HijackThis log. hjæp :D

Af Semibruger waxx | 24-10-2004 12:11 | 885 visninger | 1 svar, hop til seneste

kan i hjælpe mig med dette... i for lige min Log : Logfile of HijackThis v1.98.2 Scan saved at 12:03:31, on 24-10-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:ProgrammerTGTSoftStyleXPStyleXPService.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSExplorer.EXE C:WINDOWSSystem32serviceswmplayer.exe C:Program FilesWindows SyncroAdSyncroAd.exe C:Program FilesWindows SyncroAdWinSync.exe C:ProgrammerGrisoftAVG6avgcc32.exe C:WINDOWSSystem32 undll32.exe C:ProgrammerMessenger Plus! 3MsgPlus.exe C:ProgrammerQuickTimeqttask.exe C:ProgrammerInternet Exploreriexplore.exe C:ProgrammeriTunesiTunesHelper.exe C:ProgrammerD-Toolsdaemon.exe C:WINDOWSSystem32ctfmon.exe C:WINDOWSSystem32RUNDLL32.EXE C:ProgrammerTGTSoftStyleXPStyleXP.exe c:progra~1intern~1iexplore.exe C:ProgrammerMessengermsmsgs.exe C:PROGRA~1GrisoftAVG6avgserv.exe C:ProgrammerFælles filerGMTGMT.exe C:ProgrammerFælles filerMicrosoft SharedVS7Debugmdm.exe C:WINDOWSSystem32 vsvc32.exe C:ProgrammerSpywareGuardsgmain.exe C:ProgrammerSpywareGuardsgbhp.exe C:ProgrammerMSN Messengermsnmsgr.exe C:ProgrammeriPodiniPodService.exe C:WINDOWSSystem32svchost.exe C:ProgrammerInternet Exploreriexplore.exe C:eJayDance4ejayejayd_ejay4.exe C:Documents and SettingsLouis BjerreDokumenterSpywarehijackthis.exe R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.vqulqgyxybgcuxg.com[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.bixrwfqhyvhipnbsfjp.us[...] R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://lookfor.cc[...] R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:WINDOWSDownloaded Program Files undlg32.dll F3 - REG:win.ini: run=C:WINDOWSSystem32serviceswmplayer.exe O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file) O4 - HKLM..Run: [xpsystem] C:WINDOWSSystem32serviceswmplayer.exe O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [Windows SyncroAd] C:Program FilesWindows SyncroAdSyncroAd.exe O4 - HKLM..Run: [AVG_CC] C:ProgrammerGrisoftAVG6avgcc32.exe /startup O4 - HKLM..Run: [CMESys] "C:ProgrammerFælles filerCMEIICMESys.exe" O4 - HKLM..Run: [eDonkey2000] "C:ProgrammereDonkey2000edonkey2000.exe" -t O4 - HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,NewDotNetStartup -s O4 - HKLM..Run: [MessengerPlus3] "C:ProgrammerMessenger Plus! 3MsgPlus.exe" O4 - HKLM..Run: [locks bags name delete] C:Documents and SettingsAll UsersApplication DataFAST ROAD LOCKS BAGSsafe readme.exe O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime O4 - HKLM..Run: [iTunesHelper] C:ProgrammeriTunesiTunesHelper.exe O4 - HKLM..Run: [DAEMON Tools-1033] "C:ProgrammerD-Toolsdaemon.exe" -lang 1033 O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe O4 - HKCU..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU..Run: [Basr] C:Documents and SettingsLouis BjerreApplication Datasptr.exe O4 - HKCU..Run: [Kjsxutiq] C:WINDOWSSystem32zqfs.exe O4 - HKCU..Run: [Spyware Begone] C:freescanfreescan.exe -FastScan O4 - HKCU..Run: [STYLEXP] C:ProgrammerTGTSoftStyleXPStyleXP.exe -Hide O4 - HKCU..Run: [MessengerPlus3] "C:ProgrammerMessenger Plus! 3MsgPlus.exe" /WinStart O4 - HKCU..Run: [xpsystem] C:WINDOWSSystem32serviceswmplayer.exe O4 - HKCU..Run: [More hope] C:DOCUME~1LOUISB~1APPLIC~1ARMYBA~1Scr Byte Beep.exe O4 - HKCU..Run: [MSMSGS] "C:ProgrammerMessengermsmsgs.exe" /background O4 - HKCU..Run: [msnmsgr] "C:ProgrammerMSN Messengermsnmsgr.exe" /background O4 - Startup: SpywareGuard.lnk = C:ProgrammerSpywareGuardsgmain.exe O4 - Global Startup: GStartup.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:ProgrammerMicrosoft OfficeOffice10OSA.EXE O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~4Office10EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengerMSMSGS.EXE O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.xxxtoolbar.com O16 - DPF: v2cab - http://searchmiracle.com[...] O16 - DPF: v3cab - http://searchmiracle.com[...] O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com[...] O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com[...]
--

