Hjælp til logfil fra Adaware+Hijackthis!!
Har brug for en der kan se om der er mere spyware eller lign. i nedenstående logfil. Har fået bugt med en del, men der er stadig 9 ting der bliver ved med at komme igen i reg. databasen.Log fra Adaware:
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"SpecifyDefaultButtons" () Possible unwanted enabling of browser button restriction ability
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Search" () Possible unwanted block of search button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Back" () Possible unwanted block of back button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Forward" () Possible unwanted block of forward button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Stop" () Possible unwanted block of stop button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Refresh" () Possible unwanted block of refresh button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Home" () Possible unwanted block of home button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_History" () Possible unwanted block of history button
Windows RegData Vulnerability HKEY_CURRENT_USER:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"Btn_Favorites" ()
Log fra Hijakthis:
Logfile of HijackThis v1.97.7
Scan saved at 09:06:03, on 23-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\mltarc\StrJwSrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\System\MAPI\1030\nt\MAPISP32.EXE
c:\program files\ibm\client access\emulator\pcsws.exe
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
c:\program files\ibm\client access\emulator\pcsws.exe
C:\Program Files\IBM\Client Access\cwblmsrv.exe
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\mltarc\StrJwSrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
C:\Program Files\IBM\Client Access\Emulator\PCSCM.EXE
C:\Documents and Settings\tf\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [CPQTEAM] CPQTEAM.EXE
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Global Startup: Start Java Server.lnk = C:\Program Files\mltarc\StrJwSrv.exe
O10 - Broken Internet access because of LSP provider 'c:\documents and settings\tf\windows\system32\rnr20.dll' missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {0D06CDB2-163D-46FD-94B7-BD3B1D69F846} (WDX.WDX_Main) - https://www.web-direct.dk/WDX.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://2000-terminal/myconsole/mstscax.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://business.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://ledningsinfo.esbjergkommune.dk/Esbjerg/viewer63/mgaxctrl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.229.27.222/activex/AxisCamControl.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37868.0183796296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://business.bgbank.dk/businessbg/activex/DanskeSikker.cab
O16 - DPF: {FF2ED99D-13F1-460A-9A8F-C1A876B62D37} (WDX.WDX_Main) - https://www.web-direct.dk/WDX.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = lauri.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{19737F23-CAB8-49B2-9A09-420722A4C158}: NameServer = 10.10.11.15,10.10.11.14
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = lauri.dk
O17 - HKLM\System\CS1\Services\Tcpip\..\{19737F23-CAB8-49B2-9A09-420722A4C158}: NameServer = 10.10.11.15,10.10.11.14
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = lauri.dk
O17 - HKLM\System\CS2\Services\Tcpip\..\{19737F23-CAB8-49B2-9A09-420722A4C158}: NameServer = 10.10.11.15,10.10.11.14
