.98.2
Scan saved at 23:37:47, on 04-02-05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:/WINDOWS/SYSTEM/KERNEL32.DLL
C:/WINDOWS/SYSTEM/MSGSRV32.EXE
C:/WINDOWS/SYSTEM/MPREXE.EXE
C:/WINDOWS/SYSTEM/mmtask.tsk
C:/WINDOWS/SYSTEM/MSTASK.EXE
C:/WINDOWS/SYSTEM/MDM.EXE
C:/PROGRAMMER/NORTON INTERNET SECURITY/NISSERV.EXE
C:/PROGRAMMER/NORTON INTERNET SECURITY/NISUM.EXE
C:/PROGRAMMER/NORTON INTERNET SECURITY/SYMPROXYSVC.EXE
C:/WINDOWS/SYSTEM/SYSTRAY.EXE
C:/PROGRAM FILES/DIRECTCD/DIRECTCD.EXE
C:/PROGRAMMER/REAL/REALPLAYER/REALPLAY.EXE
C:/WINDOWS/SYSTEM/LVCOMS.EXE
C:/WINDOWS/SYSTEM/STIMON.EXE
C:/WINDOWS/SYSTEM/USBMONIT.EXE
C:/PROGRAMMER/NORTON ANTIVIRUS/NAVAPW32.EXE
C:/PROGRAMMER/NORTON INTERNET SECURITY/IAMAPP.EXE
C:/PROGRAMMER/ICQ/ICQNET.EXE
C:/PROGRAMMER/MSN MESSENGER/MSNMSGR.EXE
C:/PROGRAMMER/WINDOWS MEDIA COMPONENTS/ENCODER/WMENCAGT.EXE
C:/PROGRAMMER/WINZIP/WZQKPICK.EXE
C:/WINDOWS/SYSTEM/DDHELP.EXE
C:/WINDOWS/SYSTEM/WMIEXE.EXE
C:/WINDOWS/SYSTEM/PSTORES.EXE
C:/WINDOWS/SYSTEM/SPOOL32.EXE
C:/WINDOWS/EXPLORER.EXE
C:/WINDOWS/SKRIVEBORD/HIJACKER/HIJACKTHIS.EXE

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Programmer/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Programmer/Norton AntiVirus/NavShExt.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX
O3 - Toolbar: &Yahoo;! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:/PROGRAMMER/YAHOO!/COMPANION/INSTALLS/CPN/YCOMP5_5_7_0.DLL
O4 - HKLM/../Run: [SystemTray] SysTray.Exe
O4 - HKLM/../Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM/../Run: [Adaptec DirectCD] C:/Program Files/DirectCD/DIRECTCD.EXE
O4 - HKLM/../Run: [RealTray] C:/Programmer/Real/RealPlayer/RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM/../Run: [LVComs] c:/windows/SYSTEM/LVComS.exe
O4 - HKLM/../Run: [StillImageMonitor] C:/WINDOWS/SYSTEM/STIMON.EXE
O4 - HKLM/../Run: [Gene USB Monitor] c:/windows/SYSTEM/USBMonit.exe
O4 - HKLM/../Run: [NAV Agent] C:/PROGRA~1/NORTON~1/NAVAPW32.EXE
O4 - HKLM/../Run: [iamapp] C:/Programmer/Norton Internet Security/IAMAPP.EXE
O4 - HKLM/../Run: [Norton Auto-Protect] C:/PROGRA~1/NORTON~1/NAVAPW32.EXE /LOADQUIET
O4 - HKLM/../Run: [Mirabilis ICQ] C:/PROGRA~1/ICQ/ICQNet.exe
O4 - HKLM/../Run: [MiniPortRt] C:/WINDOWS/SYSTEM/MINIPORT_MP.EXE
O4 - HKLM/../RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM/../RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM/../RunServices: [Planlægningsagent] c:/windows/SYSTEM/mstask.exe
O4 - HKLM/../RunServices: [Machine Debug Manager] C:/WINDOWS/SYSTEM/MDM.EXE
O4 - HKLM/../RunServices: [ScriptBlocking] “C:/Programmer/Fælles filer/Symantec Shared/Script Blocking/SBServ.exe” -reg
O4 - HKLM/../RunServices: [nisserv] C:/Programmer/Norton Internet Security/NISSERV.EXE
O4 - HKCU/../Run: [MsnMsgr] “c:/Programmer/MSN Messenger/MsnMsgr.Exe” /background
O4 - HKCU/../Run: [Skype] “C:/PROGRAMMER/SKYPE/PHONE/SKYPE.EXE” /nosplash /minimized
O4 - HKCU/../Run: [Eyeball Chat] “C:/PROGRAMMER/EYEBALL/EYEBALL CHAT/EYEBALLCHAT.EXE” -min
O4 - Startup: Microsoft Office.lnk = C:/Programmer/Microsoft Office/Office/OSA9.EXE
O4 - Startup: Encoder Agent.lnk = C:/Programmer/Windows Media Components/Encoder/WMENCAGT.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:/Programmer/WinZip/WZQKPICK.EXE
O8 - Extra context menu item: &Yahoo;! Search - file:///C:/Programmer/Yahoo!/Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:/Programmer/Yahoo!/Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:/Programmer/Yahoo!/Common/ycdict.htm
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:/PROGRA~1/ICQ/ICQ.exe
O9 - Extra ‘Tools’ menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:/PROGRA~1/ICQ/ICQ.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:/PROGRAMMER/YAHOO!/MESSENGER/YHEXBMES0521.DLL
O9 - Extra ‘Tools’ menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:/PROGRAMMER/YAHOO!/MESSENGER/YHEXBMES0521.DLL
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

Redaktør
Antal indlæg: 4429

Hej hansehen smile

Hent lige en nyere version af HiJackThis og brug den efterfølgende.
http://www.spywarefri.dk/vaerktoj.htm

Jeg kunne kun finde en enkelt linie i loggen som ikke var helt ren.

Genstart pc’en i fejlsikret tilstand. Klik F8 under opstart.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.

O4 - HKLM/../Run: [MiniPortRt] C:/WINDOWS/SYSTEM/MINIPORT_MP.EXE

———————————————————-
Sletning af filer og mapper:
—————————-
Mapper:
<ingen>

Filer:
C:/WINDOWS/SYSTEM/MINIPORT_MP.EXE

Genstart normalt og kom med en ny log til kontrol