Søg
Avatar billede hideild Nybegynder
20. april 2004 - 21:01 Der er 31 kommentarer og
1 løsning

Er blevet Hijacked

Jeg er bange for at jeg er blevet hijacked. Det er ikke første gang at det er sket. Håber at nogen kan hjælpe mig. JEg downloadede et p2p program og så var var den gal.
Avatar billede hideild Nybegynder
20. april 2004 - 21:01 #1
Logfile of HijackThis v1.97.7
Scan saved at 20:01:00, on 20-04-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\StartupMonitor.exe
C:\Programmer\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmer\Freeware\antispyware\SpywareGuard\sgmain.exe
C:\Programmer\Freeware\antispyware\SpywareGuard\sgbhp.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Freeware\antispyware\hijackthis\HijackThis.exe
C:\Programmer\Freeware\antispyware\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\freeware\PopupPopper\PopLib.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\Freeware\FlashGet\fgiebar.dll
O3 - Toolbar: HyperBand - {1BC1FC4B-B0D2-4D8D-9307-2E40E2A8C257} - C:\Programmer\Fælles filer\Hyperbar\Hyperbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] C:\Programmer\Creative\SBLive\Diagnostics\diagent.exe startup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\Freeware\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Programmer\Freeware\FlashGet\jc_link.htm
O9 - Extra button: PopupPopper Control Panel (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
Avatar billede johnstigers Seniormester
20. april 2004 - 21:15 #2
XP - den kigger jeg på :)
Avatar billede johnstigers Seniormester
20. april 2004 - 21:17 #3
Hent først cwshredder: http://www.softpedia.com/public/scripts/downloadhero/10-17-150/
Avatar billede hideild Nybegynder
20. april 2004 - 21:19 #4
jeg henter den
Avatar billede johnstigers Seniormester
20. april 2004 - 21:20 #5
HOV!
Der manglede en guide:
start programmet - check for update - klik på fix og lad programmet arbejde til det er slut.
genstart og lav en ny scanning med hijackthis og smid log herind.
Avatar billede hideild Nybegynder
20. april 2004 - 21:27 #6
et øjeblik så er jeg tilbage med en log
Avatar billede hideild Nybegynder
20. april 2004 - 21:32 #7
der var ikke noget der, men du får lige en log
Avatar billede hideild Nybegynder
20. april 2004 - 21:33 #8
CWShredder v1.56.3 scan only report
Please understand that a CWShredder 'Scan only' report
might not be sufficient to troubleshoot an infected system.
You can use HijackThis for that:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows XP (5.01.2600 SP1)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\system32
AppData folder: C:\Documents and Settings\Dell\Application Data
Username: Dell

Found Hosts file: C:\WINDOWS\system32\drivers\etc\hosts (723 bytes, R)
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwebsearch.com
  • dword:4
    • CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwwwsearch.com
  • dword:4
    • CWS.Googlems.2 (if value is 2) Registry value: Domains: *.xxxtoolbar.com
  • dword:4
    • CWS.Googlems.4 (if value is 2) Registry value: Domains: *.teensguru.com
  • dword:4
    • Registry value: DefaultPrefix (should be http://) [] http://
    Registry value: WWW Prefix (should be http://) [www] http://
    Registry value: Mosaic Prefix (should be http://) [mosaic] http://
    Registry value: Home Prefix (should be http://) [home] http://
    Found Win.ini file: C:\WINDOWS\win.ini (894 bytes, A)
    Found System.ini file: C:\WINDOWS\system.ini (278 bytes, A)

    - END OF REPORT -
    Avatar billede hideild Nybegynder
    20. april 2004 - 21:35 #9
    hverken ad-aware eller spybot finder noget
    Avatar billede johnstigers Seniormester
    20. april 2004 - 21:38 #10
    Det er altså MEGET vigtigt at du gør som jeg skriver:
    du skal IKKE klikke på "scan only" - du skal klikke på FIX - så vil den fixe den trælse startside. Du får en status efter fix.

    Min ser sådan ud efter fix: (den er ren)
    "Done!
    Your system was completely clean.

    Windows XP (5.01.2600 SP1)
    CWShredder v1.56.3
    Written by Merijn - merijn@spywareinfo.com

    For any additional help with this program or removing CWS, visit:
    http://forums.spywareinfo.com/

    For information and documentation on the Coolwebsearch
    trojan and its variants, visit:
    http://www.spywareinfo.com/~merijn/cwschronicles.html

    For donations to help support CWShredder, visit:
    http://www.spywareinfo.com/~merijn/donate.html"
    Avatar billede johnstigers Seniormester
    20. april 2004 - 21:38 #11
    HUSK at lukke internet explorer først - du må ikke have nogen åbne vinduer overhovedet.
    Avatar billede hideild Nybegynder
    20. april 2004 - 21:42 #12
    Done!
    Your system was completely clean.

