log-file

Af Gæst Henrik | 25-07-2004 17:27 | 898 visninger | 5 svar, hop til seneste

EN der vil kigge på denne log file PÅ forhånd tak... Logfile of HijackThis v1.98.0 Scan saved at 17:22:46, on 25-07-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32csrss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedccSetMgr.exe C:WINDOWSExplorer.EXE C:ProgrammerFælles filerSymantec SharedccEvtMgr.exe C:WINDOWSsystem32LEXBCES.EXE C:WINDOWSsystem32spoolsv.exe C:WINDOWSsystem32LEXPPS.EXE C:windowssystem32audcntr.exe C:windowssystemhpsysdrv.exe C:ProgrammerUSB Storage RWshwicon.exe C:HPKBDKBD.EXE C:ProgrammerFælles filerSymantec SharedccApp.exe C:PROGRA~1ONELA~1ONEAL~1zlclient.exe C:ProgrammerWebrootSpy SweeperSpySweeper.exe C:WINDOWSSystem32alg.exe C:ProgrammerMouseMouse ControlPanel.exe C:ProgrammerFælles filerMicrosoft SharedVS7Debugmdm.exe C:ProgrammerNorton AntiVirus avapsvc.exe C:WINDOWSSystem32 vsvc32.exe C:ProgrammerNorton AntiVirusSAVScan.exe C:WINDOWSsystem32oneLabsvsmon.exe C:ProgrammerMessengermsmsgs.exe C:ProgrammerInternet Exploreriexplore.exe C:ProgrammerInternet ExplorerIEXPLORE.EXE C:Documents and SettingsEjerLokale indstillingerTemporary Internet FilesContent.IE5WT8X2ZWDhijackthis[1].exe R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton AntiVirusNavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton AntiVirusNavShExt.dll O4 - HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe O4 - HKLM..Run: [KYE_Showicon] "C:ProgrammerUSB Storage RWshwicon.exe" -t"KYEUSB Storage RW" O4 - HKLM..Run: [KBD] C:HPKBDKBD.EXE O4 - HKLM..Run: [StorageGuard] "C:ProgrammerVERITAS SoftwareUpdate Managersgtray.exe" /r O4 - HKLM..Run: [WCOLOREAL] C:ProgrammerColorealcoloreal.exe O4 - HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [Windows Explorer] LSAS.exe O4 - HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [ccApp] "C:ProgrammerFælles filerSymantec SharedccApp.exe" O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [Zone Labs Client] C:PROGRA~1ONELA~1ONEAL~1zlclient.exe O4 - HKLM..RunServices: [Windows Explorer] LSAS.exe O4 - HKCU..Run: [SpySweeper] "C:ProgrammerWebrootSpy SweeperSpySweeper.exe" /0 O4 - Global Startup: Mouse Control.lnk = C:ProgrammerMouseMouse ControlPanel.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000 O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00625BD00009} (Skjern Banks Netbank) - https://www.skjernbank.dk[...] O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com[...] O16 - DPF: {2A91CEB1-37F5-424C-997C-4C38A3677CD8} - http://akamai.downloadv3.com[...] O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com[...] O16 - DPF: {C56CE781-A6FC-4706-8B32-6EB4622155DF} (MediaConnect Control) - http://plugin.euro-infomedia.com[...] O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com[...]
--

Gæstebruger, opret dit eget login og få din egen signatur.

#1
Armageddon
Moderator
25-07-2004 17:52

Rapporter til Admin

Hejsa, Der er et par småting som lige skal fixes. Start med at deaktivere systemgendannelse. Højreklik på "Denne Computer" på skrivebordet, vælg egenskaber og fanebladet "Systemgendannelse" og sæt flueben i "Deaktiver systemgendannelse". Klik ok og genstart. Kør en ny scanning med HJT og sæt flueben ved disse: O4 - HKLM..Run: [Windows Explorer] LSAS.exe O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..RunServices: [Windows Explorer] LSAS.exe O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com[...] O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com[...] O16 - DPF: {C56CE781-A6FC-4706-8B32-6EB4622155DF} (MediaConnect Control) - http://plugin.euro-infomedia.com[...] Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand (tryk F8 efter POST skærmen). Find og slet disse: C:\windows\system32\audcntr.exe LSAS.exe (lav en global søgning) Genstart normalt. Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#2
henrik
Gæst
25-07-2004 18:27

Rapporter til Admin

Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand (tryk F8 efter POST skærmen). Find og slet disse: C:windowssystem32audcntr.exe LSAS.exe (lav en global søgning) har ikke helt forstået det sidste hvor skal jeg trykkr f8 Jeg har fjernet de andre
--
Gæstebruger, opret dit eget login og få din egen signatur.

#3
Tiger2
Ny på siden
25-07-2004 19:22

Rapporter til Admin

Logfile of HijackThis v1.98.0 Scan saved at 19:20:27, on 25-07-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32csrss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSExplorer.EXE C:ProgrammerFælles filerSymantec SharedccSetMgr.exe C:ProgrammerFælles filerSymantec SharedccEvtMgr.exe C:WINDOWSsystem32LEXBCES.EXE C:WINDOWSsystem32spoolsv.exe C:WINDOWSsystem32LEXPPS.EXE C:windowssystemhpsysdrv.exe C:ProgrammerUSB Storage RWshwicon.exe C:HPKBDKBD.EXE C:ProgrammerVERITAS SoftwareUpdate Managersgtray.exe C:ProgrammerFælles filerSymantec SharedccApp.exe C:PROGRA~1ONELA~1ONEAL~1zlclient.exe C:ProgrammerWebrootSpy SweeperSpySweeper.exe C:ProgrammerMouseMouse ControlPanel.exe C:WINDOWSSystem32alg.exe C:ProgrammerFælles filerMicrosoft SharedVS7Debugmdm.exe C:ProgrammerNorton AntiVirus avapsvc.exe C:WINDOWSSystem32 vsvc32.exe C:ProgrammerNorton AntiVirusSAVScan.exe C:WINDOWSsystem32oneLabsvsmon.exe C:ProgrammerMessengermsmsgs.exe C:Documents and SettingsEjerDokumentervirus programmerhijackthis.exe C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton AntiVirusNavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton AntiVirusNavShExt.dll O4 - HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe O4 - HKLM..Run: [KYE_Showicon] "C:ProgrammerUSB Storage RWshwicon.exe" -t"KYEUSB Storage RW" O4 - HKLM..Run: [KBD] C:HPKBDKBD.EXE O4 - HKLM..Run: [StorageGuard] "C:ProgrammerVERITAS SoftwareUpdate Managersgtray.exe" /r O4 - HKLM..Run: [WCOLOREAL] C:ProgrammerColorealcoloreal.exe O4 - HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [ccApp] "C:ProgrammerFælles filerSymantec SharedccApp.exe" O4 - HKLM..Run: [Zone Labs Client] C:PROGRA~1ONELA~1ONEAL~1zlclient.exe O4 - HKCU..Run: [SpySweeper] "C:ProgrammerWebrootSpy SweeperSpySweeper.exe" /0 O4 - Global Startup: Mouse Control.lnk = C:ProgrammerMouseMouse ControlPanel.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000 O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00625BD00009} (Skjern Banks Netbank) - https://www.skjernbank.dk[...] O16 - DPF: {2A91CEB1-37F5-424C-997C-4C38A3677CD8} - http://akamai.downloadv3.com[...] O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com[...] O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com[...]
--

#4
Armageddon
Moderator
25-07-2004 22:35

Rapporter til Admin

Der er lige en enkelt linie som skal fixes igen: O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com[...] Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart maskinen. Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#5
Tiger2
Ny på siden
26-07-2004 08:29

Rapporter til Admin

Mange tak for hjælpen her er ny ny log-file...Så skulle den være ren Logfile of HijackThis v1.98.0 Scan saved at 08:23:14, on 26-07-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32csrss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedccSetMgr.exe C:WINDOWSExplorer.EXE C:ProgrammerFælles filerSymantec SharedccEvtMgr.exe C:WINDOWSsystem32LEXBCES.EXE C:WINDOWSsystem32spoolsv.exe C:WINDOWSsystem32LEXPPS.EXE C:windowssystemhpsysdrv.exe C:ProgrammerUSB Storage RWshwicon.exe C:HPKBDKBD.EXE C:ProgrammerVERITAS SoftwareUpdate Managersgtray.exe C:ProgrammerFælles filerSymantec SharedccApp.exe C:PROGRA~1ONELA~1ONEAL~1zlclient.exe C:ProgrammerWebrootSpy SweeperSpySweeper.exe C:ProgrammerMouseMouse ControlPanel.exe C:WINDOWSSystem32alg.exe C:ProgrammerFælles filerMicrosoft SharedVS7Debugmdm.exe C:ProgrammerNorton AntiVirus avapsvc.exe C:WINDOWSSystem32 vsvc32.exe C:ProgrammerNorton AntiVirusSAVScan.exe C:PROGRA~1FLLESF~1SYMANT~1SCRIPT~1SBServ.exe C:WINDOWSsystem32oneLabsvsmon.exe C:ProgrammerMessengermsmsgs.exe C:Documents and SettingsEjerDokumentervirus programmerhijackthis.exe R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.dk[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton AntiVirusNavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton AntiVirusNavShExt.dll O4 - HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe O4 - HKLM..Run: [KYE_Showicon] "C:ProgrammerUSB Storage RWshwicon.exe" -t"KYEUSB Storage RW" O4 - HKLM..Run: [KBD] C:HPKBDKBD.EXE O4 - HKLM..Run: [StorageGuard] "C:ProgrammerVERITAS SoftwareUpdate Managersgtray.exe" /r O4 - HKLM..Run: [WCOLOREAL] C:ProgrammerColorealcoloreal.exe O4 - HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [ccApp] "C:ProgrammerFælles filerSymantec SharedccApp.exe" O4 - HKLM..Run: [Zone Labs Client] C:PROGRA~1ONELA~1ONEAL~1zlclient.exe O4 - HKCU..Run: [SpySweeper] "C:ProgrammerWebrootSpy SweeperSpySweeper.exe" /0 O4 - Global Startup: Mouse Control.lnk = C:ProgrammerMouseMouse ControlPanel.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000 O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00625BD00009} (Skjern Banks Netbank) - https://www.skjernbank.dk[...] O16 - DPF: {2A91CEB1-37F5-424C-997C-4C38A3677CD8} - http://akamai.downloadv3.com[...] O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com[...]
--