nogle der vil tjekke min hjt log?

Af Megabruger McDrive | 01-08-2004 22:37 | 930 visninger | 5 svar, hop til seneste

min puter er lidt sløv så jeg fik endelig mig selv til at smide en log herind.. og jeg har ingen forstand på hvordan man gør, så hvis i lige forklarer hva jeg skal gøre grundigt bliver jeg glad.. på forhånd tak, og godnat Logfile of HijackThis v1.98.1 Scan saved at 22:31:46, on 01-08-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedccSetMgr.exe C:ProgrammerFælles filerSymantec SharedccEvtMgr.exe C:WINDOWSsystem32spoolsv.exe C:ProgrammerFælles filerSymantec SharedccProxy.exe C:PROGRA~1NORTON~2NORTON~3GHOSTS~2.EXE C:ProgrammerFælles filerMicrosoft SharedVS7DEBUGMDM.EXE C:ProgrammerNorton Internet SecurityNorton AntiVirus avapsvc.exe C:PROGRA~1NORTON~2NORTON~1NPROTECT.EXE C:WINDOWSSystem32 vsvc32.exe C:ProgrammerNorton Internet SecurityNorton AntiVirusSAVScan.exe C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe C:PROGRA~1NORTON~2NORTON~1SPEEDD~1NOPDB.EXE C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedCCPD-LCsymlcsvc.exe C:WINDOWSExplorer.EXE C:WINDOWSSystem32RUNDLL32.EXE C:ProgrammerFælles filerSymantec SharedccApp.exe C:WINDOWSSystem32RunDll32.exe C:ProgrammerJavaj2re1.4.2_04injusched.exe C:ProgrammerNorton SystemWorksPassword ManagerAcctMgr.exe C:ProgrammerNaviSearchin ls.exe C:ProgrammerBullsEye Networkinargains.exe C:ProgrammerMSN MessengerMsnMsgr.Exe C:WINDOWSSystem32ctfmon.exe C:ProgrammerMessengermsmsgs.exe C:ProgrammerInternet ExplorerIEXPLORE.EXE C:ProgrammerSteamSteam.exe C:WINDOWSsvchost.exe C:Documents and SettingsJesperSkrivebordHijackThis.exe R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://crackspider.net[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.hol.dk[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://crackspider.net[...] R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:WINDOWSDownloaded Program FilesCONFLICT.1ridge.dll O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:ProgrammerFælles filerSymantec SharedAdBlockingNISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton Internet SecurityNorton AntiVirusNavShExt.dll O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:WINDOWSSystem32apuc.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:ProgrammerFælles filerSymantec SharedAdBlockingNISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton Internet SecurityNorton AntiVirusNavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit O4 - HKLM..Run: [ccApp] "C:ProgrammerFælles filerSymantec SharedccApp.exe" O4 - HKLM..Run: [URLLSTCK.exe] C:ProgrammerNorton Internet SecurityUrlLstCk.exe O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM..Run: [SunJavaUpdateSched] C:ProgrammerJavaj2re1.4.2_04injusched.exe O4 - HKLM..Run: [AcctMgr] C:ProgrammerNorton SystemWorksPassword ManagerAcctMgr.exe /startup O4 - HKLM..Run: [RunDLL] rundll32.exe "C:WINDOWSDownloaded Program FilesCONFLICT.1ridge.dll",Load O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [TrojanScanner] C:ProgrammerTrojan RemoverTrjscan.exe O4 - HKCU..Run: [MsnMsgr] "C:ProgrammerMSN MessengerMsnMsgr.Exe" /background O4 - HKCU..Run: [Steam] "c:progra~1steamsteam.exe" -silent O4 - HKCU..Run: [Symantec NetDriver Monitor] C:PROGRA~1SymantecLIVEUP~1SNDMon.EXE O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk.disabled O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net[...] O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com[...] O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com[...] O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com[...] O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com[...] O17 - HKLMSystemCCSServicesTcpip..{59ACB718-49D8-493E-A756-7D08C4134B1E}: NameServer = 193.162.153.164 194.239.134.83
--

