Avatar billede tzag_dk Nybegynder
29. marts 2004 - 17:15 Der er 6 kommentarer og
1 løsning

Kikke en hjt log igennem

Hej
Jeg har vist fået virus.
Vil I ikke kikke denne log igennem?

Logfile of HijackThis v1.97.7
Scan saved at 17:14:15, on 29-03-04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMMER\F-SECURE\COMMON\FSMA32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSMB32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FCH32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FNRB32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FAMEH32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSGK32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FIH32.EXE
C:\PROGRAMMER\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSM32.EXE
C:\WINDOWS\SYSTEM\PDESK\PDESK.EXE
C:\PROGRAMMER\TRUST\AMI MOUSE 250S CORDLESS\AMOUMAIN.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\WINAMP\WINAMPA.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\HP OFFICEJET D SERIES\BIN\HPOOJD07.EXE
C:\PROGRAMMER\SMARTDISK\FLASHPATH\SDSTAT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOEVM07.EXE
C:\WINDOWS\SYSTEM\HPOIPM07.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOSTS07.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOFXM07.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SKRIVEBORD\HJT\HJT.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.djz.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.skanska.dk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmer\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\RunServices: [fsaa] C:\Programmer\F-Secure\Common\fsaa.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Programmer\F-Secure\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Programmer\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O4 - Startup: FlashPath Monitor.lnk = C:\Programmer\SmartDisk\FlashPath\sdstat.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .nsf/html/934BD07433AEF289C1256ABD007B0EED/$file/_98dp6utre41j6usjjei8n4qr5e9iiss34co_: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37969.2466898148
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://213.150.57.68/speedtest/SpeedTest_2.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://tsac.rebelhq.org/msrdp.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {0556834E-F56C-4545-8FAD-4F0ED25999BE} (Jackie Control) - http://www.6jackpot.com/dialup/jackie.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.36.40.30,10.36.32.30

På forhånd tak!
// Rene
Avatar billede arlet Juniormester
29. marts 2004 - 17:16 #1
løber den igennem
Avatar billede tzag_dk Nybegynder
29. marts 2004 - 17:17 #2
Tak for det :-)
Avatar billede arlet Juniormester
29. marts 2004 - 17:23 #3
Der ligger ikke noget virus i loggen, men en enkelt fil, der skal væk.

kør hijackthis igen og vinge denne fil af, luk alle vinduer fornær hijackthis og tryk fix og genstart:
O16 - DPF: {0556834E-F56C-4545-8FAD-4F0ED25999BE} (Jackie Control) - http://www.6jackpot.com/dialup/jackie.cab

Tag et online scan med housecall og panda: http://www.arlet.dk/faeetvirus.htm

Finder de noget??

Hvorfor tror du at du har virus??
Avatar billede tzag_dk Nybegynder
29. marts 2004 - 17:47 #4
Hej igen.

Jeg kan heller ikke finde nogle vira. Dog opføre min comp sig underlig for tiden, så derfor tror jeg at der er noget snavs på den :-(

Her er den nye log:
Logfile of HijackThis v1.97.7
Scan saved at 17:43:09, on 29-03-04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMMER\F-SECURE\COMMON\FSMA32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSMB32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FCH32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FNRB32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FAMEH32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSGK32.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FIH32.EXE
C:\PROGRAMMER\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\F-SECURE\COMMON\FSM32.EXE
C:\WINDOWS\SYSTEM\PDESK\PDESK.EXE
C:\PROGRAMMER\TRUST\AMI MOUSE 250S CORDLESS\AMOUMAIN.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\WINAMP\WINAMPA.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\HP OFFICEJET D SERIES\BIN\HPOOJD07.EXE
C:\PROGRAMMER\SMARTDISK\FLASHPATH\SDSTAT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOEVM07.EXE
C:\WINDOWS\SYSTEM\HPOIPM07.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOSTS07.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\AIO\SHARED\BIN\HPOFXM07.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SKRIVEBORD\HJT\HJT.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.djz.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.skanska.dk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Job-oversigt] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmer\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\RunServices: [fsaa] C:\Programmer\F-Secure\Common\fsaa.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Programmer\F-Secure\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Programmer\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O4 - Startup: FlashPath Monitor.lnk = C:\Programmer\SmartDisk\FlashPath\sdstat.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .nsf/html/934BD07433AEF289C1256ABD007B0EED/$file/_98dp6utre41j6usjjei8n4qr5e9iiss34co_: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37969.2466898148
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://213.150.57.68/speedtest/SpeedTest_2.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://tsac.rebelhq.org/msrdp.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.36.40.30,10.36.32.30
Avatar billede arlet Juniormester
29. marts 2004 - 18:00 #5
Hvis hverken housecall eller panda finder noget, så har du ikke nogen virus.

Hvad gør den af unormale ting??
Avatar billede tzag_dk Nybegynder
29. marts 2004 - 18:04 #6
Det gør den heller ikke mere efter at jeg har fjernet det som du sagde, det syntes jeg i hvert fald ikke.

Men tak for det! :-)
Avatar billede arlet Juniormester
29. marts 2004 - 18:09 #7
Velbekommen
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester