Spywarefri Forum | Uønsket searchbar (Log)

Uønsket searchbar (Log)

[ Ignorer ] mads79
05.04.2004 01:27:37 Antal indlæg: 9	Kære eksperter, mine forældre får en uønsket (blå) searchbar under den normale adresselinje hver gang de bruger Explorer. Den hedder “livefreesoap” og kan vælges fra manuelt, men dukker alligevel op næste gang. Jeg har kørt ad-aware og spybot. Her er logfilen. Jeg håber, I kan hjælpe. Venligst, Mads Logfile of HijackThis v1.97.7 Scan saved at 23:22:11, on 04-04-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/WINDOWS/system32/spoolsv.exe C:/Programmer/Atguard/iamserv.exe C:/Programmer/Norton AntiVirus/navapsvc.exe C:/Programmer/Norton AntiVirus/AdvTools/NPROTECT.EXE C:/WINDOWS/System32/nvsvc32.exe C:/WINDOWS/System32/svchost.exe C:/WINDOWS/Explorer.EXE C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/PROGRA~1/Atguard/iamapp.exe C:/Programmer/ahead/InCD/InCD.exe C:/Programmer/Fælles filer/Real/Update_OB/realsched.exe C:/WINDOWS/htpatch.exe C:/WINDOWS/System32/RunDll32.exe C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe C:/Program Files/AutoUpdate/AutoUpdate.exe C:/WINDOWS/System32/ctfmon.exe C:/WINDOWS/System32/RUNDLL32.EXE C:/Programmer/Internet Explorer/iexplore.exe C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe C:/Programmer/SysAI/SysAI.exe C:/PROGRA~1/INCRED~1/bin/IMApp.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpohmr08.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe C:/Programmer/Microsoft Office/Office/1030/msoffice.exe C:/WINDOWS/emsw.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpoevm08.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Bin/hpoSTS08.exe C:/Programmer/Internet Explorer/iexplore.exe C:/Documents and Settings/FLINTHOLM/Lokale indstillinger/Temporary Internet Files/Content.IE5/CL2FGTE3/HijackThis[1].exe C:/Programmer/Spybot - Search & Destroy/SpybotSD.exe C:/Programmer/Messenger/msmsgs.exe R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://amazingautossearch.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://amazingautossearch.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://amazingautossearch.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://amazingautossearch.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Page = http://amazingautossearch.com/searchbar.html R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://amazingautossearch.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:/Programmer/SysAI/AproposPlugin.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:/PROGRA~1/FLLESF~1/Real/Toolbar/realbar.dll O2 - BHO: (no name) - {A2D00273-9269-680E-DB2A-B94ACCD488B4} - C:/PROGRA~1/DEADME~1/MPEG FIND.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Programmer/Norton AntiVirus/NavShExt.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Programmer/Norton AntiVirus/NavShExt.dll O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:/PROGRA~1/FLLESF~1/Real/Toolbar/realbar.dll O3 - Toolbar: livefreesoap - {18867C46-4744-E213-D027-2CAD69ADEDB7} - C:/PROGRA~1/DEADME~1/MPEG FIND.dll O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [nwiz] nwiz.exe /install O4 - HKLM/../Run: [ccApp] “C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “C:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [Advanced Tools Check] C:/PROGRA~1/NORTON~1/AdvTools/ADVCHK.EXE O4 - HKLM/../Run: [iamapp] C:/PROGRA~1/Atguard/iamapp.exe O4 - HKLM/../Run: [IncrediMail] C:/PROGRA~1/INCRED~1/bin/IncMail.exe /c O4 - HKLM/../Run: [NeroCheck] C:/WINDOWS/system32/NeroCheck.exe O4 - HKLM/../Run: [InCD] C:/Programmer/ahead/InCD/InCD.exe O4 - HKLM/../Run: [TkBellExe] “C:/Programmer/Fælles filer/Real/Update_OB/realsched.exe” -osboot O4 - HKLM/../Run: [HTpatch] C:/WINDOWS/htpatch.exe O4 - HKLM/../Run: [SiSUSBRG] C:/WINDOWS/SiSUSBrg.exe O4 - HKLM/../Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM/../Run: [heck skip] C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe O4 - HKLM/../Run: [AutoUpdater] “C:/Program Files/AutoUpdate/AutoUpdate.exe” O4 - HKLM/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [CTFMON.EXE] C:/WINDOWS/System32/ctfmon.exe O4 - HKCU/../Run: [NvMediaCenter] RUNDLL32.EXE C:/WINDOWS/System32/NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU/../Run: [HXIUL.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE O4 - HKCU/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [HELPEXP.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:/Programmer/Microsoft Office/Office/OSA9.EXE O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:/PROGRA~1/INCRED~1/bin/resources/WebMenuImg.htm O8 - Extra context menu item: Coupons - file://C:/Programmer/couponsandoffers/System/Temp/couponsandoffers_script0.htm O9 - Extra button: Related (HKLM) O9 - Extra ‘Tools’ menuitem: Show &Related; Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:/Programmer/Internet Explorer/Plugins/NPDocBox.dll O12 - Plugin for .UVR: C:/Programmer/Internet Explorer/Plugins/NPUPano.dll O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38011.4574074074 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
[ Ignorer ] [ # 1 ] A.Behrendt TeamSpywarefri
05.04.2004 02:16:25 Redaktør Supporter Emeritus Antal indlæg: 25535	Hej mads79 og velkommen til Spywarefri Du har lagt hijackthis i den forkerte mappe. Jeg vil råde dig til at lægge Hijackthis i en anden mappe end den du har lagt den i. Du får ikke mulighed for at gendanne en fil, hvis du kommer til at fixe noget forkert, så længe HJ ligger i din temp. mappe. Opret en ny mappe, og kom programmet i den nye mappe, inden du skal til at bruge det. Du skal nu til at i gang med at fixe. Først skal du slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør det så kig her: http://www.spywarefri.dk/virusscannere.htm#alle Kør en scanning med Hijackthis, så du kan se alle filer. Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked. Efter fix skal du genstarte din computer. Det er disse, som skal fixes: R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://amazingautossearch.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://amazingautossearch.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://amazingautossearch.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://amazingautossearch.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Page = http://amazingautossearch.com/searchbar.html R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://amazingautossearch.com/searchbar.html O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:/Programmer/SysAI/AproposPlugin.dll O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:/PROGRA~1/FLLESF~1/Real/Toolbar/realbar.dll O2 - BHO: (no name) - {A2D00273-9269-680E-DB2A-B94ACCD488B4} - C:/PROGRA~1/DEADME~1/MPEG FIND.dll O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:/PROGRA~1/FLLESF~1/Real/Toolbar/realbar.dll >>>> Er det en toolbar du er glad for ? hvis ikke så fix den. Hvis du er glad for den, så lad den leve. Der er ikke beviser på om den er med eller uden snavs. O3 - Toolbar: livefreesoap - {18867C46-4744-E213-D027-2CAD69ADEDB7} - C:/PROGRA~1/DEADME~1/MPEG FIND.dll O4 - HKLM/../Run: [heck skip] C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe O4 - HKLM/../Run: [AutoUpdater] “C:/Program Files/AutoUpdate/AutoUpdate.exe” O4 - HKLM/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [HXIUL.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE O4 - HKCU/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [HELPEXP.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab Dem her kan du også med fordel fixe. De forsvinder ikke, kun fra run, og her ligger de bare og sluger dine kræfter: O4 - HKLM/../Run: [nwiz] nwiz.exe /install O4 - HKLM/../Run: [NeroCheck] C:/WINDOWS/system32/NeroCheck.exe O4 - HKLM/../Run: [TkBellExe] “C:/Programmer/Fælles filer/Real/Update_OB/realsched.exe” -osboot O4 - HKLM/../Run: [HTpatch] C:/WINDOWS/htpatch.exe O4 - Global Startup: Microsoft Office.lnk = C:/Programmer/Microsoft Office/Office/OSA9.EXE ———————————————————————————————— Genstart i fejlsikret tilstand søg og slet det med fed: C:/Program Files/AutoUpdate/AutoUpdate.exe C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe C:/Programmer/SysAI/SysAI.exe C:/WINDOWS/emsw.exe C:/PROGRA~1/DEADME~1/MPEG FIND.dll C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe C:/PROGRA~1/FLLESF~1/Real/Toolbar/realbar.dll >>>> denne fjerner du kun, hvis du også har valgt at fjerne den oppe I 03. Gå i tilføj/fjern prg. Se om disse stadig ligger der, hvis de gør så afinstalleres de: emsw.exe Alset/HelpExpress/FLINTHOLM/HXIUL.EXE Inden du skal finde og slette disse filer i fejlsikret tilstand, så følg denne vejledning: Win2K og XP. Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis. Fjern flueben ved “Skjul beskyttede operativsystemfiler”. Fjern flueben ved “Skjul filtypenavne for kendte filtyper”. Sæt prik i “Vis skjulte filer og mapper”. Genstart din computer. Du skal også lige hente og installere programmet Ad-aware. Opdater det straks efter installationen, og inden du kører en scanning med denne. Fjern alt hvad den finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware Genstart din computer, kør en ny scanning med HijackThis, kopier en ny log herind til tjek.
