Hijack This.. Gidder i?

Af Megabruger Mighty_nOOb | 06-07-2004 00:18 | 1385 visninger | 10 svar, hop til seneste

Hejsa. Sidder ved en kammerat, der har bøvl med sin pc. Så vi prøvede lige en HT Er her en der vil kigge på den. ? Logfile of HijackThis v1.98.0 Scan saved at 00:19:00, on 06/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSSystem32Ati2evxx.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSsystem32spoolsv.exe C:ProgrammerKaspersky LabKaspersky Anti-Virus Personal Proavpm.exe C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSExplorer.EXE C:Program FilesASUSProbeAsusProb.exe C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe C:ProgrammerQuickTimeqttask.exe C:ProgrammerMessengerMSMSGS.EXE C:ProgrammerKaspersky LabKaspersky Anti-Virus Personal ProAvpM.exe C:WINDOWSSystem32wuauclt.exe C:Documents and SettingsPer JørgensenSkrivebordhijackthisHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://212.10.10.20[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page = R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file) O1 - Hosts: 127.0.0.0 localhost O1 - Hosts: 127.0.0.2 auditmypc.com O1 - Hosts: 127.0.0.3 boards.cexx.org O1 - Hosts: 127.0.0.4 bulletproofsoft.net O1 - Hosts: 127.0.0.5 camtech2000.net O1 - Hosts: 127.0.0.6 cexx.org O1 - Hosts: 127.0.0.7 computercops.us O1 - Hosts: 127.0.0.8 ct7support.com O1 - Hosts: 127.0.0.9 doxdesk.com O1 - Hosts: 127.0.0.20 kellys-korner-xp.com O1 - Hosts: 127.0.0.21 kephyr.com O1 - Hosts: 127.0.0.22 lavasoft.de O1 - Hosts: 127.0.0.23 lavasoftusa.com O1 - Hosts: 127.0.0.24 lurkhere.com O1 - Hosts: 127.0.0.25 majorgeeks.com O1 - Hosts: 127.0.0.26 merijn.org O1 - Hosts: 127.0.0.27 mjc1.com O1 - Hosts: 127.0.0.28 moosoft.com O1 - Hosts: 127.0.0.29 mvps.org O1 - Hosts: 127.0.0.30 net-integration.net O1 - Hosts: 127.0.0.31 noadware.net O1 - Hosts: 127.0.0.32 no-spybot.com O1 - Hosts: 127.0.0.33 onlinepcfix.com O1 - Hosts: 127.0.0.34 pchell.com O1 - Hosts: 127.0.0.35 pestpatrol.com O1 - Hosts: 127.0.0.36 safer-networking.org O1 - Hosts: 127.0.0.37 secure.spykiller.com O1 - Hosts: 127.0.0.38 secureie.com O1 - Hosts: 127.0.0.39 security.kolla.de O1 - Hosts: 127.0.0.40 spybot.info O1 - Hosts: 127.0.0.41 spychecker.com O1 - Hosts: 127.0.0.42 spychecker.com O1 - Hosts: 127.0.0.43 spycop.com O1 - Hosts: 127.0.0.44 spyguard.com O1 - Hosts: 127.0.0.45 spykiller.com O1 - Hosts: 127.0.0.46 spyware.co.uk O1 - Hosts: 127.0.0.47 spyware-cop.com O1 - Hosts: 127.0.0.48 spywareinfo.com O1 - Hosts: 127.0.0.49 spywarenuker.com O1 - Hosts: 127.0.0.50 spywareremove.com O1 - Hosts: 127.0.0.51 spywareremove.com O1 - Hosts: 127.0.0.52 stopzillapro.com O1 - Hosts: 127.0.0.53 sunbelt-software.com O1 - Hosts: 127.0.0.54 thiefware.com O1 - Hosts: 127.0.0.55 tomcoyote.org O1 - Hosts: 127.0.0.56 unwantedlinks.com O1 - Hosts: 127.0.0.57 webattack.com O1 - Hosts: 127.0.0.58 wilders.org O1 - Hosts: 127.0.0.59 www.auditmypc.com[...] O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net[...] O1 - Hosts: 127.0.0.61 www.cexx.org[...] O1 - Hosts: 127.0.0.62 www.computercops.us[...] O1 - Hosts: 127.0.0.63 www.ct7support.com[...] O1 - Hosts: 127.0.0.64 www.doxdesk.com[...] O1 - Hosts: 127.0.0.65 www.eblocs.com[...] O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com[...] O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com[...] O1 - Hosts: 127.0.0.68 www.free-web-browsers.com[...] O1 - Hosts: 127.0.0.69 www.grc.com[...] O1 - Hosts: 127.0.0.70 www.grisoft.com[...] O1 - Hosts: 127.0.0.71 www.hackfaq.org[...] O1 - Hosts: 127.0.0.72 www.hazeleger.net[...] O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com[...] O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com[...] O1 - Hosts: 127.0.0.75 www.kephyr.com[...] O1 - Hosts: 127.0.0.76 www.lavasoft.de[...] O1 - Hosts: 127.0.0.77 www.lavasoftusa.com[...] O1 - Hosts: 127.0.0.78 www.lurkhere.com[...] O1 - Hosts: 127.0.0.79 www.majorgeeks.com[...] O1 - Hosts: 127.0.0.80 www.merijn.org[...] O1 - Hosts: 127.0.0.81 www.mjc1.com[...] O1 - Hosts: 127.0.0.82 www.moosoft.com[...] O1 - Hosts: 127.0.0.83 www.mvps.org[...] O1 - Hosts: 127.0.0.84 www.net-integration.net[...] O1 - Hosts: 127.0.0.85 www.noadware.net[...] O1 - Hosts: 127.0.0.86 www.no-spybot.com[...] O1 - Hosts: 127.0.0.87 www.onlinepcfix.com[...] O1 - Hosts: 127.0.0.88 www.pchell.com[...] O1 - Hosts: 127.0.0.89 www.pestpatrol.com[...] O1 - Hosts: 127.0.0.90 www.safer-networking.org[...] O1 - Hosts: 127.0.0.91 www.secureie.com[...] O1 - Hosts: 127.0.0.92 www.security.kolla.de[...] O1 - Hosts: 127.0.0.93 www.spybot.info[...] O1 - Hosts: 127.0.0.94 www.spychecker.com[...] O1 - Hosts: 127.0.0.95 www.spychecker.com[...] O1 - Hosts: 127.0.0.96 www.spycop.com[...] O1 - Hosts: 127.0.0.97 www.spyguard.com[...] O1 - Hosts: 127.0.0.98 www.spykiller.com[...] O1 - Hosts: 127.0.0.99 www.spyware.co.uk[...] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: (no name) - {6EAE3559-E041-42A8-8D36-76BE94605196} - C:WINDOWSSystem32oloklka.dll (file missing) O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:ProgrammerTEXTwareQUICKfindPlugInsIEHelp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [ASUS Probe] C:Program FilesASUSProbeAsusProb.exe O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe O4 - HKLM..Run: [Ad-watch] "C:ProgrammerLavasoftAd-aware 6Ad-watch.exe" O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime O4 - HKCU..Run: [MSMSGS] "C:ProgrammerMessengerMSMSGS.EXE" /background O4 - Global Startup: Kaspersky Anti-Virus Monitor.lnk = C:ProgrammerKaspersky LabKaspersky Anti-Virus Personal ProAvpM.exe O8 - Extra context menu item: &iSearch The Web - res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:ProgrammerICQICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:ProgrammerICQICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com[...] O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com[...] O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - ms-its:mhtml:file://C:ss.MHT!http://toolbar.isearch.com[...] O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com[...] O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com[...] O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com[...] O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com[...] O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com[...] O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com[...] O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} - http://akamai.downloadv3.com[...]
--

#1
Kim In Chul
Supporter Aspirant
06-07-2004 00:30

Rapporter til Admin

hej... Start med at deaktiverere systemgendannelsen, kør en ny hijackthis og sæt flueben ud for: R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page = R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file) O1 - Hosts: 127.0.0.0 localhost O1 - Hosts: 127.0.0.2 auditmypc.com O1 - Hosts: 127.0.0.3 boards.cexx.org O1 - Hosts: 127.0.0.4 bulletproofsoft.net O1 - Hosts: 127.0.0.5 camtech2000.net O1 - Hosts: 127.0.0.6 cexx.org O1 - Hosts: 127.0.0.7 computercops.us O1 - Hosts: 127.0.0.8 ct7support.com O1 - Hosts: 127.0.0.9 doxdesk.com O1 - Hosts: 127.0.0.20 kellys-korner-xp.com O1 - Hosts: 127.0.0.21 kephyr.com O1 - Hosts: 127.0.0.22 lavasoft.de O1 - Hosts: 127.0.0.23 lavasoftusa.com O1 - Hosts: 127.0.0.24 lurkhere.com O1 - Hosts: 127.0.0.25 majorgeeks.com O1 - Hosts: 127.0.0.26 merijn.org O1 - Hosts: 127.0.0.27 mjc1.com O1 - Hosts: 127.0.0.28 moosoft.com O1 - Hosts: 127.0.0.29 mvps.org O1 - Hosts: 127.0.0.30 net-integration.net O1 - Hosts: 127.0.0.31 noadware.net O1 - Hosts: 127.0.0.32 no-spybot.com O1 - Hosts: 127.0.0.33 onlinepcfix.com O1 - Hosts: 127.0.0.34 pchell.com O1 - Hosts: 127.0.0.35 pestpatrol.com O1 - Hosts: 127.0.0.36 safer-networking.org O1 - Hosts: 127.0.0.37 secure.spykiller.com O1 - Hosts: 127.0.0.38 secureie.com O1 - Hosts: 127.0.0.39 security.kolla.de O1 - Hosts: 127.0.0.40 spybot.info O1 - Hosts: 127.0.0.41 spychecker.com O1 - Hosts: 127.0.0.42 spychecker.com O1 - Hosts: 127.0.0.43 spycop.com O1 - Hosts: 127.0.0.44 spyguard.com O1 - Hosts: 127.0.0.45 spykiller.com O1 - Hosts: 127.0.0.46 spyware.co.uk O1 - Hosts: 127.0.0.47 spyware-cop.com O1 - Hosts: 127.0.0.48 spywareinfo.com O1 - Hosts: 127.0.0.49 spywarenuker.com O1 - Hosts: 127.0.0.50 spywareremove.com O1 - Hosts: 127.0.0.51 spywareremove.com O1 - Hosts: 127.0.0.52 stopzillapro.com O1 - Hosts: 127.0.0.53 sunbelt-software.com O1 - Hosts: 127.0.0.54 thiefware.com O1 - Hosts: 127.0.0.55 tomcoyote.org O1 - Hosts: 127.0.0.56 unwantedlinks.com O1 - Hosts: 127.0.0.57 webattack.com O1 - Hosts: 127.0.0.58 wilders.org O1 - Hosts: 127.0.0.59 www.auditmypc.com[...] O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net[...] O1 - Hosts: 127.0.0.61 www.cexx.org[...] O1 - Hosts: 127.0.0.62 www.computercops.us[...] O1 - Hosts: 127.0.0.63 www.ct7support.com[...] O1 - Hosts: 127.0.0.64 www.doxdesk.com[...] O1 - Hosts: 127.0.0.65 www.eblocs.com[...] O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com[...] O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com[...] O1 - Hosts: 127.0.0.68 www.free-web-browsers.com[...] O1 - Hosts: 127.0.0.69 www.grc.com[...] O1 - Hosts: 127.0.0.70 www.grisoft.com[...] O1 - Hosts: 127.0.0.71 www.hackfaq.org[...] O1 - Hosts: 127.0.0.72 www.hazeleger.net[...] O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com[...] O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com[...] O1 - Hosts: 127.0.0.75 www.kephyr.com[...] O1 - Hosts: 127.0.0.76 www.lavasoft.de[...] O1 - Hosts: 127.0.0.77 www.lavasoftusa.com[...] O1 - Hosts: 127.0.0.78 www.lurkhere.com[...] O1 - Hosts: 127.0.0.79 www.majorgeeks.com[...] O1 - Hosts: 127.0.0.80 www.merijn.org[...] O1 - Hosts: 127.0.0.81 www.mjc1.com[...] O1 - Hosts: 127.0.0.82 www.moosoft.com[...] O1 - Hosts: 127.0.0.83 www.mvps.org[...] O1 - Hosts: 127.0.0.84 www.net-integration.net[...] O1 - Hosts: 127.0.0.85 www.noadware.net[...] O1 - Hosts: 127.0.0.86 www.no-spybot.com[...] O1 - Hosts: 127.0.0.87 www.onlinepcfix.com[...] O1 - Hosts: 127.0.0.88 www.pchell.com[...] O1 - Hosts: 127.0.0.89 www.pestpatrol.com[...] O1 - Hosts: 127.0.0.90 www.safer-networking.org[...] O1 - Hosts: 127.0.0.91 www.secureie.com[...] O1 - Hosts: 127.0.0.92 www.security.kolla.de[...] O1 - Hosts: 127.0.0.93 www.spybot.info[...] O1 - Hosts: 127.0.0.94 www.spychecker.com[...] O1 - Hosts: 127.0.0.95 www.spychecker.com[...] O1 - Hosts: 127.0.0.96 www.spycop.com[...] O1 - Hosts: 127.0.0.97 www.spyguard.com[...] O1 - Hosts: 127.0.0.98 www.spykiller.com[...] O1 - Hosts: 127.0.0.99 www.spyware.co.uk[...] O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime O2 - BHO: (no name) - {6EAE3559-E041-42A8-8D36-76BE94605196} - C:WINDOWSSystem32oloklka.dll (file missing) O8 - Extra context menu item: &iSearch The Web - res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - ms-its:mhtml:file://C:ss.MHT!http://toolbar.isearch.com[...] O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com[...] Luk alle programvinduer ned og klik på fix checked, genstart så op i fejlsikret tilstand og find og slet: C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML Start op normalt og smid en log herind til kontrol... //Kim In Chul
--

