Søg
Avatar billede johnstigers Seniormester
26. december 2003 - 21:10 Der er 23 kommentarer og
1 løsning

Hijackthis log der skal tjekkes.

Logfile of HijackThis v1.97.7
Scan saved at 20:58:24, on 26-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe
C:\Programmer\Netropa\Touch Manager\MEDIACTR.EXE
C:\PROGRA~1\NETROPA\ONSCRE~1\OSD.EXE
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\windows\rundll32.exe
C:\Programmer\Netropa\Touch Manager\MMUSBKB2.EXE
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
E:\Back_up\escape\ESCape.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[3].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[3].exe
C:\Documents and Settings\John Stigers\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://webcoolsearch.com/?id=54
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://webcoolsearch.com/?id=54
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://webcoolsearch.com/?id=54
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.komogvind.dk/index.php?mtt=107245949833
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.newsexgate.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Touch Manager] C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe
O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {5053A978-5972-4D8E-BEC7-3E8D4BC6B830} - http://juicyland.com/dp5000.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37975.5115046296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5
Avatar billede bredker Nybegynder
26. december 2003 - 21:22 #1
john>>så tit som du skal have tjækket din maskine burde du da snart selv kunne genkende dem der skal renses ud
Avatar billede johnstigers Seniormester
26. december 2003 - 21:27 #2
:)

ja, eller brugfe etprogram der kan standse disse ting...
Avatar billede aovergaard Nybegynder
26. december 2003 - 21:27 #3
Hent cwsschredder her:
http://www.spywareinfo.com/~merijn/junk/CWShredder.exe
Kør programmet, tjek for updates, luk alle vinduer, undtaget cwsschredder, klik på Next, den scanner nu, når den er færdigt klik på Next, klik på Exit.

Ny logfil.
Avatar billede johnstigers Seniormester
26. december 2003 - 21:44 #4
Her er log efter scan med cwsshredder:

Logfile of HijackThis v1.97.7
Scan saved at 21:33:04, on 26-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\windows\rundll32.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[3].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[3].exe
C:\WINDOWS\System32\svchost.exe
E:\Back_up\escape\ESCape.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Documents and Settings\John Stigers\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.komogvind.dk/index.php?mtt=107245949833
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Touch Manager] C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe
O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {5053A978-5972-4D8E-BEC7-3E8D4BC6B830} - http://juicyland.com/dp5000.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37975.5115046296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5
Avatar billede aovergaard Nybegynder
26. december 2003 - 22:03 #5
Du skal nu til at i gang med at fixe. Først skal du slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør det så kig her: http://www.spywarefri.dk/virus.htm#alle Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte en vinge ud for alle disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked. Efter fix skal du genstarte din computer.

Det er disse, som skal fixes:

O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe

O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm

O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {5053A978-5972-4D8E-BEC7-3E8D4BC6B830} - http://juicyland.com/dp5000.dll

Genstart i fejlsikret tilstand. Find og fjern:

C:\PROGRA~1\DAP\DAP.EXE
Gå også I tilføj/fjern prg. og fjern den herfra.

Dem her ville jeg osgå fjerne:
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[2].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\3QCN7DW5\od-teen218[3].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[3].exe

Og så har du ikke servicepack1 på, derfor ryger du i problemer. Du skal have opdateret dit Windows. Dap er noget skrammel, som altid kommer med flere grimme ting, og det er bla. den som også er skyld i dine problemer.

Genstart ny log
Avatar billede johnstigers Seniormester
26. december 2003 - 22:10 #6
Logfile of HijackThis v1.97.7
Scan saved at 21:59:04, on 26-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\windows\rundll32.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\Programmer\Outlook Express\msimn.exe
C:\WINDOWS\System32\svchost.exe
E:\Back_up\escape\ESCape.exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\HBRRTP0E\od-teen218[1].exe
C:\Documents and Settings\John Stigers\Lokale indstillinger\Temporary Internet Files\Content.IE5\Y1DAVQ1K\od-teen218[4].exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\John Stigers\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.komogvind.dk/index.php?mtt=107245949833
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Touch Manager] C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe
O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Programmer\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37975.5115046296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5

Dog uden SP1 - den kommer snarest på.
Avatar billede johnstigers Seniormester
26. december 2003 - 22:11 #7
ups....!

jeg gør det lige om.
Avatar billede aovergaard Nybegynder
26. december 2003 - 22:22 #8
Fixes:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe

Fra fejlsikret tilstand find og fjern
C:\windows\rundll32.exe = filen rundll32.exe
Avatar billede johnstigers Seniormester
26. december 2003 - 22:39 #9
Sådan:

Logfile of HijackThis v1.97.7
Scan saved at 22:28:03, on 26-12-2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\Netropa\Touch Manager\MEDIACTR.EXE
C:\PROGRA~1\NETROPA\ONSCRE~1\OSD.EXE
C:\Programmer\Netropa\Touch Manager\MMUSBKB2.EXE
E:\Back_up\escape\ESCape.exe
C:\Documents and Settings\John Stigers\Skrivebord\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.komogvind.dk/index.php?mtt=107245949833
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Touch Manager] C:\Programmer\Netropa\Touch Manager\TouchMgr.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37975.5115046296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5
Avatar billede johnstigers Seniormester
26. december 2003 - 22:40 #10
Men HVAD er dette???

