tjek HJT log for en ven
En af mine venners comp er blevet underlig:Den spørger om XP cd.
Den spørger om Office cd.
Explorer virker ikke.
Og Windows Media Player har slettet sig selv.
Hans computer er ikke opdateret fordi han næsten har lige fået geninstalleret windows. Men når hans computer er "ren", så skal jeg nok bede ham om at opdatere. :)
Måske kunne HJT hjælpe. Her er hans log:
---------------------------------------------------
Logfile of HijackThis v1.98.2
Scan saved at 12:00:52, on 28-08-2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesOffice keyboard utility1.1 hksrv.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsoundman.exe
C:WINDOWSSystem32 egscan.exe
C:WINDOWSDit.exe
C:Program FilesDU MeterDUMeter.exe
C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnd.exe
C:Program FilesOffice keyboard utility1.1OFFICEKB.exe
C:WINDOWSSystem32smnp.exe
C:Program FilesTerraTecCinergy 400 TVTTTVRC.exe
C:WINDOWSSystem32 undll32.exe
C:Program FilesOffice keyboard utility1.1MMKEYB.EXE
C:Program FilesOffice keyboard utility1.1TrayMon.exe
C:Program FilesOffice keyboard utility1.1osd.exe
C:WINDOWSSystem32sysentry32.exe
C:Program FilesRealRealPlayerRealPlay.exe
C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnf.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesCMEIICMESys.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Documents and SettingsJacobApplication Dataorer.exe
C:WINDOWSSystem32uuvmqxka.exe
C:Program FilesSpywareGuardsgmain.exe
C:WINDOWSSystem32 undll32.exe
C:WINDOWSDitExp.exe
C:Program FilesCommon FilesGMTGMT.exe
C:Program FilesSpywareGuardsgbhp.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSSystem32wuauclt.exe
C:WINDOWSsystem32cmd.exe
D:Programmer&Manualerhijackthis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:Program FilesNewDotNet ewdotnet6_30.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:Program FilesSpywareGuarddlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: (no name) - {6DA8195F-ED31-74BC-D501-605504A07033} - C:WINDOWSSystem32vehfagm.dll
O2 - BHO: G1.GZ - {79C03BC5-6C55-4B5B-921F-C02B6F1ABD7B} - C:DOCUME~1ALLUSE~1.WINAPPLIC~1PribiPribi.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar1.dll
O2 - BHO: LBBHO - {EFD84954-6B46-42f4-81F3-94CE9A77052D} - C:WINDOWSlbbho.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [SoundMan] soundman.exe
O4 - HKLM..Run: [Windows Registry Scan] regscan.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [Dit] Dit.exe
O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [DU Meter] C:Program FilesDU MeterDUMeter.exe
O4 - HKLM..Run: [Share-to-Web Namespace Daemon] C:Program FilesHewlett-PackardHP Share-to-Webhpgs2wnd.exe
O4 - HKLM..Run: [FLMOFFICEKEYBOARD] C:Program FilesOffice keyboard utility1.1OFFICEKB.exe
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [blah service] smnp.exe
O4 - HKLM..Run: [TerraTec Remote Control] C:Program FilesTerraTecCinergy 400 TVTTTVRC.exe
O4 - HKLM..Run: [System Update] C:WINDOWSSystem32cnjrzjum.exe
O4 - HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM..Run: [System Uptime Server] sysentry32.exe
O4 - HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 - HKLM..Run: [Cryptographic Service] C:WINDOWSSystem32khmjx.exe
O4 - HKLM..Run: [RealTray] C:Program FilesRealRealPlayerRealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [CMESys] "C:Program FilesCommon FilesCMEIICMESys.exe"
O4 - HKLM..RunServices: [Windows Registry Scan] regscan.exe
O4 - HKLM..RunServices: [blah service] smnp.exe
O4 - HKLM..RunServices: [System Uptime Server] sysentry32.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Rrth] C:Documents and SettingsJacobApplication Dataorer.exe
O4 - HKCU..Run: [Csfok] C:WINDOWSSystem32uuvmqxka.exe
O4 - HKCU..Run: [Pribi.exe] C:DOCUME~1ALLUSE~1.WINAPPLIC~1PribiPribi.exe
O4 - Startup: SpywareGuard.lnk = C:Program FilesSpywareGuardsgmain.exe
O8 - Extra context menu item: &Google Search - res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSweb elated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSweb elated.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:WINDOWSSystem32Shdocvw.dll
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093635812870
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLMSystemCCSServicesTcpip..{EC2FBFA2-6108-450F-B397-31496D73472D}: NameServer = 193.162.153.164 194.239.134.83
---------------------------------------------------
Sig til, hvis du begynder at se loggen igennem :)
Takker på forhånd
