Spywarefri Forum | Vær sød at tjekke denne log

1 af 3

Vær sød at tjekke denne log

[ Ignorer ] Jacobsen
17.05.2004 12:59:14 Antal indlæg: 24	Logfile of HijackThis v1.97.7 Scan saved at 10:55:10, on 17-05-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/STOPzilla!/szntsvc.exe C:/WINDOWS/system32/spoolsv.exe c:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/Programmer/Fælles filer/Microsoft Shared/VS7Debug/mdm.exe c:/Programmer/Norton AntiVirus/navapsvc.exe C:/windows/system/hpsysdrv.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe C:/WINDOWS/System32/hphmon05.exe C:/HP/KBD/KBD.EXE C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe C:/Programmer/STOPzilla!/Stopzilla.exe C:/PROGRA~1/32hide/SECOND PLAN.exe C:/Programmer/Messenger/msmsgs.exe C:/WINDOWS/System32/7GL9VW75.exe C:/WINDOWS/System32/rundll32.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe C:/Programmer/Microsoft Office/Office/OSA.EXE C:/WINDOWS/FSScrCtl.exe C:/WINDOWS/System32/wuauclt.exe C:/Programmer/SpyBot/hijackthis.exe C:/WINDOWS/explorer.exe R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = prosearching.com R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: (no name) - {2943415E-EBE2-A5E5-8EC6-FBB3B1B36DF0} - C:/PROGRA~1/SAFEHT~1/about extra.dll O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:/Programmer/Spybot - Search & Destroy/SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:/Programmer/Norton AntiVirus/NavShExt.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:/WINDOWS/System32/SZIEBHO.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpdtlk02.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:/Programmer/Norton AntiVirus/NavShExt.dll O3 - Toolbar: Mp3 idol - {0C6FD287-000A-72F9-0C9E-772B8395C3FF} - C:/PROGRA~1/SAFEHT~1/about extra.dll O4 - HKLM/../Run: [hpsysdrv] c:/windows/system/hpsysdrv.exe O4 - HKLM/../Run: [HotKeysCmds] C:/WINDOWS/System32/hkcmd.exe O4 - HKLM/../Run: [CamMonitor] c:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe O4 - HKLM/../Run: [HPHUPD05] c:/Programmer/Hewlett-Packard/{45B6180B-DCAB-4093-8EE8-6164457517F0}/hphupd05.exe O4 - HKLM/../Run: [HPHmon05] C:/WINDOWS/System32/hphmon05.exe O4 - HKLM/../Run: [KBD] C:/HP/KBD/KBD.EXE O4 - HKLM/../Run: [StorageGuard] “C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe” /r O4 - HKLM/../Run: [Home Theater SchSvr] “C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe” O4 - HKLM/../Run: [Recguard] C:/WINDOWS/SMINST/RECGUARD.EXE O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM/../Run: [ccApp] “c:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “c:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM/../Run: [ATIPTA] C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../Run: [PS2] C:/WINDOWS/system32/ps2.exe O4 - HKLM/../Run: [STOPzilla] “C:/Programmer/STOPzilla!/Stopzilla.exe” /autorun O4 - HKLM/../Run: [APIMon] C:/WINDOWS/System32/apimon.exe O4 - HKLM/../Run: [finddefy] C:/PROGRA~1/32hide/SECOND PLAN.exe O4 - HKLM/../Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKCU/../Run: [BackupNotify] c:/Programmer/Hewlett-Packard/Digital Imaging/bin/backupnotify.exe O4 - HKCU/../Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU/../Run: [MSMSGS] “C:/Programmer/Messenger/msmsgs.exe” /background O4 - HKCU/../Run: [NortonAV] C:/WINDOWS/System32/7GL9VW75.exe O4 - Startup: Microsoft Office-start.lnk = C:/Programmer/Microsoft Office/Office/OSA.EXE O4 - Startup: Screen Saver Control.lnk = C:/WINDOWS/FSScrCtl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe O9 - Extra ‘Tools’ menuitem: Sun Java Console (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra ‘Tools’ menuitem: Show &Related; Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38124.0250810185 O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ Ignorer ] [ # 1 ] A.Behrendt TeamSpywarefri
17.05.2004 14:42:05 Redaktør Supporter Emeritus Antal indlæg: 25535	Hej Jacobsen Du skal nu til at i gang med at fixe. Først skal du slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør det så kig her: http://www.spywarefri.dk/virusscannere.htm#alle Kør en scanning med Hijackthis, så du kan se alle filer. Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked. Efter fix skal du genstarte din computer. Det er disse, som skal fixes: R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = prosearching.com R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKLM/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKLM/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html O2 - BHO: (no name) - {2943415E-EBE2-A5E5-8EC6-FBB3B1B36DF0} - C:/PROGRA~1/SAFEHT~1/about extra.dll O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll O3 - Toolbar: Mp3 idol - {0C6FD287-000A-72F9-0C9E-772B8395C3FF} - C:/PROGRA~1/SAFEHT~1/about extra.dll O4 - HKCU/../Run: [NortonAV] C:/WINDOWS/System32/7GL9VW75.exe O4 - Startup: Microsoft Office-start.lnk = C:/Programmer/Microsoft Office/Office/OSA.EXE O4 - HKLM/../Run: [finddefy] C:/PROGRA~1/32hide/SECOND PLAN.exe >>>>> Kender du selv denne hvis ikke skal du fixe den. Jeg kan intet finde på den, og det tyder aldrig godt. O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab —————————————————————————————————- Dem her kan du også med fordel fixe. De forsvinder ikke, kun fra run, og her ligger de bare og sluger dine kræfter: O4 - HKLM/../Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect —————————————————————————————————- For at kunne se alle filer og mapper, så følg denne vejledning: Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis. Fjern flueben ved “Skjul beskyttede operativsystemfiler”. Fjern flueben ved “Skjul filtypenavne for kendte filtyper”. Sæt prik i “Vis skjulte filer og mapper”. Genstart i fejlsikret tilstand søg og slet det med fed: C:/WINDOWS/System32/7GL9VW75.exe Kun hvis du fixer den jeg spørger dig om du kender.C:/PROGRA~1/32hide/SECOND PLAN.exe Genstart din computer. Du skal også lige hente og installere programmet Ad-aware hvis du da ikke har det i forvejen. Opdater det straks efter installationen, og inden du kører en scanning med denne. Fjern alt hvad den finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware Genstart din computer, kør en ny scanning med HijackThis, kopier en ny log herind til tjek.
[ Ignorer ] [ # 2 ] Jacobsen
17.05.2004 15:28:32 Antal indlæg: 24	Her er den nye log, men den har ikke fjernet det program jeg havde problemer med [?], trykker jeg på genvéjen og egenskaber får jeg følgende sti hvor programmet skulle ligge: C:/Programmer/WebSiteViewer/123268.exe /ac:123268 /sk:sk001 /lc: /ul Jeg har prøvet at gå ind og slette dette manuelt, men lige meget hjælper det… Den nye log: Logfile of HijackThis v1.97.7 Scan saved at 13:22:53, on 17-05-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/STOPzilla!/szntsvc.exe C:/WINDOWS/system32/spoolsv.exe c:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/Programmer/Fælles filer/Microsoft Shared/VS7Debug/mdm.exe c:/Programmer/Norton AntiVirus/navapsvc.exe C:/windows/system/hpsysdrv.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe C:/WINDOWS/System32/hphmon05.exe C:/HP/KBD/KBD.EXE C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe C:/Programmer/STOPzilla!/Stopzilla.exe C:/PROGRA~1/32hide/SECOND PLAN.exe C:/Programmer/Messenger/msmsgs.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe C:/WINDOWS/FSScrCtl.exe C:/Programmer/SpyBot/hijackthis.exe C:/WINDOWS/System32/wuauclt.exe C:/WINDOWS/explorer.exe R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://prosearching.