Avatar billede natman Nybegynder
20. august 2004 - 10:56 Der er 24 kommentarer og
2 løsninger

Hi-jack this log

Logfile of HijackThis v1.97.7
Scan saved at 10:49:00, on 20-08-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Office keyboard utility\1.1\nhksrv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Nvc\Bin\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\WINDOWS\Explorer.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
C:\Programmer\Browser MOUSE\mouse32a.exe
C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Office keyboard utility\1.1\MMKEYB.EXE
C:\Programmer\Office keyboard utility\1.1\TrayMon.exe
C:\Programmer\Office keyboard utility\1.1\osd.exe
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\Ejer\Dokumenter\Modtagne filer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {0036F389-FEF8-43AC-9220-16430E0012ED} - C:\WINDOWS\DOWNLO~1\iEBINST.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-95BE-B378BA9CB52D} - C:\WINDOWS\DOWNLO~1\NAUPOI~1.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Toolbar\01.01.1629.0\da\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: NAUPOINTBAR - {4E7BD74F-2B8D-469E-95BE-B378BA9CB52D} - C:\WINDOWS\DOWNLO~1\NAUPOI~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [RrkOBMZzr.exe] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RrkOBMZzr] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [W1iFrH.exe] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [W1iFrH] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmer\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMOFFICEKEYBOARD] C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
O4 - HKLM\..\Run: [4x1.exe] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [4x1] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [M] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKLM\..\Run: [M.exe] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .bmp: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin6.dll
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin4.dll
O15 - Trusted Zone: http://www.bgbank.dk
O16 - DPF: {0036F389-FEF8-43AC-9220-16430E0012ED} (No description) - http://naupoint.com/toolbar/installer/iEBINST6.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.4000578704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede serverservice Praktikant
20. august 2004 - 11:04 #1
Placer hijackthis i en mappe for sig selv.
Slå systemgendannelse fra i system og scan med spybot: http://www.download.com/3000-8022-10289035.html?tag=lst-0-2     Spybot

Genstart i fejlsikret og slet alle filer i Temp mappen:
C:\Documents and Settings\Ejer\Lokale indstillinger\Temp

-Ny log
Avatar billede majsmarken Nybegynder
20. august 2004 - 11:06 #2
Du har nogle 'sjove' nogle under ..\lokale indstillinger\Temp\ filerne
Både for bruger: [ejer] og [mommy]
Slet dem !!!
Evt. http://www.spywarefri.dk/vaerktoj.htm#emptytemp

Nyeste HiJackThis ved: http://danborg.org/spy/HJT/hijackthis.exe
Avatar billede majsmarken Nybegynder
20. august 2004 - 11:07 #3
OK <dannyboy> - du kom først - Go For It...
Avatar billede serverservice Praktikant
20. august 2004 - 11:11 #4
->Majsmarken , takker havde oveset Mommy
Avatar billede serverservice Praktikant
20. august 2004 - 11:29 #5
Gå i add/remove - find Naupoint toolbar og afinstaller- hvis den er der...

Fixes
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {0036F389-FEF8-43AC-9220-16430E0012ED} - C:\WINDOWS\DOWNLO~1\iEBINST.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-95BE-B378BA9CB52D} - C:\WINDOWS\DOWNLO~1\NAUPOI~1.DLL
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Toolbar\01.01.1629.0\da\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_16_0.dll
O3 - Toolbar: NAUPOINTBAR - {4E7BD74F-2B8D-469E-95BE-B378BA9CB52D} - C:\WINDOWS\DOWNLO~1\NAUPOI~1.DLL
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot

Hvis du ikke selv har installeret disse 2 skal de fixes:
O12 - Plugin for .bmp: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin6.dll
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin4.dll

