lidt hjælp til HiJackThis

løber den igennem

ok..

Kender du denne: O4 - HKCU\..\Run: [ntkit] c:\ntkit\ntkit.exe

nope,, den havde også lagt en knap i min explorer, den har jeg fjernet,, men det er ikke på min maskine..

ok.
åbn hjt igen tryk scan, marker de linjer nedeunder. luk alle vinduer fornær hjt vinduet og tryk fix

O4 - HKCU\..\Run: [ntkit] c:\ntkit\ntkit.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

find og slet:
c:\ntkit <-hele mappen

genstart og ny log

er gjort men jeg fandt kun en fil der svaret til ntkit ( NTKIT.LGC ) i c:\windows\applog\ åbner jeg denne fil med eks notesblok indeholder den dette


{
o e624b6c0 a6e00 "C:\NTKIT\NTKIT.EXE"
R e624b6c0 0 40
R e624b6c0 100 f8
R e624b6c0 100 288
R e624b6c0 58400 1000
R e624b6c0 59400 1000
R e624b6c0 a5600 1000
R e624b6c0 a6600 800
o c18127a0 22e000 "C:\WINDOWS\SYSTEM\SHELL32.DLL"
R c18127a0 fb000 1000
R c18127a0 fc000 1000
o e44a5220 47035 "C:\WINDOWS\SYSTEM\MSVCRT.DLL"
R e44a5220 34000 1000
R e44a5220 3b000 600
o e44a53b0 60800 "C:\WINDOWS\SYSTEM\SHLWAPI.DLL"
R e44a53b0 53400 1000
R e44a53b0 58400 1000
R e44a53b0 59400 200
o e44ac0c0 32000 "C:\WINDOWS\SYSTEM\COMDLG32.DLL"
R e44ac0c0 1f000 1000
R e44ac0c0 20000 1000
R e44ac0c0 21000 800
R e44ac0c0 1f000 1000
R e44ac0c0 1000 1000
R e44ac0c0 1000 1000
o e61592c0 d000 "C:\WINDOWS\INETMIB1.DLL"
R e61592c0 0 40
R e61592c0 80 f8
R e61592c0 80 198
R e61592c0 b000 400
R e61592c0 5000 e00
o e4488ba0 8000 "C:\WINDOWS\SNMPAPI.DLL"
R e4488ba0 3000 1000
R e4488ba0 4000 600
R e4488ba0 3000 1000
R e4488ba0 1000 1000
R e4488ba0 1000 1000
r e61592c0 1000 1000
R e61592c0 1000 1000
R e61592c0 5000 e00
o e44af6f0 11000 "C:\WINDOWS\SYSTEM\WS2_32.DLL"
R e44af6f0 b000 1000
R e44af6f0 b000 1000
R c18127a0 fa000 1000
R e44af6f0 c000 c00
R e624b6c0 56000 1000
o e44d94b0 1c66 "C:\WINDOWS\WIN.INI"
R e44d94b0 0 1c66
C e44d94b0
o e44ac3a0 c2000 "C:\WINDOWS\SYSTEM\OLE32.DLL"
R e44ac3a0 af000 1000
R e44ac3a0 b3000 1000
R e44ac3a0 b2000 1000
o e44af170 96110 "C:\WINDOWS\SYSTEM\OLEAUT32.DLL"
R e44af170 87000 1000
R e44af170 88000 1000
R e44af170 89000 1000
R e44af170 8a000 1000
R e44af170 8b000 1000
o e44b20c0 3137 "C:\WINDOWS\SYSTEM\VER.DLL"
R e44b20c0 2f5 100
R e44ac0c0 22000 1000
o e44a1b10 1df7b "C:\WINDOWS\SYSTEM\MMSYSTEM.DLL"
R e44a1b10 731 b77
R e44a1b10 731 b77
o e4475630 9000 "C:\WINDOWS\SYSTEM\WSOCK32.DLL"
R e4475630 6000 a00
R e44af6f0 d000 1000
R e44af6f0 e000 600
o e44a4a80 14000 "C:\WINDOWS\SYSTEM\MSWSOCK.DLL"
R e44a4a80 f000 1000
R e624b6c0 a4400 1000
R e624b6c0 a5400 200
o c18115c0 28110 "C:\WINDOWS\SYSTEM\OLEPRO32.DLL"
R c18115c0 21000 1000
R c18115c0 1d000 1000
R c18115c0 1e000 1000
R c18115c0 1f000 1000
o e44b7300 a000 "C:\WINDOWS\SYSTEM\MSAFD.DLL"
R e44b7300 5000 800
R e44b7300 5000 1000
R e44b7300 6000 400
o c180ad70 882c7 "C:\WINDOWS\SYSTEM\USER.EXE"
R c180ad70 185e 2275
o e44c6b30 2580 "C:\WINDOWS\SYSTEM\ICMP.DLL"
R e44c6b30 1a00 200
o e44d94b0 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e44d94b0 0 8
R e44d94b0 0 e
R e44d94b0 0 40
R e44d94b0 c0 40
R e44d94b0 c0 c4
o e44aca20 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e44aca20 0 4
R e44aca20 0 0
C e44aca20
o e44aca20 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e44aca20 0 1000