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid;={SUB_CLSID}&pver;={SUB_PVER}&ar=home R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:/Programmer/Spybot - Search & Destroy/SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:/Programmer/Norton AntiVirus/NavShExt.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:/WINDOWS/System32/SZIEBHO.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpdtlk02.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:/Programmer/Norton AntiVirus/NavShExt.dll O4 - HKLM/../Run: [hpsysdrv] c:/windows/system/hpsysdrv.exe O4 - HKLM/../Run: [HotKeysCmds] C:/WINDOWS/System32/hkcmd.exe O4 - HKLM/../Run: [CamMonitor] c:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe O4 - HKLM/../Run: [HPHUPD05] c:/Programmer/Hewlett-Packard/{45B6180B-DCAB-4093-8EE8-6164457517F0}/hphupd05.exe O4 - HKLM/../Run: [HPHmon05] C:/WINDOWS/System32/hphmon05.exe O4 - HKLM/../Run: [KBD] C:/HP/KBD/KBD.EXE O4 - HKLM/../Run: [StorageGuard] “C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe” /r O4 - HKLM/../Run: [Home Theater SchSvr] “C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe” O4 - HKLM/../Run: [Recguard] C:/WINDOWS/SMINST/RECGUARD.EXE O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [ccApp] “c:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “c:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM/../Run: [ATIPTA] C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../Run: [PS2] C:/WINDOWS/system32/ps2.exe O4 - HKLM/../Run: [STOPzilla] “C:/Programmer/STOPzilla!/Stopzilla.exe” /autorun O4 - HKLM/../Run: [APIMon] C:/WINDOWS/System32/apimon.exe O4 - HKLM/../Run: [finddefy] C:/PROGRA~1/32hide/SECOND PLAN.exe O4 - HKLM/../Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKCU/../Run: [BackupNotify] c:/Programmer/Hewlett-Packard/Digital Imaging/bin/backupnotify.exe O4 - HKCU/../Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU/../Run: [MSMSGS] “C:/Programmer/Messenger/msmsgs.exe” /background O4 - Startup: Screen Saver Control.lnk = C:/WINDOWS/FSScrCtl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe O9 - Extra ‘Tools’ menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38124.0250810185 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ Ignorer ] [ # 3 ] Fromsej TeamSpywarefri
17.05.2004 19:23:27 Administrator Team Spywarefri Antal indlæg: 55091	Fixes: R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://prosearching.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid;={SUB_CLSID}&pver;={SUB_PVER}&ar=home O4 - HKLM/../Run: [finddefy] C:/PROGRA~1/32hide/SECOND PLAN.exe O4 - HKLM/../Run: [AlcxMonitor] ALCXMNTR.EXE Hent TheKillBox her: http://home8.inet.tele.dk/fbj/TheKillBox.exe http://home8.inet.tele.dk/fbj/TheKillBoxBrugsanvisning.htm Brug Thekillbox til det hele, kig i manualens underpunkt, Sletning ved næste genstart. C:/PROGRA~1/32hide <- Mappen. C:/Programmer/WebSiteViewer <- Mappen. C:/windows/ALCXMNTR.EXE <- Filen. Derefter genstart og en, forhåbentlig, sidste log til tjek. Signatur Member of “Alliance of Security Analysis Professionals” - Alle angaben wie immer “nur mit pistole” Græd du også over eventyret om smedens kat, da du var lille? http://www.spywarefri.dk/medarbejderne/ Nierne bomaye - You’ll never walk alone qui potest, obligatur
[ Ignorer ] [ # 4 ] A.Behrendt TeamSpywarefri
17.05.2004 20:04:33 Redaktør Supporter Emeritus Antal indlæg: 25535	http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=3025 her ligger også en log fra samme person. Bruger må lige bestemme sig til hvilken tråd der skal lukkes og hvilken en der skal fortsætte.