Man har kun det sjov man selv laver... og det FUN man selv blander msn: [email protected]

#1
Armageddon
Moderator
24-10-2004 13:33

Rapporter til Admin

Hejsa, Der skal virkelig muges ud hos dig!. Start med at deaktivere systemgendannelse. Højreklik på "Denne Computer" på skrivebordet, vælg egenskaber og fanebladet "Systemgendannelse" og sæt flueben i "Deaktiver systemgendannelse". Klik ok og genstart. Afinstaller om muligt Messenger Plus! 3 og eDonkey i Tilføj/fjern programmer. Hent disse værktøjer: Ad-Aware SE Personal http://www.lavasoft.de[...] SpyBot S&D http://www.safer-networking.org[...] CWShredder http://www.mdegn.dk[...] FINDnFIX http://downloads.subratam.org[...] http://www.mdegn.dk[...] http://www.mdegn.dk[...] Installer Ad-Aware, SpyBot og CWShredder og opdater dem online. Fjern netkablet så der ikke er forbindelse til nettet. Kør en ny scanning med HJT og sæt flueben ved disse: R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.vqulqgyxybgcuxg.com[...] R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.bixrwfqhyvhipnbsfjp.us[...] R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://lookfor.cc[...] R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32ljvib.dll/sp.html#29126 R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:WINDOWSDownloaded Program Filesrundlg32.dll F3 - REG:win.ini: run=C:WINDOWSSystem32serviceswmplayer.exe O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file) O4 - HKLM..Run: [xpsystem] C:WINDOWSSystem32serviceswmplayer.exe O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [Windows SyncroAd] C:Program FilesWindows SyncroAdSyncroAd.exe O4 - HKLM..Run: [CMESys] "C:ProgrammerFælles filerCMEIICMESys.exe" O4 - HKLM..Run: [eDonkey2000] "C:ProgrammereDonkey2000edonkey2000.exe" -t O4 - HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,NewDotNetStartup -s O4 - HKLM..Run: [MessengerPlus3] "C:ProgrammerMessenger Plus! 3MsgPlus.exe" O4 - HKLM..Run: [locks bags name delete] C:Documents and SettingsAll UsersApplication DataFAST ROAD LOCKS BAGSsafe readme.exe O4 - HKLM..Run: [QuickTime Task] "C:ProgrammerQuickTimeqttask.exe" -atboottime O4 - HKCU..Run: [Basr] C:Documents and SettingsLouis BjerreApplication Datasptr.exe O4 - HKCU..Run: [Kjsxutiq] C:WINDOWSSystem32 zqfs.exe O4 - HKCU..Run: [Spyware Begone] C:freescanfreescan.exe -FastScan O4 - HKCU..Run: [MessengerPlus3] "C:ProgrammerMessenger Plus! 3MsgPlus.exe" /WinStart O4 - HKCU..Run: [xpsystem] C:WINDOWSSystem32serviceswmplayer.exe O4 - HKCU..Run: [More hope] C:DOCUME~1LOUISB~1APPLIC~1ARMYBA~1Scr Byte Beep.exe O4 - Global Startup: GStartup.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:ProgrammerMicrosoft OfficeOffice10OSA.EXE O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.xxxtoolbar.com O16 - DPF: v2cab - http://searchmiracle.com[...] O16 - DPF: v3cab - http://searchmiracle.com[...] Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand (tryk F8 efter POST skærmen). Find og slet disse filer & mapper (husk at ændre mappeindstillinger så du kan se skjulte filer samt systemfiler): C:\WINDOWS\system32\ljvib.dll C:\WINDOWS\Downloaded Program Files\rundlg32.dll C:\WINDOWS\System32\services\wmplayer.exe C:\Program Files\Windows SyncroAd\ C:\Programmer\Fælles filer\CMEII\ C:\Programmer\eDonkey2000\ C:\PROGRA~1\NEWDOT~1\ C:\Programmer\Messenger Plus! 3\ C:\Documents and Settings\All Users\Application Data\FAST ROAD LOCKS BAGS\ C:\Documents and Settings\Louis Bjerre\Application Data\sptr.exe C:\WINDOWS\System32\ zqfs.exe C:\freescan\ C:\DOCUME~1\LOUISB~1\APPLIC~1\ARMYBA~1\Scr Byte Beep.exe Kør så Ad-Aware, SpyBot og CWShredder efter tur og fix/afhjælp problemerne. Genstart normalt. Tjek om netforbindelsen virker - hvis den ikke gør skal du køre WinsockXPFix & lspfix. Så er det tid til at installere FINDnFIX - den pakker programmet ud til C:FINDnFIX - her klikker du på !LOG!.bat og lader det hele køre. Der bliver scannet og oprettet en log som hedder log.txt - kopier indholdet herind på samme måde som med HJT (kopier denne log i et særskilt indlæg). Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]