    Windows XP (5.01.2600 SP1)
    CWShredder v1.56.3
    Written by Merijn - merijn@spywareinfo.com

    For any additional help with this program or removing CWS, visit:
    http://forums.spywareinfo.com/

    For information and documentation on the Coolwebsearch
    trojan and its variants, visit:
    http://www.spywareinfo.com/~merijn/cwschronicles.html

    For donations to help support CWShredder, visit:
    http://www.spywareinfo.com/~merijn/donate.html
    Avatar billede hideild Nybegynder
    20. april 2004 - 21:43 #13
    jeg gør sum du siger og min er ren, som du kan se:)
    Avatar billede johnstigers Seniormester
    20. april 2004 - 22:35 #14
    OK det var bare fodi du smed log fra cwshredder og det skerv jeg ikke du skulle - pyt! :)

    Tjekker den log.
    Avatar billede johnstigers Seniormester
    20. april 2004 - 22:38 #15
    Fix:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks

    Genstart og ny log.
    Avatar billede hideild Nybegynder
    20. april 2004 - 23:06 #16
    Logfile of HijackThis v1.97.7
    Scan saved at 22:00:52, on 20-04-2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\WINDOWS\StartupMonitor.exe
    C:\Programmer\Microsoft IntelliPoint\point32.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Programmer\Freeware\antispyware\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\freeware\PopupPopper\PopLib.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\Freeware\FlashGet\jccatch.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\Freeware\FlashGet\fgiebar.dll
    O3 - Toolbar: HyperBand - {1BC1FC4B-B0D2-4D8D-9307-2E40E2A8C257} - C:\Programmer\Fælles filer\Hyperbar\Hyperbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [diagent] C:\Programmer\Creative\SBLive\Diagnostics\diagent.exe startup
    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
    O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\Freeware\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Programmer\Freeware\FlashGet\jc_link.htm
    O9 - Extra button: PopupPopper Control Panel (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: FlashGet (HKLM)
    O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    O17 - HKLM\System\CS1\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    Avatar billede hideild Nybegynder
    20. april 2004 - 23:09 #17
    ups jeg glemte vist et par stykker fixer dem med det samme
    Avatar billede hideild Nybegynder
    20. april 2004 - 23:34 #18
    Logfile of HijackThis v1.97.7
    Scan saved at 22:33:14, on 20-04-2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\WINDOWS\StartupMonitor.exe
    C:\Programmer\Microsoft IntelliPoint\point32.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Programmer\Internet Explorer\iexplore.exe
    C:\Programmer\Freeware\antispyware\hijackthis\HijackThis.exe

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\freeware\PopupPopper\PopLib.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
    O2 - BHO: (no name) - {A491D208-B353-490F-B81A-A8A3DC97042D} - "C:\WINDOWS\System32\smiehlp.dll (file missing)
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\Freeware\FlashGet\jccatch.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\Freeware\FlashGet\fgiebar.dll
    O3 - Toolbar: HyperBand - {1BC1FC4B-B0D2-4D8D-9307-2E40E2A8C257} - C:\Programmer\Fælles filer\Hyperbar\Hyperbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [diagent] C:\Programmer\Creative\SBLive\Diagnostics\diagent.exe startup
    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
    O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\Freeware\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Programmer\Freeware\FlashGet\jc_link.htm
    O9 - Extra button: PopupPopper Control Panel (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: FlashGet (HKLM)
    O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    O17 - HKLM\System\CS1\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    Avatar billede johnstigers Seniormester
    20. april 2004 - 23:42 #19
    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
    skal fixes
    Avatar billede johnstigers Seniormester
    20. april 2004 - 23:43 #20
    nej vent - den er ok
    Avatar billede hideild Nybegynder
    20. april 2004 - 23:49 #21
    er du sikker med den der dsertry
    Avatar billede johnstigers Seniormester
    20. april 2004 - 23:49 #22
    Jep - du har vel en DEll maskine?
    Avatar billede hideild Nybegynder
    20. april 2004 - 23:56 #23
    ja, jeg har en Dell. Men havd bruges den dsentry til?(noget med DVD)
    Avatar billede johnstigers Seniormester
    20. april 2004 - 23:57 #24
    http://www.liutilities.com/products/wintaskspro/processlibrary/dsentry/
    Avatar billede hideild Nybegynder
    21. april 2004 - 00:05 #25
    ok, så fjerner jeg den bare
    Avatar billede hideild Nybegynder
    21. april 2004 - 00:05 #26
    er jeg så ren??
    Avatar billede johnstigers Seniormester
    21. april 2004 - 19:44 #27
    Den ser ren ud nu - men prøv lige at geninstallere SpywareGuard - denne linie ser lidt mystisk ud:
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)