[ Ignorer ] [ # 5 ] Jacobsen
17.05.2004 23:23:55 Antal indlæg: 24	Programmet er der endnu, kan det evt hjælpe hvis jeg sletter hele harddisken, og starter forfra ?? Her er loggen Logfile of HijackThis v1.97.7 Scan saved at 21:18:24, on 17-05-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/STOPzilla!/szntsvc.exe C:/WINDOWS/Explorer.EXE C:/WINDOWS/system32/spoolsv.exe c:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/Programmer/Fælles filer/Microsoft Shared/VS7Debug/mdm.exe c:/Programmer/Norton AntiVirus/navapsvc.exe C:/windows/system/hpsysdrv.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe C:/WINDOWS/System32/hphmon05.exe C:/HP/KBD/KBD.EXE C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe C:/Programmer/STOPzilla!/Stopzilla.exe C:/Programmer/Messenger/msmsgs.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe C:/WINDOWS/FSScrCtl.exe C:/Programmer/SpyBot/hijackthis.exe R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = prosearching.com R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:/Programmer/Spybot - Search & Destroy/SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:/Programmer/Norton AntiVirus/NavShExt.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:/WINDOWS/System32/SZIEBHO.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpdtlk02.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:/Programmer/Norton AntiVirus/NavShExt.dll O4 - HKLM/../Run: [hpsysdrv] c:/windows/system/hpsysdrv.exe O4 - HKLM/../Run: [HotKeysCmds] C:/WINDOWS/System32/hkcmd.exe O4 - HKLM/../Run: [CamMonitor] c:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe O4 - HKLM/../Run: [HPHUPD05] c:/Programmer/Hewlett-Packard/{45B6180B-DCAB-4093-8EE8-6164457517F0}/hphupd05.exe O4 - HKLM/../Run: [HPHmon05] C:/WINDOWS/System32/hphmon05.exe O4 - HKLM/../Run: [KBD] C:/HP/KBD/KBD.EXE O4 - HKLM/../Run: [StorageGuard] “C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe” /r O4 - HKLM/../Run: [Home Theater SchSvr] “C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe” O4 - HKLM/../Run: [Recguard] C:/WINDOWS/SMINST/RECGUARD.EXE O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [ccApp] “c:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “c:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM/../Run: [ATIPTA] C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../Run: [PS2] C:/WINDOWS/system32/ps2.exe O4 - HKLM/../Run: [STOPzilla] “C:/Programmer/STOPzilla!/Stopzilla.exe” /autorun O4 - HKLM/../Run: [APIMon] C:/WINDOWS/System32/apimon.exe O4 - HKCU/../Run: [BackupNotify] c:/Programmer/Hewlett-Packard/Digital Imaging/bin/backupnotify.exe O4 - HKCU/../Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU/../Run: [MSMSGS] “C:/Programmer/Messenger/msmsgs.exe” /background O4 - Startup: Screen Saver Control.lnk = C:/WINDOWS/FSScrCtl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe O9 - Extra ‘Tools’ menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38124.0250810185 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ Ignorer ] [ # 6 ] Fromsej TeamSpywarefri
17.05.2004 23:29:03 Administrator Team Spywarefri Antal indlæg: 55091	Det hjælper stensikkert, men er det ikke lidt drastisk. Selvfølgelig, hvis den alligevel trænger til den store tur. Kom lige med en tilbagemelding så vi ikke bruger tid på din log. Signatur Member of “Alliance of Security Analysis Professionals” - Alle angaben wie immer “nur mit pistole” Græd du også over eventyret om smedens kat, da du var lille? http://www.spywarefri.dk/medarbejderne/ Nierne bomaye - You’ll never walk alone qui potest, obligatur
[ Ignorer ] [ # 7 ] Jacobsen
18.05.2004 19:08:12 Antal indlæg: 24	Jo, det er det vel, men jeg er bare ved at være rigtig grundig træt af den [xx(] Men jeg giver den lige en chance til, så i må gerne kigge på den.