O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5
 
Syntes ikke jeg har set den linie før...???
Avatar billede aovergaard Nybegynder
26. december 2003 - 22:57 #11
Fix lige denne

O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab


Den her hører til dit stofanet, så den må du ikke fixe:
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5

Bagefter kan du aktivere din systemgendannelse igen. Og husk nu endelig det med at få opdatere Xp.
Avatar billede johnstigers Seniormester
27. december 2003 - 12:41 #12
Takker :)
Avatar billede johnstigers Seniormester
27. december 2003 - 14:15 #13
aovergaard> der har ikke været systemfiler indblandet, så jeg brugte ikke systemgendannelse.
Avatar billede victor-1 Nybegynder
27. december 2003 - 15:21 #14
"john stigers"
Om jeg fatter hvorfor en bruger som du, der er så velbefaren i WindowXP IKKE bruger service pack 1.
?????
Avatar billede johnstigers Seniormester
27. december 2003 - 15:37 #15
Ren og skær dovenskab.
Avatar billede victor-1 Nybegynder
27. december 2003 - 15:41 #16
Ja det kommer mig i den grad for - det er blot et par små bevægelser med pegefingeren. *GG*

Kan jeg finde din e-mail adr. et eller andet sted ?
Avatar billede johnstigers Seniormester
27. december 2003 - 15:44 #17
http://www.eksperten.dk/bruger.phtml?navn=john_stigers - den tjekker jeg ikke så tit  - ellers brug johnstigers (@) stofanet DOT dk
Avatar billede victor-1 Nybegynder
27. december 2003 - 15:55 #18
Har sendt dig en mail -
brugte denne - brug johnstigers (@) stofanet DOT dk
Avatar billede aovergaard Nybegynder
27. december 2003 - 17:34 #19
Takker for point;) Så må vi jo se hvor længe det holder denne gang, når du ikke vil opdatere ;)

Godt Nytår
Avatar billede johnstigers Seniormester
30. december 2003 - 23:00 #20
aovergaard> Nu er XP opdateret :)
Tag lige et hurtigt kig på loggen nu:

Logfile of HijackThis v1.97.7
Scan saved at 22:59:34, on 30-12-2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\VsStat.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmer\Fælles filer\Network Associates\McShield\Mcshield.exe
C:\Programmer\McAfee\McAfee VirusScan\Avconsol.exe
E:\Back_up\escape\ESCape.exe
C:\Documents and Settings\John Stigers\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.komogvind.dk/index.php?mtt=107040323988
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Programmer\DAP\DAPBHO.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmer\DAP\DAPIEBar.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Programmer\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: C-D.lnk = C:\Programmer\Cheating-Death\cdeath.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37975.5115046296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6105EC4E-DC56-487E-903C-BC3CA03B33DE}: NameServer = 212.10.24.252,212.10.10.4,212.10.10.5
Avatar billede aovergaard Nybegynder
30. december 2003 - 23:34 #21
Fixes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Programmer\DAP\DAPBHO.dll (file missing)

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmer\DAP\DAPIEBar.dll (file missing)

O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP

O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm

O9 - Extra button: Run DAP (HKLM)

Det er jo dap som kommer med en masse snavs, så jeg ville da vælge at fixe alle disse, men det skal jo komme an på dig selv.

Bortset fra det, så er resten ok. ;) Og dejligt at se at du endelig har givet dig tid til at installere de updates.

Godt nytår
Avatar billede victor-1 Nybegynder
31. december 2003 - 02:44 #22
Du er for tidligt ude med dit "nytårs-fortsæt", nemlig IKKE at være doven :)

(ref. til din kommentar CITAT: Ren og skær dovenskab. CITAT SLUT.)

Godt Nytår (o;
Avatar billede johnstigers Seniormester
31. december 2003 - 13:13 #23
Tak for dn ekstra hjælp. DAP m.m. er fjernet.
Avatar billede aovergaard Nybegynder
31. december 2003 - 13:21 #24
Velbekommen.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
SQL kurser
Computerworld tilbyder specialiserede kurser i database-management
Se alle SQL kurser

Flere spørgsmål fra Fri debat kategorien

Titel Indlæg Oprettet Seneste aktivitet
Vedr. Windows 11 version 26H2 Af ErikHg i Fri debat 7 02/10/202621:29 04/10/202606:52
DBA er ikke hvad det tidligere var - desværre! Af ErikHg i Fri debat 5 21/09/202610:39 03/10/202600:02
Powerbank Af postpeter@outlook.dk i Fri debat 1 24/08/202610:45 24/08/202610:46
Samsung smart TV Af postpeter@outlook.dk i Fri debat 7 20/08/202615:01 22/08/202618:39
morf bilede Af knuldefar1942 i Fri debat 4 08/08/202612:15 09/08/202606:07
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I dag 15:18 Hvordan er det - At man sætter et billed af en ting her på ? Af Ikke-ekspert i Diverse
I går 13:58 Status på UPS Af dcedata1977 i Andet hardware
02/1101:00 Problemer med software til Power Walker UPS - Nødstrømsbatteri Af ErikHg i Andet software
01/1120:16 Snapchat Af made18 i Apps til iOS
31/1013:01 Måned og år på graf Af mort1 i Excel
White papers
Flere white papers »