    Du skal ikke fxe mere, bare installere spywareguard igen :)
    Når det er gjort, så smid lige en ny log for at se om den blev rettet til

    (tak til andersenph for tip ;))
    Avatar billede johnstigers Seniormester
    21. april 2004 - 19:45 #28
    fxe = fixe
    Avatar billede hideild Nybegynder
    21. april 2004 - 22:58 #29
    Logfile of HijackThis v1.97.7
    Scan saved at 21:55:55, on 21-04-2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\WINDOWS\StartupMonitor.exe
    C:\Programmer\Microsoft IntelliPoint\point32.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Programmer\Messenger\msmsgs.exe
    C:\Programmer\Freeware\antispyware\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.portal.fo
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {41353F8B-78CE-48A5-BE44-153ED293D192} - C:\Programmer\freeware\PopupPopper\PopLib.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\freeware\antispyware\SpywareGuard\dlprotect.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\Freeware\FlashGet\fgiebar.dll
    O3 - Toolbar: HyperBand - {1BC1FC4B-B0D2-4D8D-9307-2E40E2A8C257} - C:\Programmer\Fælles filer\Hyperbar\Hyperbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [diagent] C:\Programmer\Creative\SBLive\Diagnostics\diagent.exe startup
    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
    O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\Freeware\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Programmer\Freeware\FlashGet\jc_link.htm
    O9 - Extra button: PopupPopper Control Panel (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: FlashGet (HKLM)
    O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    O17 - HKLM\System\CS1\Services\Tcpip\..\{121999CA-3EB3-422A-810B-E698F72629BE}: NameServer = 212.55.32.2 212.55.32.3
    Avatar billede hideild Nybegynder
    21. april 2004 - 23:05 #30
    Jeg har af installeret SpywareGuard og installeret den igen
    Avatar billede johnstigers Seniormester
    21. april 2004 - 23:19 #31
    Den er ren og ok nu :)
    Avatar billede hideild Nybegynder
    21. april 2004 - 23:31 #32
    tak for hjælpen
    Avatar billede Ny bruger Nybegynder

    Din løsning...

    Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

    Loading billede Opret Preview
    Kategori
    Se alle it-kurser fra Computerworld Kurser
    IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
    Se alle it-kurser

    Flere spørgsmål fra Virus kategorien

    Titel Indlæg Oprettet Seneste aktivitet
    Vil skrifte antivirusprogram. Af ErikHg i Virus 22 26/11/202510:42 23/12/202514:29
    Er gratis Bitdefender værd at installere ? Af Ikke-ekspert i Virus 8 31/08/202519:08 01/09/202514:18
    Ukendte filer på min Pc Af jonpet i Virus 10 03/02/202514:20 04/02/202511:05
    mulig ukendt virus Af jackie18 i Virus 3 18/01/202514:07 18/01/202516:39
    virus popper op med jævne mellemrum Af Malm i Virus 13 18/01/202511:40 20/01/202517:53
    Se alle spørgsmål i kategorien Opret spørgsmål

    Log ind eller opret profil

    Hov!

    For at kunne deltage på Computerworld Eksperten skal du være logget ind.

    Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

    Opret Log ind

    Du kan også logge ind via nedenstående tjenester

    Alle kategorier på Eksperten
    Seneste spørgsmål Seneste aktivitet
    I går 16:04 Canon printer vil ikke udskrive farver Af mort1 i Printere
    I går 14:50 Hvilket fabrikat af Mesh systemer virker? Af fkj i Wifi
    15/0513:45 AJAX kode -javascript Af Asky i Programmeringsværktøjer
    15/0511:50 Vælg indstilling - blå skærm med med flere muligheder for fejlretning Af Uvanga i Windows
    14/0523:24 Google sheets beregning udfra dato Af rickiegrayholm i Office & Kontorpakker
    White papers
    Flere white papers »