Hej
ja, undskyld forsinkelsen men jeg har haft lidt småtravlt idag :-)
Jeg har kørt CWShredder og lavet denne nye log:
Logfile of HijackThis v1.97.7
Scan saved at 21:32:26, on 10-02-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMER\BROWSER MOUSE\BROWSER MOUSE\1.0\LWBWHEEL.EXE
C:\PROGRAMMER\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.msn.dk/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www001.upp.so-net.ne.jp:3128@DF809JOW4WJ2304LFD0SF9FS0A2T4LDF809JOW4WJ2304LFD0SF9FSD0A2T4LD.DF809JOW4WJ2304LFD0SF9FSD0A2T4LDF809JOW4WJ2304LFD0SF9FSD0A2T4LD.BIZ/search.htm (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.msn.dkR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O1 - Hosts: 66.159.18.184 mt1.mtree.com
O1 - Hosts: 66.159.18.184 mt2.mtree.com
O1 - Hosts: 66.159.18.184 mt3.mtree.com
O1 - Hosts: 66.159.18.184 mt4.mtree.com
O1 - Hosts: 66.159.18.184 mt5.mtree.com
O1 - Hosts: 66.159.18.184 mt6.mtree.com
O1 - Hosts: 66.159.18.184 mt7.mtree.com
O1 - Hosts: 66.159.18.184 mt8.mtree.com
O1 - Hosts: 66.159.18.184 mt9.mtree.com
O1 - Hosts: 66.159.18.184 mt10.mtree.com
O1 - Hosts: 66.159.18.184 mt11.mtree.com
O1 - Hosts: 66.159.18.184 mt12.mtree.com
O1 - Hosts: 66.159.18.184 mt13.mtree.com
O1 - Hosts: 66.159.18.184 mt14.mtree.com
O1 - Hosts: 66.159.18.184 mt15.mtree.com
O1 - Hosts: 66.159.18.184 mt16.mtree.com
O1 - Hosts: 66.159.18.184 mt17.mtree.com
O1 - Hosts: 66.159.18.184 mt18.mtree.com
O1 - Hosts: 66.159.18.184 mt19.mtree.com
O1 - Hosts: 66.159.18.184 mt20.mtree.com
O1 - Hosts: 66.159.18.184 mt21.mtree.com
O1 - Hosts: 66.159.18.184 mt22.mtree.com
O1 - Hosts: 66.159.18.184 mt23.mtree.com
O1 - Hosts: 66.159.18.184 mt24.mtree.com
O1 - Hosts: 66.159.18.184 mt25.mtree.com
O1 - Hosts: 66.159.18.184 mt26.mtree.com
O1 - Hosts: 66.159.18.184 mt27.mtree.com
O1 - Hosts: 66.159.18.184 mt28.mtree.com
O1 - Hosts: 66.159.18.184 mt29.mtree.com
O1 - Hosts: 66.159.18.184 mt30.mtree.com
O1 - Hosts: 66.159.18.184 the.sextracker.com
O1 - Hosts: 66.159.18.184 lobby.sexlist.com
O1 - Hosts: 66.159.18.184 in.paycounter.com
O1 - Hosts: 66.159.18.184 adv.sexcounter.com
O1 - Hosts: 66.159.18.184 rd1.hitbox.com
O1 - Hosts: 66.159.18.184 refer.ccbill.com
O1 - Hosts: 66.159.18.184
www.ccbill.comO1 - Hosts: 66.159.18.184 select.2000charge.com
O1 - Hosts: 66.159.18.184 secure.2000charge.com
O1 - Hosts: 66.159.18.184
www.signup.globill-systems.comO1 - Hosts: 66.159.18.184 secure.visionbill.net
O1 - Hosts: 66.159.18.184
www.dibill.comO1 - Hosts: 66.159.18.184 secure.dpbill.com
O1 - Hosts: 66.159.18.184 secure.dutchbilling.com
O1 - Hosts: 66.159.18.184 secure.pswbilling.com
O1 - Hosts: 66.159.18.184
www.maximumcash.comO1 - Hosts: 66.159.18.184
www.adultrevenueservice.comO1 - Hosts: 66.159.18.184
www.eroticacash.comO1 - Hosts: 66.159.18.184
www.oxcash.comO1 - Hosts: 66.159.18.184 track.oxcash.com
O1 - Hosts: 66.159.18.184 potd.oxcash.com