R e44aca20 67000 1000
C e44aca20
C e44d94b0
o e44d94b0 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e44d94b0 0 8

R e44d94b0 c0 c4
o e4534c20 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e4534c20 0 4
R e4534c20 0 0
C e4534c20
o e4534c20 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e4534c20 0 1000

C e4534c20
C e44d94b0
o e44d94b0 85f10 "C:\WINDOWS\SYSTEM\COMCTL32.DLL"
R e44d94b0 0 8

C e44aca20
C e44d94b0
o e44afc30 147200 "C:\WINDOWS\SYSTEM\SHDOCVW.DLL"

o c1822520 90400 "C:\WINDOWS\SYSTEM\WININET.DLL"
R c1822520 76400 1000
o e44a67a0 74600 "C:\WINDOWS\SYSTEM\CRYPT32.DLL"
R e44a67a0 63000 1000
R e44a67a0 64000 1000
o c1811590 10000 "C:\WINDOWS\SYSTEM\MSASN1.DLL"

o e44ac4d0 55000 "C:\WINDOWS\SYSTEM\RPCRT4.DLL"

R c18127a0 7000 1000
o e475d2e0 58000 "C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT"

o e44cb060 e000 "C:\WINDOWS\SYSTEM\RNR20.DLL"
R e44cb060 b000 e00
R e44cb060 a000 1000
o e44af470 13000 "C:\WINDOWS\SYSTEM\SSSENSOR.DLL"

}

den nye log


Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMER\SYGATE\SPF\SMC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAMMER\AVPERSONAL\AVGCTRL.EXE
C:\PROGRAMMER\CREATIVE\SHAREDLL\CTNOTIFY.EXE
C:\PROGRAMMER\CREATIVE\AUDIO\PROGRAM\CTMIX32.EXE
C:\PROGRAMMER\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMER\CREATIVE\SHAREDLL\MEDIADET.EXE
C:\PROGRAMMER\ICQ\ICQ.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOHMR08.EXE
C:\PROGRAMMER\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSTS08.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\DOWNLOAD\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [Disc Detector] C:\Programmer\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CreativeMixer] C:\Programmer\Creative\Audio\PROGRAM\CTMIX32.EXE /t
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAMMER\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Icq.lnk = C:\Programmer\ICQ\Icq.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - User Startup: Icq.lnk = C:\Programmer\ICQ\Icq.exe
O4 - User Startup: hpoddt01.exe.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - User Startup: hp psc 1000 series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O4 - User Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: NTKit (HKLM)
O9 - Extra 'Tools' menuitem: Network Tools Kit (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38068.5178935185
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab

Så er du ren og kan aktiver din systemgendannelse igen

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

mange tak

Velbekommen