We want fun

#1
Armageddon
Moderator
02-08-2004 00:54

Rapporter til Admin

Hejsa, Der er et par småting som lige skal fixes. Start med at deaktivere systemgendannelse. Højreklik på "Denne Computer" på skrivebordet, vælg egenskaber og fanebladet "Systemgendannelse" og sæt flueben i "Deaktiver systemgendannelse". Klik ok og genstart. Kør en ny scanning med HJT og sæt flueben ved disse: R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://crackspider.net[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://crackspider.net[...] R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = R3 - Default URLSearchHook is missing O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:WINDOWSDownloaded Program FilesCONFLICT.1 ridge.dll O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:WINDOWSSystem32apuc.dll O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [SunJavaUpdateSched] C:ProgrammerJavaj2re1.4.2_04 injusched.exe O4 - HKLM..Run: [RunDLL] rundll32.exe "C:WINDOWSDownloaded Program FilesCONFLICT.1 ridge.dll",Load O4 - Global Startup: InterVideo WinCinema Manager.lnk.disabled O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net[...] O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com[...] O17 - HKLMSystemCCSServicesTcpip..{59ACB718-49D8-493E-A756-7D08C4134B1E}: NameServer = 193.162.153.164 194.239.134.83 Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand (tryk F8 efter POST skærmen). Find og slet disse mapper og filer (sørg for at ændre mappeindstillinger så du kan se systemfiler og skjulte filer): C:\Programmer\NaviSearch\ C:\Programmer\BullsEye Network\ C:\WINDOWS\Downloaded Program Files\CONFLICT.1\bridge.dll C:\WINDOWS\System32\apuc.dll Genstart normalt. Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#2
McDrive
Megabruger
02-08-2004 15:44

Rapporter til Admin

så er jeg endelig tilbage med en ny log.. og det skal lige siges at F8 ikke hjælper, det får boot menuen frem og ikke andet. Logfile of HijackThis v1.98.1 Scan saved at 15:46:22, on 02-08-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedccSetMgr.exe C:ProgrammerFælles filerSymantec SharedccEvtMgr.exe C:WINDOWSsystem32spoolsv.exe C:ProgrammerFælles filerSymantec SharedccProxy.exe C:PROGRA~1NORTON~2NORTON~3GHOSTS~2.EXE C:ProgrammerFælles filerMicrosoft SharedVS7DEBUGMDM.EXE C:ProgrammerNorton Internet SecurityNorton AntiVirus avapsvc.exe C:WINDOWSExplorer.EXE C:PROGRA~1NORTON~2NORTON~1NPROTECT.EXE C:WINDOWSSystem32 vsvc32.exe C:WINDOWSSystem32RUNDLL32.EXE C:ProgrammerFælles filerSymantec SharedccApp.exe C:WINDOWSSystem32RunDll32.exe C:ProgrammerNorton Internet SecurityNorton AntiVirusSAVScan.exe C:ProgrammerMSN MessengerMsnMsgr.Exe C:WINDOWSSystem32ctfmon.exe C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe C:PROGRA~1NORTON~2NORTON~1SPEEDD~1NOPDB.EXE C:WINDOWSSystem32svchost.exe C:ProgrammerFælles filerSymantec SharedCCPD-LCsymlcsvc.exe C:ProgrammerMessengermsmsgs.exe C:Documents and SettingsJesperSkrivebordHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.hol.dk[...] R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:ProgrammerFælles filerSymantec SharedAdBlockingNISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton Internet SecurityNorton AntiVirusNavShExt.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:ProgrammerFælles filerSymantec SharedAdBlockingNISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton Internet SecurityNorton AntiVirusNavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit O4 - HKLM..Run: [ccApp] "C:ProgrammerFælles filerSymantec SharedccApp.exe" O4 - HKLM..Run: [URLLSTCK.exe] C:ProgrammerNorton Internet SecurityUrlLstCk.exe O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM..Run: [AcctMgr] C:ProgrammerNorton SystemWorksPassword ManagerAcctMgr.exe /startup O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [TrojanScanner] C:ProgrammerTrojan RemoverTrjscan.exe O4 - HKCU..Run: [MsnMsgr] "C:ProgrammerMSN MessengerMsnMsgr.Exe" /background O4 - HKCU..Run: [Steam] "c:progra~1steamsteam.exe" -silent O4 - HKCU..Run: [Symantec NetDriver Monitor] C:PROGRA~1SymantecLIVEUP~1SNDMon.EXE O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com[...] O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com[...] O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.wow-europe.com[...]
--
We want fun

#3
Armageddon
Moderator
02-08-2004 15:50

Rapporter til Admin

Så er loggen helt ren. Det gik alligevel uden at komme i fejlsikret tilstand kan jeg se, men du skriver ikke om du har fået slette de nævnte filer og mapper. Hvis du ikke har så gør det nu i normal tilstand. Sørg for at tømme papirkurven bagefter. Som det sidste kan du aktivere systemgendannelse igen.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#4
McDrive
Gigabruger
02-08-2004 15:52

Rapporter til Admin

det var godt.. hva har alle de ting, der nu er fjernet, gjort ved mit system?
--
We want fun

#5
Armageddon
Moderator
02-08-2004 16:00

Rapporter til Admin

Det er adware som henter en masse skrammel ned på computeren og viser popup reklamer.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]