Søg
Avatar billede mixi Nybegynder
23. marts 2004 - 16:14 Der er 33 kommentarer og
1 løsning

About:blank

Kan i tjekke denne hijack:
Logfile of HijackThis v1.97.7
Scan saved at 16:14:33, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\REGSERV.EXE
C:\WINDOWS\SNMP.EXE
C:\DMI98\WIN32\BIN\WIN32SL.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDNAGENT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SAVAGENT\SAVAGENT.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\KPQROPQV\HIJACKTHIS[2].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [SAVAgent] C:\Programmer\SAVAgent\SAVAgent.exe  -POLL=7200
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\bdnagent.exe
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Win32SL] C:\Dmi98\WIN32\bin\Win32sl.exe -i -p -r
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programmer\Fælles filer\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programmer\Fælles filer\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programmer\Softwin\BitDefender Free Edition\\bdinit.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [AddClass] C:\WINDOWS\ADDCLASS.EXE
O4 - HKCU\..\Run: [s4scuwar2h] C:\WINDOWS\H1H6MZVAIA.EXE
O4 - HKCU\..\Run: [4p7ud8ow7v] C:\WINDOWS\IKS5P2HOFB.EXE
O4 - HKCU\..\Run: [yk0puoy4ik] C:\WINDOWS\O7DAGRB621.EXE
O4 - HKCU\..\Run: [2e50oz6vo3] C:\WINDOWS\BC43T63B9D.EXE
O4 - HKCU\..\Run: [81kd6ndloi] C:\WINDOWS\OCXWAPC63T.EXE
O4 - HKCU\..\RunServices: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\RunServices: [AddClass] C:\WINDOWS\ADDCLASS.EXE
O4 - HKCU\..\RunServices: [s4scuwar2h] C:\WINDOWS\H1H6MZVAIA.EXE
O4 - HKCU\..\RunServices: [4p7ud8ow7v] C:\WINDOWS\IKS5P2HOFB.EXE
O4 - HKCU\..\RunServices: [yk0puoy4ik] C:\WINDOWS\O7DAGRB621.EXE
O4 - HKCU\..\RunServices: [2e50oz6vo3] C:\WINDOWS\BC43T63B9D.EXE
O4 - HKCU\..\RunServices: [81kd6ndloi] C:\WINDOWS\OCXWAPC63T.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: RealGuide (HKLM)
O13 - DefaultPrefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW Prefix: http://%65%68%74%74%70%2E%63%63/?
O13 - WWW. Prefix: http://%65%68%74%74%70%2E%63%63/?
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede arlet Juniormester
23. marts 2004 - 16:15 #1
løber den igennem
Avatar billede arlet Juniormester
23. marts 2004 - 16:15 #2
hent og kør dette program: http://www.arlet.dk/cwshredder.htm
genstart og ny hijackthis log
Avatar billede ird Praktikant
23. marts 2004 - 16:17 #3
http://www.eksperten.dk/spm/480562

http://www.eksperten.dk/spm/480740

hjalp Arlet dig ikke færdig her?
Avatar billede mixi Nybegynder
23. marts 2004 - 16:19 #4
jo men der er flere computere der har den der about:blank...det er på mit arbejde
Avatar billede ird Praktikant
23. marts 2004 - 16:21 #5
kunne du have arlet gøre i samme spørgsmål uden det kostede dig flere point :)
Avatar billede arlet Juniormester
23. marts 2004 - 16:21 #6
Jamen vi tager dem bare en for en