[ Ignorer ] [ # 8 ] Fromsej TeamSpywarefri
18.05.2004 22:04:49 Administrator Team Spywarefri Antal indlæg: 55091	Fixes: R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Bar = http://prosearching.com/searchbar.html R1 - HKCU/Software/Microsoft/Internet Explorer/Main,Search Page = http://prosearching.com/searchbar.html R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = prosearching.com R1 - HKCU/Software/Microsoft/Internet Explorer/Search,SearchAssistant = http://prosearching.com/searchbar.html ——————————————————————— Den her kan jeg ikke finde noget på, så mon ikke det er bedst at fixe den? O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll slet så filen C:/WINDOWS/udpmod.dll i fejlsikret. Signatur Member of “Alliance of Security Analysis Professionals” - Alle angaben wie immer “nur mit pistole” Græd du også over eventyret om smedens kat, da du var lille? http://www.spywarefri.dk/medarbejderne/ Nierne bomaye - You’ll never walk alone qui potest, obligatur
[ Ignorer ] [ # 9 ] Jacobsen
19.05.2004 21:22:12 Antal indlæg: 24	Endnu en logfil, men den har stadig ikke slettet det program jeg havde problemer med, det begynder snart at blive rigtig komisk G Logfile of HijackThis v1.97.7 Scan saved at 19:19:52, on 19-05-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:/WINDOWS/System32/smss.exe C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/system32/services.exe C:/WINDOWS/system32/lsass.exe C:/WINDOWS/system32/svchost.exe C:/WINDOWS/System32/svchost.exe C:/Programmer/STOPzilla!/szntsvc.exe C:/WINDOWS/system32/spoolsv.exe c:/Programmer/Fælles filer/Symantec Shared/ccEvtMgr.exe C:/windows/system/hpsysdrv.exe C:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe C:/WINDOWS/System32/hphmon05.exe C:/HP/KBD/KBD.EXE C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe C:/Programmer/Fælles filer/Symantec Shared/ccApp.exe C:/Programmer/Fælles filer/Microsoft Shared/VS7Debug/mdm.exe c:/Programmer/Norton AntiVirus/navapsvc.exe C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe C:/Programmer/STOPzilla!/Stopzilla.exe C:/Programmer/Messenger/msmsgs.exe C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe C:/WINDOWS/FSScrCtl.exe C:/Programmer/SpyBot/hijackthis.exe C:/WINDOWS/explorer.exe R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://formel1.jubii.dk/ R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Hyperlinks O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:/Programmer/Adobe/Acrobat 5.0/Reader/ActiveX/AcroIEHelper.ocx O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:/Programmer/Spybot - Search & Destroy/SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:/Programmer/Norton AntiVirus/NavShExt.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:/WINDOWS/System32/SZIEBHO.dll O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/System32/msdxm.ocx O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpdtlk02.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:/Programmer/Norton AntiVirus/NavShExt.dll O4 - HKLM/../Run: [hpsysdrv] c:/windows/system/hpsysdrv.exe O4 - HKLM/../Run: [HotKeysCmds] C:/WINDOWS/System32/hkcmd.exe O4 - HKLM/../Run: [CamMonitor] c:/Programmer/Hewlett-Packard/Digital Imaging/Unload/hpqcmon.exe O4 - HKLM/../Run: [HPHUPD05] c:/Programmer/Hewlett-Packard/{45B6180B-DCAB-4093-8EE8-6164457517F0}/hphupd05.exe O4 - HKLM/../Run: [HPHmon05] C:/WINDOWS/System32/hphmon05.exe O4 - HKLM/../Run: [KBD] C:/HP/KBD/KBD.EXE O4 - HKLM/../Run: [StorageGuard] “C:/Programmer/Fælles filer/Sonic/Update Manager/sgtray.exe” /r O4 - HKLM/../Run: [Home Theater SchSvr] “C:/Programmer/Fælles filer/InterVideo/SchSvr/SchSvr.exe” O4 - HKLM/../Run: [Recguard] C:/WINDOWS/SMINST/RECGUARD.EXE O4 - HKLM/../Run: [NvCplDaemon] RUNDLL32.EXE C:/WINDOWS/System32/NvCpl.dll,NvStartup O4 - HKLM/../Run: [ccApp] “c:/Programmer/Fælles filer/Symantec Shared/ccApp.exe” O4 - HKLM/../Run: [ccRegVfy] “c:/Programmer/Fælles filer/Symantec Shared/ccRegVfy.exe” O4 - HKLM/../Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM/../Run: [ATIPTA] C:/Programmer/ATI Technologies/ATI Control Panel/atiptaxx.exe O4 - HKLM/../Run: [PS2] C:/WINDOWS/system32/ps2.exe O4 - HKLM/../Run: [STOPzilla] “C:/Programmer/STOPzilla!/Stopzilla.exe” /autorun O4 - HKLM/../Run: [APIMon] C:/WINDOWS/System32/apimon.exe O4 - HKCU/../Run: [BackupNotify] c:/Programmer/Hewlett-Packard/Digital Imaging/bin/backupnotify.exe O4 - HKCU/../Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU/../Run: [MSMSGS] “C:/Programmer/Messenger/msmsgs.exe” /background O4 - Startup: Screen Saver Control.lnk = C:/WINDOWS/FSScrCtl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:/Programmer/Hewlett-Packard/Digital Imaging/bin/hpqtra08.exe O9 - Extra ‘Tools’ menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra ‘Tools’ menuitem: Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38124.0250810185 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ Ignorer ] [ # 10 ] FBJ Emeritus
19.05.2004 22:24:34 Redaktør Supporter Emeritus Antal indlæg: 17644	Må jeg lige sammenfatte, for at finde ud af om jeg har forstået dit problem. 1. Du kan ikke slette C:/Programmer/WebSiteViewer/123268.exe 2. Du kan ikke fixe O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll Er det rigtigt forstået? Signatur Gode råd om sikkerhed….
