Hijack tis log på nyformateret computer
Er der nogen der har tid til at kigge på min hijack this log. Jeg har ligeformateret maskinen og scannet men norton, antivir, ad-aware og spybot, men der er stadig et eller andet som gør at den fryser. Efter nogle gestart kan den ikke bruge javascript og axtivex komponenter.Spyboot fandt en fil ved navn Cobrator som den ikke kunne komme ind i, notorn fryser og antivir stopper ved en fil i windowsmappen der hedder mnyz.exe.
her er loggen:
Logfile of HijackThis v1.98.2
Scan saved at 17:39:47, on 19-11-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\r_server.exe
C:\WINDOWS\System32\guardpc.exe
C:\WINDOWS\System32\svdll32.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\aim.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
c:\windows\system32\qsws\beird.exe
c:\windows\system32\qsws\beird.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\wuauclt.exe
G:\InstDisk\div virus og orm\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bandlist.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [kernel32dll] guardpc.exe
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [*windows update] wuacrlt.exe
O4 - HKLM\..\Run: [DATABASE MySql] c:\windows\system32\qsws\repcale.exe c:\windows\system32\qsws\beird.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [AOL Instant Messenger] aim.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmer\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\RunServices: [kernel32dll] guardpc.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [*windows update] wuacrlt.exe
O4 - HKLM\..\RunServices: [DATABASE MySql] c:\windows\system32\qsws\repcale.exe c:\windows\system32\qsws\beird.exe
O4 - HKLM\..\RunServices: [AOL Instant Messenger] aim.exe
O4 - HKLM\..\RunOnce: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kernel32dll] guardpc.exe
O4 - HKCU\..\Run: [*windows update] wuacrlt.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [DATABASE MySql] c:\windows\system32\qsws\repcale.exe c:\windows\system32\qsws\beird.exe
O4 - HKCU\..\Run: [AOL Instant Messenger] aim.exe
O4 - HKCU\..\RunServices: [DATABASE MySql] c:\windows\system32\qsws\repcale.exe c:\windows\system32\qsws\beird.exe
O4 - HKCU\..\RunOnce: [kernel32dll] guardpc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1100822123582