[ Ignorer ] [ # 2 ] mads79
05.04.2004 04:00:46 Antal indlæg: 9	Nu er søgefunktionen i toppen væk - og det er godt! - men der er stadig en fremmed søgefunktion i bunden, som jeg gerne vil slippe af med. Log-filen ser nu sådan her ud. (Jeg er ret sikker på at den linje jeg har markeret med fed skrift spiller en vigtig rolle) Logfile of HijackThis v1.97.7 Scan saved at 01:57:02, on 05-04-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/WINDOWS/system32/spoolsv.exe C:/WINDOWS/Explorer.EXE C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/PROGRA~1/Atguard/iamapp.exe C:/Programmer/ahead/InCD/InCD.exe C:/WINDOWS/System32/RunDll32.exe C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe C:/WINDOWS/System32/ctfmon.exe C:/WINDOWS/System32/RUNDLL32.EXE C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpohmr08.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe C:/PROGRA~1/INCRED~1/bin/IMApp.exe C:/Programmer/Atguard/iamserv.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpoevm08.exe C:/Programmer/Norton AntiVirus/navapsvc.exe C:/Programmer/Norton AntiVirus/AdvTools/NPROTECT.EXE C:/WINDOWS/System32/nvsvc32.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Bin/hpoSTS08.exe C:/Programmer/Messenger/msmsgs.exe C:/Documents and Settings/FLINTHOLM/Dokumenter/Hijack/HijackThis.exe R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://amazingautossearch.com/passthrough/index.html?http://about:blank R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Programmer/Norton AntiVirus/NavShExt.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Programmer/Norton AntiVirus/NavShExt.dll O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [ccApp] “C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “C:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [Advanced Tools Check] C:/PROGRA~1/NORTON~1/AdvTools/ADVCHK.EXE O4 - HKLM/../Run: [iamapp] C:/PROGRA~1/Atguard/iamapp.exe O4 - HKLM/../Run: [IncrediMail] C:/PROGRA~1/INCRED~1/bin/IncMail.exe /c O4 - HKLM/../Run: [InCD] C:/Programmer/ahead/InCD/InCD.exe O4 - HKLM/../Run: [SiSUSBRG] C:/WINDOWS/SiSUSBrg.exe O4 - HKLM/../Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM/../Run: [heck skip] C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe O4 - HKLM/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [CTFMON.EXE] C:/WINDOWS/System32/ctfmon.exe O4 - HKCU/../Run: [NvMediaCenter] RUNDLL32.EXE C:/WINDOWS/System32/NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU/../Run: [HXIUL.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE O4 - HKCU/../Run: [HELPEXP.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe O4 - HKCU/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:/PROGRA~1/INCRED~1/bin/resources/WebMenuImg.ht
[ Ignorer ] [ # 3 ] FBJ Emeritus
05.04.2004 12:30:36 Redaktør Supporter Emeritus Antal indlæg: 17644	Du har ret - den linie du har markeret med fed skrift skal også væk. Men der er desværre meget af det du skulle fjerne, der stadig er tilbage. Prøv lige at gå i Start - Kontrol Panel - Tilføj/fjern programmer og se om du kan fjerne HelpExpress. Genstart herefter i Fejlsikret tilstand (ved at taste F8 under opstart). Kør HijackThis og sæt et flueben ud for hver af disse linier (forhåbentlig er Helpexpress forsvundet) - luk alle øvrige programmer - og klik “Fix checked”: R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://amazingautossearch.com/passthrough/index.html?http://about:blank O4 - HKLM/../Run: [heck skip] C:/PROGRA~1/AMENFI~1/Type 1 Proxy.exe O4 - HKLM/../Run: [emsw.exe] C:/WINDOWS/emsw.exe O4 - HKCU/../Run: [HXIUL.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/HXIUL.EXE O4 - HKCU/../Run: [HELPEXP.EXE] C:/Programmer/Alset/HelpExpress/FLINTHOLM/Client/HelpExp.exe O4 - HKCU/../Run: [emsw.exe] C:/WINDOWS/emsw.exe Find og slet følgende: C:/(Programmer eller Program Filer)/AMENFI~1 <<—hele mappen C:/WINDOWS/emsw.exe C:/Programmer/Alset/ <<—hele mappen Genstart i Normal tilstand, kør HijackThis, scan og læg en frisk log herind og fortæl os om den søgefunktion du nævner stadig er der (og om den har et navn). Signatur Gode råd om sikkerhed….
[ Ignorer ] [ # 4 ] mads79
05.04.2004 15:39:47 Antal indlæg: 9	Det ser ud til at virke… Logfile of HijackThis v1.97.7 Scan saved at 13:27:45, on 05-04-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/WINDOWS/system32/spoolsv.exe C:/WINDOWS/Explorer.EXE C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/PROGRA~1/Atguard/iamapp.exe C:/Programmer/ahead/InCD/InCD.exe C:/WINDOWS/System32/RunDll32.exe C:/WINDOWS/System32/ctfmon.exe C:/WINDOWS/System32/RUNDLL32.EXE C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpohmr08.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpotdd01.exe C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe C:/PROGRA~1/INCRED~1/bin/IMApp.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpoevm08.exe C:/Programmer/Atguard/iamserv.exe C:/Programmer/Norton AntiVirus/navapsvc.exe C:/Programmer/Norton AntiVirus/AdvTools/NPROTECT.EXE C:/WINDOWS/System32/nvsvc32.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Bin/hpoSTS08.exe C:/Programmer/Messenger/msmsgs.exe C:/Documents and Settings/FLINTHOLM/Dokumenter/Hijack/HijackThis.exe R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:/Programmer/Norton AntiVirus/NavShExt.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:/Programmer/Norton AntiVirus/NavShExt.dll O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [ccApp] “C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “C:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [Advanced Tools Check] C:/PROGRA~1/NORTON~1/AdvTools/ADVCHK.EXE O4 - HKLM/../Run: [iamapp] C:/PROGRA~1/Atguard/iamapp.exe O4 - HKLM/../Run: [IncrediMail] C:/PROGRA~1/INCRED~1/bin/IncMail.exe /c O4 - HKLM/../Run: [InCD] C:/Programmer/ahead/InCD/InCD.exe O4 - HKLM/../Run: [SiSUSBRG] C:/WINDOWS/SiSUSBrg.exe O4 - HKLM/../Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU/../Run: [CTFMON.EXE] C:/WINDOWS/System32/ctfmon.exe O4 - HKCU/../Run: [NvMediaCenter] RUNDLL32.EXE C:/WINDOWS/System32/NVMCTRAY.DLL,NvTaskbarInit O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:/Programmer/Ulead Systems/Ulead Photo Express 4.0 SE/CalCheck.exe O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:/PROGRA~1/INCRED~1/bin/resources/WebMenuImg.htm O8 - Extra context menu item: Coupons - file://C:/Programmer/couponsandoffers/System/Temp/couponsandoffers_script0.htm O9 - Extra button: Related (HKLM) O9 - Extra ‘Tools’ menuitem: Show &Related; Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:/Programmer/Internet Explorer/Plugins/NPDocBox.dll O12 - Plugin for .UVR: C:/Programmer/Internet Explorer/Plugins/NPUPano.dll O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38011.4574074074 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
[ Ignorer ] [ # 5 ] A.Behrendt TeamSpywarefri
05.04.2004 16:01:27 Redaktør Supporter Emeritus Antal indlæg: 25535	Hej mads79 Du skal lige fixe denne her som er adware og skal væk: O8 - Extra context menu item: Coupons - file://C:/Programmer/couponsandoffers/System/Temp/couponsandoffers_script0.htm Genstart efter det fix. For at sikre din pc fremover ville det være en god idé at bruge nogle af programmerne fra vores lille pakke som du kan se her: http://www.spywarefri.dk/pakken.htm Husk at slå din systemgendannelse til igen. Og så skal du også lige skjule dine filer og mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.