[ Ignorer ] [ # 11 ] Jacobsen
20.05.2004 12:04:20 Antal indlæg: 24	Det er fuldstændig rigtigt
[ Ignorer ] [ # 12 ] tracert
20.05.2004 12:25:13 Antal indlæg: 67	Lige et spørgsmål: Huskede du at lukke Alle Internet Explorer browser vinduer da du fixede: O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - C:/WINDOWS/udpmod.dll ? mvh
[ Ignorer ] [ # 13 ] FBJ Emeritus
20.05.2004 12:30:43 Redaktør Supporter Emeritus Antal indlæg: 17644	Du muligvis prøvet dette, men vi tager den lige igen. 1. Hent TheKillBox herfra: http://download.broadbandmedic.com/cgi-bin/download.cgi?id=0 Pak programmet ud til en mappe du kan finde igen. Åben mappen og dobbeltklik på KillBox. Kopier “C:/Programmer/WebSiteViewer/123268.exe” ind i tekstfeltet og i menulinien vælger Action -> Delete on Reboot. Nu kommer der et nyt vindue frem - her vælger du File -> Add file og herefter Action -> Process and reboot. Lad computeren genstarte. 2. Hent dette program: http://tools.zerosrealm.com/dllfix.exe Dobbeltklik på programmet og pak det ud til en mappe du kan finde igen. Åben mappen og åben mappen “RegSearch Tools” - dobbeltklik på NewRegSrch. I den første dialogboks skriver du “1”, i den næste skriver du “4BCF322B-9621-4e90-9678-F1424EB7584E” (uden anførselstegn) - klik OK. Nu søges din computer igennem og efter et stykke tid åbnes en tekstfil i Notepad - læg indholdet herind. Signatur Gode råd om sikkerhed….
[ Ignorer ] [ # 14 ] Jacobsen
20.05.2004 19:55:58 Antal indlæg: 24	Ny log ——————————————————————————— REGEDIT4 ; NewRegSrch.vbs © Bill James ; Registry search results for string “4BCF322B-9621-4e90-9678-F1424EB7584E” 20-05-2004 17:53:56 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}] [HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/Control] [HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/Control] “CI”=”{4BCF322B-9621-4e90-9678-F1424EB7584E}” [HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/InprocServer32] [HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/{4BCF322B-9621-4e90-9678-F1424EB7584E}]
[ Ignorer ] [ # 15 ] FBJ Emeritus
20.05.2004 21:19:52 Redaktør Supporter Emeritus Antal indlæg: 17644	Du er ikke særligt meddelsom Fik du slettet C:/Programmer/WebSiteViewer/123268.exe??? ___________________________________________ Til det andet problem. Gå i Start -> Kør og skriv regedit Gå i Filer og vælg Eksporter. Nu kommer der en boks frem med titlen “Eksporter registreringsdatabase fil”. I nederste venstre hjørne skal du sætte en prik i Eksporter område “Alt”. Skriv et Filnavn og vælg “Gem”. Nu har du eksporteret hele registreringsdatabasen, i tilfælde af, at noget går galt. Åbn notepad/notesblok og kopier det med fed ind REGEDIT4 [-HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}] [-HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/Control] [HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/Control] “CI”=”“ [-HKEY_LOCAL_MACHINE/SOFTWARE/Classes/CLSID/{4BCF322B-9621-4e90-9678-F1424EB7584E}/InprocServer32] [-HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/{4BCF322B-9621-4e90-9678-F1424EB7584E}] Gem filen som rens.reg på skrivebordet. Under filnavn, sæt filtype til “alle filer”. Efter du har gemt denne fil, find den på Skrivebordet og dobbeltklik på den, og sig ja til at flette. Kør HijackThis, scan og læg en frisk log herind. Signatur Gode råd om sikkerhed….

1 af 3

Næste