Ps hvor mange har i?? tænkte på at det måske blev en labg aften
Avatar billede mixi Nybegynder
23. marts 2004 - 16:23 #7
Logfile of HijackThis v1.97.7
Scan saved at 16:23:20, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\REGSERV.EXE
C:\WINDOWS\SNMP.EXE
C:\DMI98\WIN32\BIN\WIN32SL.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDNAGENT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SAVAGENT\SAVAGENT.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\KPQROPQV\HIJACKTHIS[2].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [SAVAgent] C:\Programmer\SAVAgent\SAVAgent.exe  -POLL=7200
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\bdnagent.exe
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Win32SL] C:\Dmi98\WIN32\bin\Win32sl.exe -i -p -r
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programmer\Fælles filer\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programmer\Fælles filer\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programmer\Softwin\BitDefender Free Edition\\bdinit.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [s4scuwar2h] C:\WINDOWS\H1H6MZVAIA.EXE
O4 - HKCU\..\Run: [4p7ud8ow7v] C:\WINDOWS\IKS5P2HOFB.EXE
O4 - HKCU\..\Run: [yk0puoy4ik] C:\WINDOWS\O7DAGRB621.EXE
O4 - HKCU\..\Run: [2e50oz6vo3] C:\WINDOWS\BC43T63B9D.EXE
O4 - HKCU\..\Run: [81kd6ndloi] C:\WINDOWS\OCXWAPC63T.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: RealGuide (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede mixi Nybegynder
23. marts 2004 - 16:25 #8
vi har 4 stk...men en kan slet ikke komme på nettet...vores it-afdeling er ikke så hurtige som i er, derfor bruger vi jer så længe....
Avatar billede arlet Juniormester
23. marts 2004 - 16:25 #9
ok. Går i gang med at tjekke den
Avatar billede mixi Nybegynder
23. marts 2004 - 16:26 #10
thanks
Avatar billede arlet Juniormester
23. marts 2004 - 16:27 #11
Ang den der ikke kan gå på nettet..
Tag porogrammet hijackthis og læg på en diskette og smid den over i den computer, der ikke kan komme på nettet. der laver du en hijackthis log og lægger den på disketten, over i den maskine du sidder ved nu og så kopierer loggen herind, det kan være jeg kan få den på nettet igen.
Avatar billede mixi Nybegynder
23. marts 2004 - 16:29 #12
ok jeg prøver
Avatar billede arlet Juniormester
23. marts 2004 - 16:43 #13
Flyt først filen Hijackthis til en mappe oprettet kun til den.

Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


O4 - HKLM\..\Run: [service] C:\WINDOWS\services.exe -serv
O4 - HKCU\..\Run: [s4scuwar2h] C:\WINDOWS\H1H6MZVAIA.EXE
O4 - HKCU\..\Run: [4p7ud8ow7v] C:\WINDOWS\IKS5P2HOFB.EXE
O4 - HKCU\..\Run: [yk0puoy4ik] C:\WINDOWS\O7DAGRB621.EXE
O4 - HKCU\..\Run: [2e50oz6vo3] C:\WINDOWS\BC43T63B9D.EXE
O4 - HKCU\..\Run: [81kd6ndloi] C:\WINDOWS\OCXWAPC63T.EXE

-----------------------------
Og den her skal jeres it-afdeling kigge på:
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1




Find og slet i fejlsikret(f8 ved opstart):


C:\WINDOWS\services.exe


Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Avatar billede mixi Nybegynder
23. marts 2004 - 16:46 #14
jeg går igang
Avatar billede mixi Nybegynder
23. marts 2004 - 17:00 #15
Logfile of HijackThis v1.97.7
Scan saved at 17:00:05, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\REGSERV.EXE
C:\WINDOWS\SNMP.EXE
C:\DMI98\WIN32\BIN\WIN32SL.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SAVAGENT\SAVAGENT.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDMCON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDNAGENT.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\KPQROPQV\HIJACKTHIS[2].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [SAVAgent] C:\Programmer\SAVAgent\SAVAgent.exe  -POLL=7200
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\bdnagent.exe
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Win32SL] C:\Dmi98\WIN32\bin\Win32sl.exe -i -p -r
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programmer\Fælles filer\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programmer\Fælles filer\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programmer\Softwin\BitDefender Free Edition\\bdinit.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: RealGuide (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede mixi Nybegynder
23. marts 2004 - 17:01 #16
kunne ikke finde C:\WINDOWS\services.exe i fejlsikret tilstand
Avatar billede arlet Juniormester
23. marts 2004 - 17:02 #17
ok.

denne skal lige fixes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


genstart og ny log.
Er startsiden stadig About:blank??
Avatar billede mixi Nybegynder
23. marts 2004 - 17:04 #18
ja startsiden er stadig about:blank....
Avatar billede arlet Juniormester
23. marts 2004 - 17:06 #19
Også efter dette:
denne skal lige fixes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

Genstart og ny log.
Avatar billede mixi Nybegynder
23. marts 2004 - 17:11 #20
jeps...
Avatar billede mixi Nybegynder
23. marts 2004 - 17:11 #21
Logfile of HijackThis v1.97.7
Scan saved at 17:10:34, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\REGSERV.EXE
C:\WINDOWS\SNMP.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\DMI98\WIN32\BIN\WIN32SL.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SAVAGENT\SAVAGENT.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDMCON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDNAGENT.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\KPQROPQV\HIJACKTHIS[2].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [SAVAgent] C:\Programmer\SAVAgent\SAVAgent.exe  -POLL=7200
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\bdnagent.exe
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Win32SL] C:\Dmi98\WIN32\bin\Win32sl.exe -i -p -r
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programmer\Fælles filer\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programmer\Fælles filer\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programmer\Softwin\BitDefender Free Edition\\bdinit.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: RealGuide (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede arlet Juniormester
23. marts 2004 - 17:31 #22
Det bliver desværre nød til at vente en times tid, så er jeg tilbage..
Avatar billede mixi Nybegynder
23. marts 2004 - 17:34 #23
det er bare ok..vi smutter først kl.23
Avatar billede arlet Juniormester
23. marts 2004 - 19:32 #24
Vigtigt:
Flyt først filen Hijackthis til en mappe oprettet kun til den.

Fix i hijackthis:
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE

genstart og ny log
Avatar billede mixi Nybegynder
23. marts 2004 - 20:02 #25
Logfile of HijackThis v1.97.7
Scan saved at 20:02:31, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\DMI98\WIN32\BIN\WIN32SL.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAMMER\FæLLES FILER\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SAVAGENT\SAVAGENT.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDMCON.EXE
C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\BDNAGENT.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\KPQROPQV\HIJACKTHIS[2].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [SAVAgent] C:\Programmer\SAVAgent\SAVAgent.exe  -POLL=7200
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMMER\SOFTWIN\BITDEFENDER FREE EDITION\bdnagent.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Win32SL] C:\Dmi98\WIN32\bin\Win32sl.exe -i -p -r
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programmer\Fælles filer\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programmer\Fælles filer\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programmer\Softwin\BitDefender Free Edition\\bdinit.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede arlet Juniormester
23. marts 2004 - 20:41 #26
Bliver den ved med at komme about:blank??

Ellers prøv at gå ind i funktioner - indstillinger og sæt en ny ind.
Avatar billede mixi Nybegynder
23. marts 2004 - 20:48 #27
ja den kommer stadig
Avatar billede mixi Nybegynder
23. marts 2004 - 20:49 #28
hmm næh..ikke mere efter jeg lige satte din side ind..prøver lige at genstarte
Avatar billede mixi Nybegynder
23. marts 2004 - 21:07 #29
vil du lige kigge på den sidste her::

Logfile of HijackThis v1.97.7
Scan saved at 21:08:17, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\REGSERV.EXE
C:\WINDOWS\SNMP.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\TMP\ICSUPP95.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\FæLLES FILER\NOKIA\NCLTOOLS\NCLTRAY.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAMMER\FæLLES FILER\NOKIA\SERVICES\SERVICELAYER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
D:\LOKALGEM\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.microsoft.com/intl/da/access/allinone.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRAMMER\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\Run: [Sweep95] "C:\Programmer\Sophos SWEEP\SETUP.EXE"
O4 - HKLM\..\RunServices: [regserv] regserv.exe
O4 - HKLM\..\RunServices: [SNMP agent] SNMP.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Sweep95] C:\Programmer\Sophos SWEEP\ICLOAD95.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Adaware Bootup] C:\PROGRAMMER\LAVASOFT AD-AWARE\AD-AWARE.EXE /Auto /Log "C:\PROGRAMMER\LAVASOFT AD-AWARE\"
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: [e] Allow popups for this site - C:\PROGRAMMER\ETCETERA\Support\AllowPopup.htm
O8 - Extra context menu item: [e] Deny popups for this site - C:\PROGRAMMER\ETCETERA\Support\DenyPopup.htm
O8 - Extra context menu item: [e] Search - C:\PROGRAMMER\ETCETERA\Support\Search.htm
O8 - Extra context menu item: [e] Refine Search - C:\PROGRAMMER\ETCETERA\Support\Refine.htm
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38068.4635763889
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede arlet Juniormester
23. marts 2004 - 21:28 #30
Så er du ren

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm
Avatar billede mixi Nybegynder
23. marts 2004 - 22:06 #31
rty
Avatar billede mixi Nybegynder
23. marts 2004 - 22:07 #32
arlet har du tid til at tjekke en mere...
Avatar billede mixi Nybegynder
23. marts 2004 - 22:13 #33
Logfile of HijackThis v1.97.7
Scan saved at 22:14:28, on 23-03-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\TMP\ICSUPP95.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE
C:\PROGRAMMER\FæLLES FILER\NOKIA\NCLTOOLS\NCLTRAY.EXE
C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAMMER\FæLLES FILER\NOKIA\SERVICES\SERVICELAYER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
D:\LOKALGEM\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer leveret af Folketinget - IT & Tele
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ProXyB.ft.dk:8080
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://opslagstavlen/"); (C:\Programmer\Netscape\Users\default\prefs.js)
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InterCheckMonitor] "C:\PROGRAMMER\SOPHOS SWEEP\ICMON.EXE" -minimised
O4 - HKLM\..\Run: [Ftstart] C:\Programmer\Ftaddon\Ftstart.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRAMMER\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAMMER\TROJANHUNTER 3.8\THGUARD.EXE"
O4 - HKLM\..\Run: [Sweep95] "C:\Programmer\Sophos SWEEP\SETUP.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Planlægningsagent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Sweep95] C:\Programmer\Sophos SWEEP\ICLOAD95.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Adaware Bootup] C:\PROGRAMMER\LAVASOFT AD-AWARE\AD-AWARE.EXE /Auto /Log "C:\PROGRAMMER\LAVASOFT AD-AWARE\"
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: [e] Allow popups for this site - C:\PROGRAMMER\ETCETERA\Support\AllowPopup.htm
O8 - Extra context menu item: [e] Deny popups for this site - C:\PROGRAMMER\ETCETERA\Support\DenyPopup.htm
O8 - Extra context menu item: [e] Search - C:\PROGRAMMER\ETCETERA\Support\Search.htm
O8 - Extra context menu item: [e] Refine Search - C:\PROGRAMMER\ETCETERA\Support\Refine.htm
O14 - IERESET.INF: START_PAGE_URL=http://Opslagstavlen
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38068.4635763889
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ft.dk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 147.29.233.30,147.29.233.65
Avatar billede arlet Juniormester
24. marts 2004 - 07:28 #34
Har den nogle problemer, for umiddelbart kan jeg ikke finde noget snavs i den..
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
SQL kurser
Computerworld tilbyder specialiserede kurser i database-management
Se alle SQL kurser

Flere spørgsmål fra Fri debat kategorien

Titel Indlæg Oprettet Seneste aktivitet
Vedr. Windows 11 version 26H2 Af ErikHg i Fri debat 7 02/10/202621:29 04/10/202606:52
DBA er ikke hvad det tidligere var - desværre! Af ErikHg i Fri debat 5 21/09/202610:39 03/10/202600:02
Powerbank Af postpeter@outlook.dk i Fri debat 1 24/08/202610:45 24/08/202610:46
Samsung smart TV Af postpeter@outlook.dk i Fri debat 7 20/08/202615:01 22/08/202618:39
morf bilede Af knuldefar1942 i Fri debat 4 08/08/202612:15 09/08/202606:07
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I går 12:28 slet gemte logind Af knuldefar1942 i Diverse
24/1020:40 Access udskrift mangler del af ramme om post. Af Uvanga i Access
24/1012:36 nulstille Samsung tablet T-580 Af fase i Tablet
23/1017:19 Kender I "Dropbox" ? Af Ikke-ekspert i Andet software
23/1016:28 Indsæt en kort video i Outlook 2024 Af ErikHg i E-mail programmer
White papers
Flere white papers »