Slettes i fejlsikret
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
Avatar billede natman Nybegynder
20. august 2004 - 12:17 #6
Lyder måske lidt dumt det her men "genstart i fejlsikret teilstand".
-HVordan??!!
Avatar billede natman Nybegynder
20. august 2004 - 12:20 #7
Og en ting til, jeg har ad-aware installeret. Er det ikke lige så god som Spybot?
Avatar billede serverservice Praktikant
20. august 2004 - 12:23 #8
Du starter op og holder f8 nede - så får du mulighed for fejlsikret, men det er jo kun vhis du ikke kan tømme mappen i normal tilstand- at det er nødvendigt.
Adaware og spybot supplerer hinanden godt - jeg bruger gerne begge.
Avatar billede natman Nybegynder
20. august 2004 - 12:48 #9
Logfile efter fix:

Logfile of HijackThis v1.97.7
Scan saved at 12:52:45, on 20-08-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
C:\Programmer\Browser MOUSE\mouse32a.exe
C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Office keyboard utility\1.1\MMKEYB.EXE
C:\Programmer\Office keyboard utility\1.1\TrayMon.exe
C:\Programmer\Office keyboard utility\1.1\osd.exe
C:\Programmer\Office keyboard utility\1.1\nhksrv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Nvc\Bin\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
D:\Documents and Settings\Ejer\Dokumenter\Modtagne filer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [RrkOBMZzr.exe] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [RrkOBMZzr] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [W1iFrH.exe] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [W1iFrH] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmer\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMOFFICEKEYBOARD] C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
O4 - HKLM\..\Run: [4x1.exe] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [4x1] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [M] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKLM\..\Run: [M.exe] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O15 - Trusted Zone: http://www.bgbank.dk
O16 - DPF: {0036F389-FEF8-43AC-9220-16430E0012ED} - http://naupoint.com/toolbar/installer/iEBINST6.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.4000578704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede natman Nybegynder
20. august 2004 - 12:52 #10
Flg. filer kan jeg dog ikke slette fra temp mappen:

~DF7305.tmp
4x1.exe
CmdLineExt03.dll
RrkOBMZzr.exe
W1iFrH.exe
Avatar billede natman Nybegynder
20. august 2004 - 12:53 #11
Den siger simpelthen "adgang nægtet".
Avatar billede serverservice Praktikant
20. august 2004 - 12:55 #12
Nå , men de ligger jo stadig i temp mappen. Du skal trykke F8 under opstart og vælge fejlsikret - login og slet alt i :

C:\documents and settings\ejer\lokale indstillinger\temp\
C:\documents and settings\mommy\lokale indstillinger\temp\
-ny log
Avatar billede majsmarken Nybegynder
20. august 2004 - 12:56 #13
Fejlsikker tilstand eller ej - denne util kan:
http://www.spywarefri.dk/tipsogtricks.htm#dr.delete
eller denne
http://download.broadbandmedic.com/Killbox.exe
= instruktion: http://home8.inet.tele.dk/fbj/TheKillBoxBrugsanvisning.htm

Så alt hvad der ligger i
C:\documents and settings\ejer\lokale indstillinger\temp
samt
C:\documents and settings\mommy\lokale indstillinger\temp

