Avatar billede olsson15 Nybegynder
13. juli 2004 - 11:44 Der er 1 kommentar og
1 løsning

HijackThis Log fil

Nogen som kan tyde denne log ?
Det haster :D

Logfile of HijackThis v1.98.0
Scan saved at 11:45:48, on 13-07-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\svchost.exe
D:\Programmer\Norton AntiVirus\navapsvc.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\PROGRA~1\NORTON~1\navapw32.exe
D:\Programmer\QuickTime\qttask.exe
D:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
D:\WINNT\system32\nnjrjz.exe
D:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
D:\WINNT\system32\internat.exe
D:\Documents and Settings\Frederik Kjølseth\Application Data\lbou.exe
D:\WINNT\system32\NDrv.exe
D:\Programmer\FinePixViewer\QuickDCF.exe
D:\Programmer\WinZip\WZQKPICK.EXE
D:\Programmer\Real\RealPlayer\RealPlay.exe
D:\WINNT\system32\wuauclt.exe
D:\Documents and Settings\Frederik Kjølseth\Skrivebord\Virus Stuff\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/spad/start.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://D:\DOCUME~1\FREDER~1\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.dr.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=D:\WINNT\system32\userinit.exe,
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINNT\nem219.dll
O2 - BHO: MxTargetObj Class - {0000607D-D204-42C7-8E46-216055BF9918} - D:\WINNT\mxTarget.dll
O2 - BHO: (no name) - {1B7D753B-1981-4bd2-91F3-6D055EE113A0} - D:\WINNT\system32\NDrv.dll
O2 - BHO: (no name) - {8C59DBED-62AB-4DD0-B059-B5B963D36B25} - D:\WINNT\system32\mbei.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - D:\WINNT\wsem300.dll
O2 - BHO: E.HH - {9E992732-295F-4987-8BE3-16FAC1639198} - D:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] D:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UC_Start] C:\IBMTools\Updater\ucstartup.exe
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Camera Detector] D:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [eaxeonj] D:\WINNT\system32\nnjrjz.exe
O4 - HKLM\..\Run: [alchem] D:\WINNT\alchem.exe
O4 - HKLM\..\Run: [WeatherOnTray] D:\Programmer\Hotbar\bin\4.5.0.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [pmr] D:\Programmer\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [fash] D:\WINNT\fash.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [sws.exe] d:\\GlobalDialer\domer00115\gd-dial.exe -remove
O4 - HKCU\..\Run: [\IEService.exe] D:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe
O4 - HKCU\..\Run: [Erui] D:\Documents and Settings\Frederik Kjølseth\Application Data\lbou.exe
O4 - HKCU\..\Run: [NDrv] D:\WINNT\system32\NDrv.exe
O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup
O4 - Global Startup: Exif Launcher.lnk = D:\Programmer\FinePixViewer\QuickDCF.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Programmer\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file)
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\system32\Shdocvw.dll
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file) (HKCU)
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - (no file) (HKCU)
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN.cab
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/TerraExplorer/Install/TEInstallPlugIn.cab
O16 - DPF: {42F2D240-B23C-11D6-8C73-70A05DC10000} - http://63.217.31.12/dial6/058439dk.exe
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdccommon/download/IbmEgath.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {CCA6CE4C-2199-4A4F-9542-12E0163D6841} (Dialer Class) - http://sessa.isprime.com:81/tel2net/CABEDialer.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{760CDEA9-5697-4B5C-9A3A-365EBC57711A}: NameServer = 212.54.64.170,212.54.64.171
O17 - HKLM\System\CS1\Services\Tcpip\..\{760CDEA9-5697-4B5C-9A3A-365EBC57711A}: NameServer = 212.54.64.170,212.54.64.171
O17 - HKLM\System\CS2\Services\Tcpip\..\{760CDEA9-5697-4B5C-9A3A-365EBC57711A}: NameServer = 212.54.64.170,212.54.64.171
O18 - Filter: text/html - {A937B11A-639C-4E35-999F-7295766F6076} - D:\WINNT\system32\mbei.dll
O18 - Filter: text/plain - {A937B11A-639C-4E35-999F-7295766F6076} - D:\WINNT\system32\mbei.dll
Avatar billede olsson15 Nybegynder
13. juli 2004 - 12:43 #1
har løst det selv :D
Avatar billede andersenph Nybegynder
13. juli 2004 - 13:48 #2
Det var da flot at du har løst den selv :O)

Jeg hører gerne fra dig. jpa(snabel a)tdcspace.dk
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester