Security - Custom Level for Internet, knap inaktiv

Der er muligvis lavet restriktioner i Internet explorer. Det kan ses og fjernes i en HiJackThis log.
http://www.spywarefri.dk/vaerktoj.htm
Hent programmet, scan, save log og kopier loggen herind.
Du må ikke selv fixe noget i programmet da den både viser snavs og ting der skal være der.

Her er logfil:

Logfile of HijackThis v1.98.0
Scan saved at 10:33:38 PM, on 11/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\AccessManager\Client\AMBroker.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\AccessManager\PMAC\sp_SWIns.exe
C:\Program Files\AccessManager\Client\sygman.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\GPQ\Pad32.exe
C:\GPQ\Fahid.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\AccessManager\Client\AccessMgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINNT\system32\rcf.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINNT\system32\sessionmgr.exe
C:\WINNT\system32\conime.exe
C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe
C:\WINNT\system32\rcf.exe
C:\WINNT\system32\sessionmgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\BulletProofSoft.com\SpywareRemover\EDF71653.DLL
C:\Program Files\Softmate\IPSwitcher Basic\IPSwitcherBasic.exe
C:\Install\HijackThis\hijackthis.exe

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Pad32] C:\GPQ\Pad32.exe
O4 - HKLM\..\Run: [FAhid] C:\GPQ\Fahid.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [AccessManager] C:\Program Files\AccessManager\Client\AccessMgr.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Rcf Driver] rcf.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [irc session] sessionmgr.exe
O4 - HKLM\..\RunServices: [Rcf Driver] rcf.exe
O4 - HKLM\..\RunServices: [irc session] sessionmgr.exe
O4 - HKCU\..\Run: [spywatch] C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP
O4 - HKCU\..\Run: [Rcf Driver] rcf.exe
O4 - HKCU\..\Run: [irc session] sessionmgr.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
O17 - HKLM\System\CS2\Services\Tcpip\..\{1422CA4C-37D9-412F-B547-759D9AE0DAF4}: NameServer = 203.198.23.208,218.102.32.208

Du har faktisk noget snavs i loggen:

Disse skal du fixe i HiJackThis. Sæt et kryds ud for dem og klik fix checked.

O4 - HKLM\..\Run: [Rcf Driver] rcf.exe
O4 - HKLM\..\Run: [irc session] sessionmgr.exe
O4 - HKLM\..\RunServices: [Rcf Driver] rcf.exe
O4 - HKLM\..\RunServices: [irc session] sessionmgr.exe
O4 - HKCU\..\Run: [Rcf Driver] rcf.exe
O4 - HKCU\..\Run: [irc session] sessionmgr.exe

Genstart i fejlsikret tilstand og slet disse 2 filer:
C:\WINNT\system32\rcf.exe
C:\WINNT\system32\sessionmgr.exe

Genstart normalt og afinstaller så SpyWareRemover.

Genstart igen og kom med en ny log til kontrol.

IE har stadig ikke "Custom level..." knappen aktiv ved "Internet" Zonen, men nu kan IE da indlæse den side den havde problemer med uden at komme med fejl.

Er der mere at komme efter nu ?

Hvorfår skulle jeg fjerne SpyWareRemover ? Den ser ellers ud til at være effektiv ??

Ny logfil:

Logfile of HijackThis v1.98.0
Scan saved at 11:20:58 PM, on 11/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\AccessManager\Client\AMBroker.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\AccessManager\PMAC\sp_SWIns.exe
C:\Program Files\AccessManager\Client\sygman.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\GPQ\Pad32.exe
C:\GPQ\Fahid.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\AccessManager\Client\AccessMgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINNT\system32\conime.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Softmate\IPSwitcher Basic\IPSwitcherBasic.exe
C:\WINNT\System32\svchost.exe
C:\Install\HijackThis\hijackthis.exe

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Pad32] C:\GPQ\Pad32.exe
O4 - HKLM\..\Run: [FAhid] C:\GPQ\Fahid.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [AccessManager] C:\Program Files\AccessManager\Client\AccessMgr.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [spywatch] C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
O17 - HKLM\System\CS2\Services\Tcpip\..\{1422CA4C-37D9-412F-B547-759D9AE0DAF4}: NameServer = 203.198.23.208,218.102.32.208

Grunden til at du ikke skal støtte SpywareRemover er her:
http://www.spywarewarrior.com/rogue_anti-spyware.htm
Den er listet i den dårlige sektion.

Da Anti spyware kan give disse symptomer mht låste ting i internet explorer'en, skal du lige afinstallere både SpywareRemover og Spywareguard. Efter en genstart kan du så se om der nu er "låst op"

Her er kan du se hvad vi anbefaler af gode og effektive antispyware programmer:
http://www.spywarefri.dk/pakken.htm
Specielt anbefaler vi Spybot,spywareblaster, IE-Spyad og spywareguard.

Jeg glemte helt at sige at loggen faktisk er ren med undtagelse af SpywareRemover.

Ok det vil jeg gøre. Tak for hjælpen.

Takker for point :)