O1 - Hosts: 66.159.18.184 clicks2.oxcash.com
O1 - Hosts: 66.159.18.184
www.webmastersmakemoney.comO1 - Hosts: 66.159.18.184 clicks.nastydollars.com
O1 - Hosts: 66.159.18.184
www.lightspeedcash.comO1 - Hosts: 66.159.18.184 db.fetishcash.com
O1 - Hosts: 66.159.18.184 ctc.amateurpages.com
O1 - Hosts: 66.159.18.184 www2.karupspc.com
O1 - Hosts: 66.159.18.184
www.iteens.comO1 - Hosts: 66.159.18.184 click.payserve.com
O1 - Hosts: 66.159.18.184 vip.mtree.com
O1 - Hosts: 66.159.18.184 c.fsx.com
O1 - Hosts: 66.159.18.184 adultfriendfinder.com
O1 - Hosts: 66.159.18.184 network.nocreditcard.com
O1 - Hosts: 66.159.18.184 php.offshoreclicks.com
O1 - Hosts: 66.159.18.184 links.lifetimebucks.com
O1 - Hosts: 66.159.18.184 cgi.gammae.com
O1 - Hosts: 66.159.18.184 click.passiondollars.com
O1 - Hosts: 66.159.18.184
www.fatpockets.comO1 - Hosts: 66.159.18.184 link.siccash.com
O1 - Hosts: 66.159.18.184
www.clickcash.comO1 - Hosts: 66.159.18.184
www.scoreland.comO1 - Hosts: 66.159.18.184
www.makingitpay.comO1 - Hosts: 66.159.18.184
www.hpic.comO1 - Hosts: 66.159.18.184 referral.topbucks.com
O1 - Hosts: 66.159.18.184 partner.globill-systems.com
O1 - Hosts: 66.159.18.184
www.pornstardollars.comO1 - Hosts: 66.159.18.184 traffic.acpay.com
O1 - Hosts: 66.159.18.184
www.cashforlink.comO1 - Hosts: 66.159.18.184 clickcash.webpower.com
O1 - Hosts: 66.159.18.184
www.dollars4babes.comO1 - Hosts: 66.159.18.184
www.sexfantasyzone.comO1 - Hosts: 66.159.18.184
www.twistyscash.comO1 - Hosts: 66.159.18.184
www.freeticketcash.comO1 - Hosts: 66.159.18.184
www.hawgscash.comO1 - Hosts: 66.159.18.184
www.freeezinebucks.comO1 - Hosts: 66.159.18.184
www.nastydollars.comO1 - Hosts: 66.159.18.184
www.deluxepass.comO1 - Hosts: 66.159.18.184 clicks.oxcash.com
O1 - Hosts: 66.159.18.184 ww2.amateur-pages.com
O1 - Hosts: 66.159.18.184 stats.allliquid.com
O1 - Hosts: 66.159.18.184 secure1.websitebilling.com
O1 - Hosts: 66.159.18.184
www.adultmovienetwork.comO1 - Hosts: 66.159.18.184
www.totally4freecash.comO1 - Hosts: 66.159.18.184 network.nocreditcard.com
O1 - Hosts: 66.159.18.184 php.offshoreclicks.com
O1 - Hosts: 66.159.18.184
www.nocreditcard.comO1 - Hosts: 66.159.18.184 media.fastclick.net
O1 - Hosts: 66.159.18.184 clicks.uni-cash.com
O1 - Hosts: 66.159.18.184
www.clubpix.comO1 - Hosts: 66.159.18.184 programs.wegcash.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Programmer\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MiniLog] C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PDFtypewriter (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mpg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37883.6843287037O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) -
http://81.19.245.211/speedtest/SpeedTest_2.cabJeg har herudover også kørt antitrojan, som ikke fandt noget....
Tak for jeres tid og hælp
Qazimodo