Søg
Avatar billede ulle82 Nybegynder
16. august 2004 - 23:10 Der er 7 kommentarer og
1 løsning

hjt log

Er der noget her der skal fjernes? og hvordan gøres det bedst?

Logfile of HijackThis v1.97.7
Scan saved at 23:06:11, on 16-08-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
E:\Anti Virus\pccguide.exe
E:\Anti Virus\PCCClient.exe
E:\Anti Virus\Pop3trap.exe
C:\Programmer\HP\HP Software Update\HPWuSchd.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
E:\Anti Virus\Tmntsrv.exe
C:\Programmer\HP\hpcoretech\comp\hptskmgr.exe
E:\Anti Virus\PCCPFW.exe
C:\Documents and Settings\Morten\Skrivebord\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Programmer\Panicware\Pop-Up Stopper Companion\CCHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5CC5FB68-ABEB-4084-8343-3F280559DF3E} - (no file)
O2 - BHO: (no name) - {5D0A4E75-2BC2-490A-BA0A-F99AE3015911} - C:\WINDOWS\System32\ijedbaa.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Programmer\Panicware\Pop-Up Stopper Companion\popupus.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [pccguide.exe] "E:\Anti Virus\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "E:\Anti Virus\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "E:\Anti Virus\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmer\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{37053D43-78B9-4E19-9F5A-4553BCD57544}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede serverservice Praktikant
16. august 2004 - 23:15 #1
ja der er en del. læg hijackthis i en mappe for sig selv. Deaktivér systemgendannelse i system. så skal jeg lige tjekke den.
Avatar billede serverservice Praktikant
16. august 2004 - 23:22 #2
start md at fixe disse
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {5CC5FB68-ABEB-4084-8343-3F280559DF3E} - (no file)

genstart i fejlsikret (med F8 nede) og tøm hele temp mappen, tøm også din temporay internet filer
\DOCUME~1\Morten\LOKALE~1\Temp

så ser jeg lige på resten af loggen
Avatar billede serverservice Praktikant
16. august 2004 - 23:32 #3
fixes
fixes
O2 - BHO: (no name) - {5D0A4E75-2BC2-490A-BA0A-F99AE3015911} - C:\WINDOWS\System32\ijedbaa.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

Download regsupreme og rens din registreringsdatabase - registry cleaner - normal - start-  og efter scan - orden
http://download.com.com/3000-2086-10225989.html?tag=lst-0-4     Regsupreme

Vælg en ny default internetside - genstart ny log
Avatar billede serverservice Praktikant
16. august 2004 - 23:37 #4
Jeg går i seng nu og lægger derfor et svar.

Hvis du stadig har problemer med en påtvungen hjemmeside skal du starte Regedit fra kør og slette alt med Sp.html - søg og slet manuelt .
Du burde være clean nu, men tjekker den lige imorgen for en sikkerheds skyld.
Avatar billede serverservice Praktikant
16. august 2004 - 23:42 #5
En god idé ville være at installeere nogle af disse programmer, fx spybot resident, empty temp, ie privacy evt. andre
http://www.spywarefri.dk/pakken.htm
se også her: http://www.eksperten.dk/artikler/144
Avatar billede ulle82 Nybegynder
17. august 2004 - 00:26 #6
Det virker ikke... her er en ny log.

Logfile of HijackThis v1.97.7
Scan saved at 00:31:04, on 17-08-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
E:\Anti Virus\Tmntsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
E:\Anti Virus\pccguide.exe
E:\Anti Virus\PCCClient.exe
E:\Anti Virus\Pop3trap.exe
C:\Programmer\HP\HP Software Update\HPWuSchd.exe
C:\Programmer\HP\hpcoretech\hpcmpmgr.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
E:\Anti Virus\PCCPFW.exe
C:\Programmer\Internet Explorer\iexplore.exe
E:\Sikkerhed\HJT\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Programmer\Panicware\Pop-Up Stopper Companion\CCHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5D0A4E75-2BC2-490A-BA0A-F99AE3015911} - C:\WINDOWS\System32\ijedbaa.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Programmer\Panicware\Pop-Up Stopper Companion\popupus.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [pccguide.exe] "E:\Anti Virus\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "E:\Anti Virus\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "E:\Anti Virus\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmer\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmer\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{37053D43-78B9-4E19-9F5A-4553BCD57544}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede serverservice Praktikant
17. august 2004 - 08:41 #7
fixes , scan igen ,  fixes hvis de er der
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Morten\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {5D0A4E75-2BC2-490A-BA0A-F99AE3015911} - C:\WINDOWS\System32\ijedbaa.dll

kør regsupreme igen - slet alle entries i registry scan http://download.com.com/3000-2086-10225989.html?tag=lst-0-4    Regsupreme

http://home8.inet.tele.dk/fbj/ASW.htm Brug killbox til at slette alle filer i: \DOCUME~1\Morten\LOKALE~1\Temp

åbn regedit fra kør - edit - find sp.html - slet - f3 for næste - slet alle sp.html

vælg ny deafult internet´side - genstart- ny log
Avatar billede majsmarken Nybegynder
17. august 2004 - 13:10 #8
Du er meget sårbar uden opdateret windows xp. Hent SP1 her:
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/

Derefter henter du alle kritiske sikkerhedsopdateringer her:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D531BF00-D7BE-48E3-ABCC-961602BD72C2&displaylang=da
Til sidst går du i start -> programmer -> windows update og scanner for opdateringer. Installer dem du får anbefalet.

(Formulering sakset fra andet spm...)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Andre onlineløsninger kategorien

Titel Indlæg Oprettet Seneste aktivitet
mit.dk - grotesk lang response tid Af Slettet bruger i Andre onlineløsninger 4 08/06/202610:18 10/06/202610:32
hvilken AI synes I er bedst? Af jcr18 i Andre onlineløsninger 8 23/05/202609:37 04/06/202615:11
AI google.com Af Peter Olsen i Andre onlineløsninger 3 04/04/202609:43 06/04/202608:43
Eboks.dk og Borger.dk Af nu_igen i Andre onlineløsninger 10 25/02/202612:56 03/03/202619:43
Mobilpay svindel Af nu_igen i Andre onlineløsninger 8 24/01/202609:50 26/01/202612:02
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I går 14:41 To mails fra YouSee - Jeg tror ikke altid på tilfældigheder Af mort1 i Andet sikkerhed
27/0714:34 Hjælp til at kunne skanne negativer på Plustek 8300i SE Af Mariann i Foto & video
27/0713:58 Mapperne Dokumenter og Overførsler er forsvundet efter geninstallation af Win11 Af bragger i Windows
25/0713:55 Ukendt sender e-mails fra - og til min e-mail adresse Af mort1 i Andet sikkerhed
24/0711:08 Forskel mellem klokkeslet start aften slut næste morgen Af krasmussen i Excel
White papers
Flere white papers »