Hijackthis hjælp!
Hey!Hvilke af disse her kan jeg godt slette? På forhånd tak! :)
===>
Logfile of HijackThis v1.98.2
Scan saved at 17:55:49, on 24-11-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOINTGR.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\ca.exe
C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
C:\Programmer\QuickTime\qttask.exe
C:\WINDOWS\System32\VetMsgNT.exe
C:\windows\SYSTEM32\ZoneLabs\vsmon.exe
C:\Programmer\Messenger Plus! 3\MsgPlus.exe
C:\documents and settings\david\lokale indstillinger\temp\5Q1O.exe
C:\documents and settings\maja\lokale indstillinger\temp\2AhYGgz.exe
C:\WINDOWS\System32\zhbadq.exe
C:\documents and settings\lone\lokale indstillinger\temp\C95DAHLU.exe
C:\Programmer\Web_Rebates\WebRebates0.exe
C:\Program Files\Winad Client\Winad.exe
C:\documents and settings\bruger\lokale indstillinger\temp\Gu.exe
C:\Program Files\Winad Client\WinClt.exe
C:\Programmer\Common files\SearchUpgrader\SearchUpgrader.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\PROGRA~1\Eyeball\EYEBAL~1\EyeballChat.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\my-playlist\my-playlist.exe
C:\Documents and Settings\Maja\Application Data\hatt.exe
C:\WINDOWS\System32\s3gfctrs.exe
C:\WINDOWS\System32\opamkr.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Web_Rebates\WebRebates1.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Maja\Dokumenter\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mmkpbboglucj.com/awUt_o6t84inll1i/1jkZWcvtcgkf1zZqJ3hDDpD26SuK/pyRfKO8oZUqBaVMdG2.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sesufjgtruddbm.org/awUt_o6t84j9r42U8B7463JmR4PGMeNBhXUkmtwD0os.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.dk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://memberservices.passport.net/ppsecure/MSRV_ResetPW.srf?lc=1030
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\CxtPls\CxtPls.dll
O2 - BHO: (no name) - {01F3075B-06D0-5CB8-2492-391010927233} - C:\DOCUME~1\Bruger\APPLIC~1\COPYCO~1\LINKAXIS.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: (no name) - {CC90CDA0-74A0-45b4-80EF-D89CA8C249B8} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\ca.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [evifizur] C:\WINDOWS\evifizur.exe
O4 - HKLM\..\Run: [shejip] C:\WINDOWS\shejip.exe
O4 - HKLM\..\Run: [wfefat] C:\WINDOWS\wfefat.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [5Q1O] C:\documents and settings\david\lokale indstillinger\temp\5Q1O.exe
O4 - HKLM\..\Run: [2AhYGgz] C:\documents and settings\maja\lokale indstillinger\temp\2AhYGgz.exe
O4 - HKLM\..\Run: [AutoLoaderEnvoloAutoUpdater] "C:\DOCUME~1\Maja\LOKALE~1\Temp\~compoundinst0\auto_update_loader.exe"
O4 - HKLM\..\Run: [berwned] C:\WINDOWS\berwned.exe
O4 - HKLM\..\Run: [nkpwabmwbq] C:\WINDOWS\System32\zhbadq.exe
O4 - HKLM\..\Run: [C95DAHLU] C:\documents and settings\lone\lokale indstillinger\temp\C95DAHLU.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [wF2X35S] cnmystem.exe
O4 - HKLM\..\Run: [Winad Client] C:\Program Files\Winad Client\Winad.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [Gu] C:\documents and settings\bruger\lokale indstillinger\temp\Gu.exe
O4 - HKLM\..\Run: [bold warn curb 1] C:\Documents and Settings\All Users\Application Data\Pop jump bold warn\bibfast.exe
O4 - HKLM\..\Run: [SearchUpgrader] C:\Programmer\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Eyeball Chat] "C:\PROGRA~1\Eyeball\EYEBAL~1\EyeballChat.exe" -min
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmer\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [my-playlist] "C:\Programmer\my-playlist\my-playlist.exe" /Autostart
O4 - HKCU\..\Run: [Ctus] C:\Documents and Settings\Maja\Application Data\hatt.exe
O4 - HKCU\..\Run: [hot7RRe4V] s3gfctrs.exe
O4 - HKCU\..\Run: [Kxntro] C:\WINDOWS\System32\opamkr.exe
O4 - HKCU\..\Run: [tick dart] C:\DOCUME~1\Maja\APPLIC~1\FLAPEQ~1\FirstGplMemo.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Date Manager.lnk = C:\Programmer\Date Manager\DateManager.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Programmer\PrecisionTime\PrecisionTime.exe
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Erotik - {95347D30-555E-4534-A05F-2229074E0A88} - http://www.porno.dk (file missing)
O9 - Extra 'Tools' menuitem: Erotik... - {95347D30-555E-4534-A05F-2229074E0A88} - http://www.porno.dk (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Sol Dating - {D5721FC7-8FBE-4d71-9C65-9718CFA078A8} - http://www.soldating.dk (file missing)
O9 - Extra 'Tools' menuitem: Sol Dating... - {D5721FC7-8FBE-4d71-9C65-9718CFA078A8} - http://www.soldating.dk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {1230CB21-C88D-11CF-B347-000000000000} - http://www.eingang69.de/EroticAccess/cabs/1786015.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=d25687639c9299a76b6a9158ac30f213893caa80138c732235a7f84005dbbdff536e8347975315f82756783740bad9cd433dd9:7e9a9bb989c56a97bbde5ad8573197fa
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/14852ddb59bf87618118/netzip/RdxIE601.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} - http://dialxs.nl/install/dialxs.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} (IEPlugIn Class) - http://www.popfile.de/myplaylist/pc/MY-PLAYLIST-WEBINSTALLER_loader.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
<===
