Hjælp til tjek af logfil fra HijackThis!
HejVi har problemer med, at vores browser automatisk springer over på www.cool-homepage.com og supret.com fra debitel.dk (vores normale startside). Grundet deres pornografiske indhold, har vi installeret Spywareblaster og Spywareguard. De forhindrer nu, at dette sker. Men vi vil gerne have fjernet al snavset, der ligger på vores PC somewhere. Vi har lige downloaded HijackThis, og har fået følgende logfil. Kan i hjælpe os med at sortere skidt og kanel?
Med venlig hilsen
Gnoeffe
Logfile of HijackThis v1.97.3
Scan saved at 14:30:57, on 17-10-2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmer\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\Programmer\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmer\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Programmer\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\WINNT\system32\msrexe.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Trend Micro\PC-cillin 2000\PNTIOMON.exe
D:\program files\SpywareGuard\sgmain.exe
D:\program files\SpywareGuard\sgbhp.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
D:\program files\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.martfinder.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.debitel.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.supret.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.white-pages.ws/results.php?show=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-homepage.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/www.searchv.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.debitel.dk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Debitel
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.pantyplace.com/sadoslaves/free/free_porn.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.pantyplace.com/sadoslaves/free/free_porn.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://cool-homepage.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFAF} - C:\DOCUME~1\MARTIN~1\LOKALE~1\Temp\msfgfj.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\program files\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programmer\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Programmer\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [System Service] C:\WINNT\system32\msrexe.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: SpywareGuard.lnk = D:\program files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Real-time Monitor.lnk = C:\Programmer\Trend Micro\PC-cillin 2000\PNTIOMON.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Enjoy It (HKLM)
O9 - Extra 'Tools' menuitem: Enjoy It (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O13 - DefaultPrefix: http://auto.search.msn.com:3128@%61%72%68%65%6F%2E%63%6F%6D/%63%67%69%2D%62%69%6E/c.pl?url=
O14 - IERESET.INF: START_PAGE_URL=http://www.debitel.dk
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/215b86c8c6aaafc68820/netzip/RdxIE601.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.bgbank.dk/bgnetbank/activex/DanskeSikker.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D64CC6ED-4C90-4563-AB14-D5DFC15B55E8}: NameServer = 212.242.40.3 212.242.40.51
