Hjælp til tolkning af HiJackThis fil - svchost.exe problem
Kære kloge eksperterJeg har et problem på en Dell laptop. Windows genererer et problem med svchost.exe ved alle boots, og hver gang jeg forsøger at starte en opkaldsforbindelse.
Den skriver helt præcist, at "svchost.exe har genereret en fejl, og lukkes af Windows. Programmet skal genstartes. Der oprettes en logfil.".
Jeg fandt forskellige artikler om emnet hos jer - eksterten.dk
Jeg har opdateret Windows med en række opdateringer.
Jeg har læst aovergaards artikel 127 (www.eksperten.dk/artikler/127) om emnet. Fremragende kogebog. Flot arbejde.
Jeg har lavet en onlinescanning, der ingenting fandt.
Jeg har installeret Spybot, hvor der var 27 røde linier, der er fjernet/afhjulpet.
Jeg har installeret HiJackThis, der har lavet nedenstående logfil.
Problemet er der fortsat, men som der står i artikel 127 (www.eksperten.dk/artikler/127), så skal man på dette stade kontakte eksperterne.
Er der nogen, der kan hjælpe med at dechifrere nedenstående?
På forhånd tak.
Jesper
*****************
Logfile of HijackThis v1.97.7
Scan saved at 18:03:41, on 08-05-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
C:\Programmer\Network Associates\VirusScan\Mcshield.exe
C:\Programmer\Network Associates\VirusScan\VsTskMgr.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\NALNTSRV.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\wm.exe
C:\WINNT\system32\svchost.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\NOVELL\ZENRC\WUOLService.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\pctspk.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Dell\AccessDirect\dadapp.exe
C:\WINNT\system32\PRPCUI.exe
C:\WINNT\System32\DSentry.exe
C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Programmer\Dell\AccessDirect\DadTray.exe
C:\Programmer\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\dpmw32.exe
C:\WINNT\system32\NWTRAY.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\PROGRA~1\FÆLLES~1\SCM\ICONFIG.EXE
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE
C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe
C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
C:\WINNT\system32\ctfmon.exe
C:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\wincmd\WINCMD32.EXE
C:\Programmer\KeyText\KeyText.exe
c:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Hijackthis\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nygard.dk/links
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/dk/dan/gen/default.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.1.13:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = www.boliggarantibevis.dk;www.kab-bolig.dk;*.kab-intranet;172.16.*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CPortPatch] C:\WINNT\DockQuickInstall\cppch.exe
O4 - HKLM\..\Run: [DadApp] C:\Programmer\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINNT\System32\DSentry.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [ICONFIG] C:\PROGRA~1\FÆLLES~1\SCM\ICONFIG.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [Nokia Tray Application] c:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Windows Commander 32.lnk = C:\wincmd\WINCMD32.EXE
O4 - Startup: KeyText.lnk = C:\Programmer\KeyText\KeyText.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38115.042037037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F2261703-0D7D-11D0-9FFE-00A0C90D049B} (Corel Presentations Show It!) - http://www.corel.com/products/wordperfect/cwps8/plugin/axprshow.cab
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.bgbank.dk/bgnetbank/activex/DanskeSikker.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7E5768-5828-4A0B-88FB-DE27DB3B1FA9}: NameServer = 172.16.1.17
O17 - HKLM\System\CCS\Services\Tcpip\..\{761377FB-547C-40EC-AE5A-E36B5CFAFBA7}: Domain = kab-intranet
O17 - HKLM\System\CCS\Services\Tcpip\..\{761377FB-547C-40EC-AE5A-E36B5CFAFBA7}: NameServer = 172.16.1.17
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EE82139-70B5-4CE2-BB33-D424C88AC2D4}: Domain = kab-intranet
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EE82139-70B5-4CE2-BB33-D424C88AC2D4}: NameServer = 172.16.1.17
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D7E5768-5828-4A0B-88FB-DE27DB3B1FA9}: NameServer = 172.16.1.17
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D7E5768-5828-4A0B-88FB-DE27DB3B1FA9}: NameServer = 172.16.1.17
