Hejsa
Har et ret irriterende problem med en popup box der kommer hele tiden med "You computer is infected" og når man trykker vil den installere SpyAxe hvilket er noget underligt noget.
Boxen ser sådan ud :
http://kass.dk[...]
Billedet er fra en anden tråd her fra HOL, hpber ikke det gør noget at jeg låner ;)
Logfile of HijackThis v1.99.1
Scan saved at 18:32:02, on 03-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:ProgrammerMicrosoft AntiSpywaregcasServ.exe
C:WINDOWSsystem32ctfmon.exe
C:ProgrammerMessengermsmsgs.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:ProgrammerHewlett-PackardDigital Imaginginhpohmr08.exe
C:ProgrammerHewlett-PackardDigital Imaginginhpotdd01.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammerHewlett-PackardDigital Imaginginhpoevm08.exe
C:ProgrammerHewlett-PackardDigital ImagingBinhpoSTS08.exe
C:ProgrammerMicrosoft AntiSpywaregcasDtServ.exe
C:Programmerewidosecurity suiteewidoguard.exe
C:Programmerewidosecurity suiteewidoctrl.exe
C:ProgrammerInternet Exploreriexplore.exe
C:Documents and SettingsJens & AaseSkrivebordhijackthis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.bgbank.dk[...]
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext =
http://windowsupdate.microsoft.com[...]
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks
O2 - BHO: HomepageBHO - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - C:WINDOWSsystem32hp72FE.tmp (file missing)
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [gcasServ] "C:ProgrammerMicrosoft AntiSpywaregcasServ.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:ProgrammerMessengermsmsgs.exe" /background
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:ProgrammerAdobeAcrobat 7.0Reader
eader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammerJavajre1.5.0_04in
pjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammerJavajre1.5.0_04in
pjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammerMessengermsmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.com[...]
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) -
https://netbank.bgbank.dk[...]
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:Programmerewidosecurity suiteewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:Programmerewidosecurity suiteewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:WINDOWSsystem32HPZipm12.exe
--