Fejl i IE

Kan måske være snavs: Følg vejledningen for Spybot og Hijackthis her: http://www.arlet.dk/spybothjt.htm
Smid loggen herind, i dette spm, så vil vi kigge på den. Husk at indsætte *alle* linier fra loggen herinde.

Her er loggen....

Logfile of HijackThis v1.97.7
Scan saved at 09:00:22, on 11-05-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINNT\System32\internat.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\Administrator\Skrivebord\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://webcoolsearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://webcoolsearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://webcoolsearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.surfast.info/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.surfast.info/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://webcoolsearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.surfast.info/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://4-counter.com/?a=2&b=cr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://4-counter.com/?a=2&b=cr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.surfast.info/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.hand-book.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.inf/?id=54
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.hand-book.com/search/
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinAuth] C:\WINNT\winlogon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [rundll32] C:\rundll32.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O13 - WWW. Prefix: http://ehttp.cc/?
O13 - Home Prefix: http://www.surfast.info/
O13 - Mosaic Prefix: http://www.surfast.info/
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38012.4048726852
O16 - DPF: {BD092CD7-AA66-4FF6-8CE1-D4E01489ED2B} (VacPro.UserControl1) - http://www.7adpower.com/dialer/EMSAT.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://80.160.51.94/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130
O17 - HKLM\System\CS1\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130
O17 - HKLM\System\CS2\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130
O19 - User stylesheet: c:\winnt\my.css (file missing)
O19 - User stylesheet: C:\WINNT\hh.htt (file missing) (HKLM)

Hent Cwshredder, udpak til egen mappe, luk alle andre vinduer, scan og fix.
http://www.spywareinfo.com/~merijn/downloads.html
Og send en ny log herind;)

Tjek lige den her:
O4 - HKLM\..\Run: [WinAuth] C:\WINNT\winlogon.exe ->C:\WINNT\winlogon.exe
Den skal være på 178KB og der SKAL stå Microsoft i Egenskaber->Version.
Scan den hos Kaspersky.
http://www.kaspersky.com/remoteviruschk.html

Her er loggen fra Cwshredder.....

Windows 2000 (5.00.2195 )
Windows dir: C:\WINNT
Windows system dir: C:\WINNT\system32
AppData folder: C:\Documents and Settings\Administrator\Application Data
Username: Administrator

Found Hosts file: C:\WINNT\system32\drivers\etc\hosts (20 bytes, R)
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINNT\system32\userinit.exe,
Found CWS.Winproc32 file: C:\WINNT\system32\winproc32.exe (6114 bytes, A)
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINNT\win.ini (421 bytes, A)
Found System.ini file: C:\WINNT\system.ini (231 bytes, A)

- END OF REPORT -

Ok;) vil du også sende en ny log fra Hijackthis herind!
Det ville også være en god ide hvis du opdaterede w2000 til og med Sp4
og internet til SP1;)
http://v4.windowsupdate.microsoft.com/da/default.asp

Her er loggen.
Jeg ville gerne opdatere til sp4, men opdateringen fejler. Selvom jeg har hele sp4 på en cd, siger den at IE3 eller nyere (?!) skal være installeret for at opdatere.

Logfile of HijackThis v1.97.7
Scan saved at 11:28:02, on 19-05-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINNT\System32\internat.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\Administrator\Skrivebord\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinAuth] C:\WINNT\winlogon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O12 - Plugin for .pdf: C:\Programmer\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38012.4048726852
O16 - DPF: {BD092CD7-AA66-4FF6-8CE1-D4E01489ED2B} (VacPro.UserControl1) - http://www.7adpower.com/dialer/EMSAT.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://80.160.51.94/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130
O17 - HKLM\System\CS1\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130
O17 - HKLM\System\CS2\Services\Tcpip\..\{66416454-860F-4E84-8AEF-A9CAD8765FFA}: NameServer = 193.162.159.194,193.162.145.130

Loggen ser god nok ud;)
Men kør lige de to her, for det kan godt være snavs, der er skyld i de fejlmeldinger fra IE:
http://www.spysweeper.com/download.html
Install, update and run, fix all what it finds

Spybot: http://beam.to/spybotsd
Install, update, immunize and run. Fix all, marked with red
Prøv om du kan hente IEsp1 her
http://www.microsoft.com/downloads/results.aspx?productID=&freetext=internet+explorer+6&DisplayLang=en

Desværre stadig ingen løsning :-( Men nu må det være tid til en geninstallation af pc'en, så jeg lukker her.
Tak for al hjælpen.

magitouch >> hvis du opretter er svar, får du dine point.

Skammeligt det skulle ende på den måde;(