Active debugger detected

Visse spil er beskyttet med cd-key, eller hvis de skal bruge cd'er. Da man kan bruge debug-programmer til at knække beskyttelsen, har nogen en rutine, der checker om der er debuggere der er aktive..

Det kan være SoftICE, WDasm, eller f.eks .NuMega Smart(et eller andet). Disse programmer må ikke køre, når spillet startes.

rettelse: programmet hedder "NuMega Smart Check"

- Her er et svar, hvis det kan bruges.

Hvordan tjekker jeg hvad der kører ??

Tja, hvis du ikke har installeret dem, kører de ikke :-)
SoftIce starter når Windows starter. De andre skal man selv starte.

1) Har du nogen af de nævnte (eller andre debuggere) installeret?
2) Har du downloadet og kørt midst 1 af disse programmer?

Nej det har jeg ikke
Jeg kender dem slet ikke.

Se om du kan starte spillet.. derefter:

Hvis du bruger XP, klik Start > Kør > Skriv denne linie og tryk enter:

tasklist > c:\tasks.txt

Åben filen "tasks.txt" der ligger i roden af dit C-Drev, og kopier indholdet. Indsæt indholder her på Eksperten.

Det viser os alle de programmer der kører på din computer lige nu.

Jeg kan ikke finde filen.

Jeg kører win 98

OK.. Følg vejledningen for og HijackThis her: http://www.arlet.dk/spybothjt.htm

Smid loggen herind (kopier indholdet af loggen, og indsæt den på Eksperten).

Logfile of HijackThis v1.97.7
Scan saved at 20:40:17, on 15-06-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMER\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAMMER\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAMMER\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAMMER\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\DOKUMENTER\STOFA\SCA.EXE
C:\PROGRAMMER\INCREDIMAIL\BIN\IMAPP.EXE
C:\WINDOWS\SKRIVEBORD\TEST\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://www.signon.stofanet.dk/proxz.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [POINTER] C:\Programmer\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Programmer\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmer\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Startup: Genvej til SCA.lnk = C:\Dokumenter\Stofa\SCA.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .ofb: C:\PROGRA~1\INTERN~1\PLUGINS\NPONFLOW.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .PDF: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00600BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibpib100.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash5r42.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00613BD20023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1320ib100.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00614BD01023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1401ib100.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00615BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1500ib100.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00617BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1700ib100.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4242/mcfscan.cab
O16 - DPF: {A5B4176A-5347-4CEC-AB75-26947BB34183} (InstaladorBetyByte Control) - http://www.redzone.dk/uploads/cab/instaladorbetybyteuk.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00625BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp2500ib100.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38111.4888078704

Du har faktisk snavs på din computer! (Snavs = virus, trojaner, spware/adaware)

- info: fix intet uden at spørge først.

- info: backup filerne må du *ikke* slette endnu!

- info "fixes": Sæt hak ud for alle linierne der bliver nævnt, luk alle vinduer undtagen HijackThis. Klik nu på Fix

- Fixes:
O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe

- Noget du selv har downloadet og aktiveret?? Hvis nej, fix:
C:\DOKUMENTER\STOFA\SCA.EXE

- Vis skjulte filer: menuen Funktioner > mappeindstillinger > vis > vælg at der skal vises "skjult filer og system filer"

- genstart i fejlsikret tilstand (hold CTRL nede ved genstart) og slet disse filer:
C:\WINDOWS\ALCHEM.exe
C:\WINDOWS\SYSTEM\A.EXE

-- Hvis du har fixet C:\DOKUMENTER\STOFA\SCA.EXE, slet filen.


- Smid en ny log herind.

Logfile of HijackThis v1.97.7
Scan saved at 21:43:08, on 15-06-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMER\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAMMER\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAMMER\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAMMER\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\DOKUMENTER\STOFA\SCA.EXE
C:\PROGRAMMER\INCREDIMAIL\BIN\IMAPP.EXE
C:\WINDOWS\SKRIVEBORD\TEST\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://www.signon.stofanet.dk/proxz.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [POINTER] C:\Programmer\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Programmer\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmer\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Startup: Genvej til SCA.lnk = C:\Dokumenter\Stofa\SCA.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .ofb: C:\PROGRA~1\INTERN~1\PLUGINS\NPONFLOW.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .PDF: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00600BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibpib100.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash5r42.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00613BD20023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1320ib100.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00614BD01023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1401ib100.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00615BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1500ib100.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00617BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp1700ib100.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4242/mcfscan.cab
O16 - DPF: {A5B4176A-5347-4CEC-AB75-26947BB34183} (InstaladorBetyByte Control) - http://www.redzone.dk/uploads/cab/instaladorbetybyteuk.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://netbank.danskebank.dk/html/activex/DB/Menu.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00625BD00023} (Alm. Brand Netbank) - https://www.almbrand-netbank.dk/salmbrandibp2500ib100.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38111.4888078704

1) var der nogen problemer?
2) dvs, SCA.exe er noget du har downloadet + aktiveret?
3) Prøv at køre spillet nu.. giver den samme fejl?

- Download og installer Internet Explorer 6 herfra:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/#Microsoft

- Hvis du har problemer med crash/afbrydelser/ikke nok tid, kan du downloade GetRight:
http://www.getright.com/get.html

Med GetRight kan du forsætte din download, selvom computeren crasher. Eller hvis du vil stoppe den, og fortsætte senere.

- Og så ville det være en god ide, at tage et smut forbi http://windowsupdate.microsoft.com for at få de seneste opdateringer.

Stadig samme problem, jeg prøver med opdateringerne

Måske er der fejl i installationen af spillet.. efter installering af Internet Explorer 6 (husk også Service Pack!) og opdateringerne, test spillet.. hvis det stadig ikke virker, prøv at afinstallere spillet og geninstallere det.


Loggen er ren. Lidt læsestof:

For at holde den ren, har aovergaard lavet en artikel om emnet, du kan kigge i: http://www.eksperten.dk/artikler/144
Som minimum anbefales Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.

Nu er maskinen opdateret, men problemet er der stadig.

Jeg prøver at afinstallere spillet.