#2
Mighty_nOOb
Megabruger
06-07-2004 00:31

Rapporter til Admin

Prøver vi lige..
--

#3
Armageddon
Moderator
06-07-2004 00:46

Rapporter til Admin

Få lige disse fixet også: O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com[...] O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com[...] O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com[...] O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com[...] O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} - http://akamai.downloadv3.com[...]
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#4
Mighty_nOOb
Megabruger
06-07-2004 00:54

Rapporter til Admin

Logfile of HijackThis v1.98.0 Scan saved at 00:56:12, on 06/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSSystem32Ati2evxx.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSsystem32Ati2evxx.exe C:WINDOWSExplorer.EXE C:ProgrammerMessengerMSMSGS.EXE C:WINDOWSSystem32wuauclt.exe C:ProgrammerInternet Exploreriexplore.exe C:Documents and SettingsPer JørgensenSkrivebordhijackthisHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://212.10.10.20[...] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:ProgrammerTEXTwareQUICKfindPlugInsIEHelp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [ASUS Probe] C:Program FilesASUSProbeAsusProb.exe O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe O4 - HKLM..Run: [Ad-watch] "C:ProgrammerLavasoftAd-aware 6Ad-watch.exe" O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime O4 - HKCU..Run: [MSMSGS] "C:ProgrammerMessengerMSMSGS.EXE" /background O4 - Global Startup: Kaspersky Anti-Virus Monitor.lnk = C:ProgrammerKaspersky LabKaspersky Anti-Virus Personal ProAvpM.exe O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:ProgrammerICQICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:ProgrammerICQICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com[...] O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com[...] O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com[...]
--

#5
Mighty_nOOb
Megabruger
06-07-2004 00:54

Rapporter til Admin

Hvordan ser den så ud
--

#6
Knutz
Elite Supporter
06-07-2004 00:57

Rapporter til Admin

#5 nu er den ganske ren!
--
Jahh.. Så kan du lære det! MSN: [email protected]

#7
Mighty_nOOb
Megabruger
06-07-2004 01:01

Rapporter til Admin

#6 Ok Lyder godt.. Er alle enige om at den er ren.. ???
--

#8
Kim In Chul
Supporter Aspirant
06-07-2004 01:06

Rapporter til Admin

#7 den er ren... Du kan med fordel fikse denne her, da den bare ligger og sluger kræfter: O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime Luk alle programvinduer ned klik på fix checked... Aktiver systemgendannelsen //Kim In Chul
--

#9
Armageddon
Moderator
06-07-2004 01:22

Rapporter til Admin

Ja, vi er vist enige om at din log er ren.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#10
Mighty_nOOb
Megabruger
06-07-2004 01:29

Rapporter til Admin

Mange tak gutter. Det har ihvertfald hjulpet gevaldigt på hans pc. Så nu er vi glade. :-)
--