Fjernelse af searchbar?

Lad os se, hvad en HijackThis-log viser.

Hent Spybot og HijackThis:
http://www.spywarefri.dk/vaerktoj.htm

Installer og kør Spybot, opdater online, scan, afhjælp valgte problemer og genstart.

Derefter kører du Hijackthis > Scan > Save log. Kopier logfilen herind, så kigger vi på den.
Lad være med at slette noget selv med Hijackthis, vi skal nok hjælpe med at tyde loggen.

Logfile of HijackThis v1.98.2
Scan saved at 17:08:00, on 14-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\inetm\services.exe
C:\Programmer\WinFast\WFTVFM\WFSCH.exe
C:\Programmer\SK-1300\mmkeymanager.exe
C:\WINDOWS\SOINTGR.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ejer\Skrivebord\hijackthis.exe
C:\WINDOWS\SoftwareDistribution\Download\44250f5474f531ae52d97fd88ab4fc58\update\update.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.opasia.dk/msie_google.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.opasia.dk/msie_search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.opasia.dk/start
F3 - REG:win.ini: run=C:\WINDOWS\inetm\services.exe
O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inetm\1.02.04.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinFast Schedule] C:\Programmer\WinFast\WFTVFM\WFSCH.exe
O4 - HKLM\..\Run: [AmitechKeyboard] C:\Programmer\SK-1300\mmkeymanager.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\PROGRA~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\xvmbfac.exe
O4 - HKLM\..\Run: [SREPL40M] C:\WINDOWS\System32\SREPL40M.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.opasia.dk/start
O15 - Trusted Zone: *.windowsupdate.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A63085E1-F88D-474B-95DE-80C7E1AEF093}: NameServer = 194.239.134.83 193.162.153.164

Herunder er der nogle filer, som du skal fixe. Sæt en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned.

Fix disse med HijackThis:

F3 - REG:win.ini: run=C:\WINDOWS\inetm\services.exe

O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inetm\1.02.04.dll

O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\xvmbfac.exe

Kender du selv dette program? Hvis ikke så fix det.
O4 - HKLM\..\Run: [SREPL40M] C:\WINDOWS\System32\SREPL40M.exe

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - Startup: PowerReg Scheduler.exe

Har du lavet restriktioner i IE med Spybot? Hvis ikke så fix disse 06.
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

----
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
----

Genstart i fejlsikret tilstand (F8 i opstart).  Find og slet:

C:\WINDOWS\inetm\ >>>> mappen
C:\WINDOWS\System32\xvmbfac.exe >>>> filen

Genstart almindeligt og send en ny log herind til tjek – tak.

Computeren mangler at blive opdateret med minimum Service Pack 1. Besøg Windows Update.

Logfile of HijackThis v1.98.2
Scan saved at 19:54:54, on 15-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programmer\WinFast\WFTVFM\WFSCH.exe
C:\Programmer\SK-1300\mmkeymanager.exe
C:\WINDOWS\SOINTGR.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Documents and Settings\Ejer\Skrivebord\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.opasia.dk/msie_google.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.opasia.dk/msie_search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.opasia.dk/start
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:\WINDOWS\inetm\services.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinFast Schedule] C:\Programmer\WinFast\WFTVFM\WFSCH.exe
O4 - HKLM\..\Run: [AmitechKeyboard] C:\Programmer\SK-1300\mmkeymanager.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\PROGRA~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.opasia.dk/start
O15 - Trusted Zone: *.windowsupdate.com

Windows og IE mangler stadig at blive opdateret med minimum Service Pack 1?


Herunder er der nogle filer, som du skal fixe. Sæt en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned.

Fix disse med HijackThis:

R3 - Default URLSearchHook is missing

F3 - REG:win.ini: run=C:\WINDOWS\inetm\services.exe

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\services.exe

Genstart i fejlsikret tilstand (F8 i opstart).  Find og slet:

C:\WINDOWS\inetm\ >>>> mappen inetm

Genstart almindeligt og send en ny log herind til tjek – tak.

De er fikset før. og mappen er før slettet i fejlsikret tilstand

Så skal jeg se en ny log, efter du har fixet dem igen.

ok forsøger jeg

Logfile of HijackThis v1.98.2
Scan saved at 13:22:23, on 25-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programmer\WinFast\WFTVFM\WFSCH.exe
C:\Programmer\SK-1300\mmkeymanager.exe
C:\WINDOWS\SOINTGR.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\inetm\winlogon.exe
c:\program files\InterMute\SpySubtract\CWShredder.exe
C:\Documents and Settings\Ejer\Skrivebord\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.tdconline.dk/msie_google.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.opasia.dk/msie_search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchportal.info/10040/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
F3 - REG:win.ini: run=C:\WINDOWS\inetm\winlogon.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinFast Schedule] C:\Programmer\WinFast\WFTVFM\WFSCH.exe
O4 - HKLM\..\Run: [AmitechKeyboard] C:\Programmer\SK-1300\mmkeymanager.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\PROGRA~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\winlogon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\winlogon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O15 - Trusted Zone: *.windowsupdate.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A63085E1-F88D-474B-95DE-80C7E1AEF093}: NameServer = 194.239.134.83 193.162.153.164

Ser frem til det

Download denne engangsscanner: http://www.spywareinfo.dk/download/mwav.exe
Du skal bruge den senere.

Fix disse med HijackThis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchportal.info/10040/

F3 - REG:win.ini: run=C:\WINDOWS\inetm\winlogon.exe

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetm\winlogon.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetm\winlogon.exe

----
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
----

Genstart i fejlsikret tilstand (F8 i opstart). Find og slet:

C:\WINDOWS\inetm\ >>>> mappen inetm

Tag en scanning med mwav.exe – aktiver så den scanner mest muligt (alle filer og mapper m.m.).

Genstart normalt og få opdateret Windows og IE

Efter du har opdateret Windows og IE, vil jeg godt se en ny log fra HijackThis – tak.

Har fulgt dine instrukser til nøje og her så den nye log

Logfile of HijackThis v1.98.2
Scan saved at 14:58:14, on 31-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmer\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programmer\WinFast\WFTVFM\WFSCH.exe
C:\Programmer\SK-1300\mmkeymanager.exe
C:\WINDOWS\SOINTGR.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ejer\Skrivebord\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find.tdconline.dk/msie_google.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.opasia.dk/msie_search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tdconline.dk/start
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tdconline.dk/start
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:\WINDOWS\inetm\winlogon.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinFast Schedule] C:\Programmer\WinFast\WFTVFM\WFSCH.exe
O4 - HKLM\..\Run: [AmitechKeyboard] C:\Programmer\SK-1300\mmkeymanager.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\PROGRA~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\PROGRA~1\Logitech\WINGMA~1\Lwpevntm.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .mpeg: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tdconline.dk/start
O15 - Trusted Zone: *.windowsupdate.com

Du mangler altså stadig at få opdateret Windows og IE med minimum Service Pack 1. Besøg Windows Update.

Herefter ny log - tak.

Alt virker nu.... så takker for alt det du har gjordt

Velbekomme ;-)