Nedbrudt system et eller andet

Hent HiJackThis:
http://www.snapfiles.com/download/dlhijackthis.html (installer (ikke til skrivebordet), scan, gem log, og send log'en herind)

og kør følgende online-scanner FØR du bruger HiJackThis:
http://www.xblock.com/download/xclean_micro.exe  (Vælg "Åbn", og ikke "Gem")

Når du har lagt en log herind fra HiJackThis, ser vi hvad vi kan gøre...

S.R.

Ok... Her er Log'en

Logfile of HijackThis v1.97.7
Scan saved at 17:14:58, on 01-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\valve\steam\steam.exe
C:\Programmer\StarOffice6.0\program\soffice.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Lasse\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchexe.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchexe.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.topsearchdog.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchexe.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchexe.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchexe.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchexe.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://ecmh.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 not found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>not found</h1>
O1 - Hosts: the requested url /data/bhwin.txt was not found on this server.<p>
O1 - Hosts: <p>additionally, a 404 not found
O1 - Hosts: error was encountered while trying to use an errordocument to handle the request.
O1 - Hosts: <hr>
O1 - Hosts: <address>apache/1.3.29 server at www.clickonteens.com port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: www.<!doctype html public "-//ietf//dtd html 2.0//en">
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 not found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>not found</h1>
O1 - Hosts: the requested url /data/bhwin.txt was not found on this server.<p>
O1 - Hosts: <p>additionally, a 404 not found
O1 - Hosts: error was encountered while trying to use an errordocument to handle the request.
O1 - Hosts: <hr>
O1 - Hosts: <address>apache/1.3.29 server at www.clickonteens.com port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: ftp.<!doctype html public "-//ietf//dtd html 2.0//en">
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 not found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>not found</h1>
O1 - Hosts: the requested url /data/bhwin.txt was not found on this server.<p>
O1 - Hosts: <p>additionally, a 404 not found
O1 - Hosts: error was encountered while trying to use an errordocument to handle the request.
O1 - Hosts: <hr>
O1 - Hosts: <address>apache/1.3.29 server at www.clickonteens.com port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: update.<!doctype html public "-//ietf//dtd html 2.0//en">
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 not found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>not found</h1>
O1 - Hosts: the requested url /data/bhwin.txt was not found on this server.<p>
O1 - Hosts: <p>additionally, a 404 not found
O1 - Hosts: error was encountered while trying to use an errordocument to handle the request.
O1 - Hosts: <hr>
O1 - Hosts: <address>apache/1.3.29 server at www.clickonteens.com port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: support.<!doctype html public "-//ietf//dtd html 2.0//en">
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 not found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>not found</h1>
O1 - Hosts: the requested url /data/bhwin.txt was not found on this server.<p>
O1 - Hosts: <p>additionally, a 404 not found
O1 - Hosts: error was encountered while trying to use an errordocument to handle the request.
O1 - Hosts: <hr>
O1 - Hosts: <address>apache/1.3.29 server at www.clickonteens.com port 80</address>
O1 - Hosts: </body></html>
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Programmer\DAP\DAPBHO.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O2 - BHO: LBBHO - {EFD84954-6B46-42f4-81F3-94CE9A77052D} - C:\WINDOWS\lbbho.dll
O2 - BHO: (no name) - {EFF80427-F837-4B74-8834-BAF18E0553FD} - c:\PROGRA~2\System\Misc\kabh1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll
O3 - Toolbar: (no name) - {702AD576-FDDB-4d0f-9811-A43252064684} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: DailyToolbar - {8333C319-0669-4893-A418-F56D9249FCA6} - C:\WINDOWS\Downloaded Program Files\DailyToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [OrbitUpdate] C:\Programmer\Orbit\update.exe
O4 - HKLM\..\Run: [OrbitView] C:\Programmer\Orbit\view.exe
O4 - HKLM\..\Run: [sysu] "C:\progra~1\ddm\sysu.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmer\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Programmer\Stop-the-Pop-Up Lite\stopthepop.exe" -minimized
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [kernel32.exe] c:\windows\system32\kernel32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Bandwidth Monitor Pro] "C:\Programmer\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MultiDesktop] C:\Programmer\Multi Desktop 2003\MultiDesktop2003.exe /LOADDESKTOPS
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - Startup: StarOffice 6.0.lnk = C:\Programmer\StarOffice6.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: >>> FREE PORN GALLERIES <<< - java script:{document.location='http://sexmaxx.com/freegalleries.htm';}
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download alle med FlashGet - C:\Programmer\FlashGet\jc_all.htm
O8 - Extra context menu item: Download med FlashGet - C:\Programmer\FlashGet\jc_link.htm
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Messenger Addon (HKLM)
O9 - Extra 'Tools' menuitem: &Messenger Addon (HKLM)
O16 - DPF: ConferenceRoom Java Client - http://irc.get2net.dk/java/cr.cab
O16 - DPF: IEToolbarCab - http://download.dailytoolbar.com/DailyToolbarAff.CAB
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.7adpower.com/dialer/A091301.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {53B3ABEA-4445-44D9-A01E-088144CAABD9} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/da/filesharingctrl.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {BF4FC0C7-4387-4D18-AD86-DF33DDDE33C7} - http://hot.activebuddy.com/catalog/smarterchild/websetup.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/SpeedTest_2.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {FFFF0021-0002-101A-A3C9-08002B2F49FB} - http://www.7adpower.com/dialer/A091AEM.exe

Tror nok den er lidt lang... Så kan nogen lige gå den igennem??

En eller anden?

Siden du ikke svarede er det bare synd.. Ingen point at finde...

Beklager den manglende aktivitet, men har haft lidt travlt på det sidste... Hvis du opretter et nyt spm og linker til det herinde, så skaffer jeg lige en af de store eksperter... Den der log overgår min kunnen...

S.R.

Ingen grund til panik. Jeg har ordnet den via mail med lassevang.

Glemte at skrive det her*S*

Nu er det jo så bare lige at alle besvarelser/løsninger på spm her på E, skal vises herinde... :P

S.R.

Nej, det skal de ikke..

Kun hvis jeg skal have point for svaret og det skulle jeg ikke.

Du kan se at han selv har taget pointene, så den skulle vist være i orden

Det er ikke tilladt:

13  tildele point for en opgave løst uden om Eksperten (feks. opgaver løst via mail, icq eller telefon).

Lige en kommentar til den her:
>>og kør følgende online-scanner FØR du bruger HiJackThis:
http://www.xblock.com/download/xclean_micro.exe  (Vælg "Åbn", og ikke "Gem")<<
Det er ikke en god idé, den scanner har efterhånden nedlagt nogle Win9x maskiner, så vi anbefaler den kun til Win2000/XP.

arlet -> Ok...

fromsej -> Ok... Det husker jeg så lige i fremtiden... :D

S.R.

Har formateret på grund af Linux så det her var helt unødvendigt... Hej hej