UD...
Avatar billede majsmarken Nybegynder
20. august 2004 - 12:56 #14
Enig...
Avatar billede serverservice Praktikant
20. august 2004 - 12:59 #15
Prøv at bruge killbox som majsmarken linker til
Avatar billede natman Nybegynder
20. august 2004 - 13:29 #16
Logfile of HijackThis v1.97.7
Scan saved at 13:33:56, on 20-08-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Programmer\Browser MOUSE\mouse32a.exe
C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Office keyboard utility\1.1\MMKEYB.EXE
C:\Programmer\Office keyboard utility\1.1\TrayMon.exe
C:\Programmer\Office keyboard utility\1.1\osd.exe
C:\Programmer\Office keyboard utility\1.1\nhksrv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Nvc\Bin\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
D:\Documents and Settings\Ejer\Dokumenter\Modtagne filer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [RrkOBMZzr.exe] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [RrkOBMZzr] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [W1iFrH.exe] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [W1iFrH] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmer\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMOFFICEKEYBOARD] C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
O4 - HKLM\..\Run: [4x1.exe] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [4x1] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [M] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKLM\..\Run: [M.exe] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O15 - Trusted Zone: http://www.bgbank.dk
O16 - DPF: {0036F389-FEF8-43AC-9220-16430E0012ED} - http://naupoint.com/toolbar/installer/iEBINST6.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.4000578704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede natman Nybegynder
20. august 2004 - 13:30 #17
Fik slettet temp mapperne med Dr delete......så er jeg vel færdigt?!
Avatar billede serverservice Praktikant
20. august 2004 - 13:46 #18
Nej ikke helt, ser ud til at filerne stadig er der, så vi må fixe dem væk.
Fixes:
O4 - HKLM\..\Run: [RrkOBMZzr.exe] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [RrkOBMZzr] C:\Documents and Settings\Ejer\Lokale indstillinger\Temp\RrkOBMZzr.exe
O4 - HKLM\..\Run: [W1iFrH.exe] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [W1iFrH] C:\documents and settings\ejer\lokale indstillinger\temp\W1iFrH.exe
O4 - HKLM\..\Run: [4x1.exe] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [4x1] C:\documents and settings\ejer\lokale indstillinger\temp\4x1.exe
O4 - HKLM\..\Run: [M] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O4 - HKLM\..\Run: [M.exe] C:\documents and settings\mommy\lokale indstillinger\temp\M.exe
O16 - DPF: {0036F389-FEF8-43AC-9220-16430E0012ED} - http://naupoint.com/toolbar/installer/iEBINST6.cab

ny log
Avatar billede natman Nybegynder
20. august 2004 - 13:58 #19
Logfile of HijackThis v1.97.7
Scan saved at 13:58:32, on 20-08-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Programmer\Browser MOUSE\mouse32a.exe
C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Office keyboard utility\1.1\MMKEYB.EXE
C:\Programmer\Office keyboard utility\1.1\TrayMon.exe
C:\Programmer\Office keyboard utility\1.1\osd.exe
C:\Programmer\Office keyboard utility\1.1\nhksrv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\Nvc\Bin\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
D:\Documents and Settings\Ejer\Dokumenter\Modtagne filer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmer\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMOFFICEKEYBOARD] C:\Programmer\Office keyboard utility\1.1\OFFICEKB.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O15 - Trusted Zone: http://www.bgbank.dk
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - http://netbank.bgbank.dk/html/activex/BG/Menu.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.4000578704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{22C2CF70-BD59-4318-B4F2-8D69CF3CF536}: NameServer = 62.61.130.1,62.61.131.1
Avatar billede serverservice Praktikant
20. august 2004 - 16:14 #20
Ja det var bedre...nu kan du slå systemgendsnnelse til igen.
mangler du antivirus er der en gratis her: http://www.grisoft.com/us/us_dwnl_free.php             AVG
se også
http://www.eksperten.dk/artikler/144         Spywarefri pc sikkerhed
Avatar billede majsmarken Nybegynder
20. august 2004 - 19:44 #21
... så denne http://www.spywarefri.dk/vaerktoj.htm#emptytemp er egentlig et pænt nyttigt værktøj at have i spanden...
Avatar billede natman Nybegynder
21. august 2004 - 10:21 #22
tak for hjælpen gutter!
Avatar billede majsmarken Nybegynder
21. august 2004 - 10:24 #23
.
Avatar billede serverservice Praktikant
21. august 2004 - 10:27 #24
for at lukkke - så skal du bare markere mit navn og vælge accepter - ved ikke hvorfor majsmarken svarer også
Avatar billede majsmarken Nybegynder
21. august 2004 - 10:30 #25
<natman> kunne jo gi' 1 point til mig <majsmarken> og 59 til dig <dannyboy> ???
Avatar billede serverservice Praktikant
21. august 2004 - 11:02 #26
>-majsmarken hvis du vil have dit behov dækket med hijacklog har jeg en til dig her *s: http://www.eksperten.dk/spm/531353
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester