Jeg har noget spyware, er der nogen som har lyst til at tjekke ?
Har fået en nasty spyware på min computerEr der nogen som kan se om min log er ren?
mvh
Jakob
Logfile of HijackThis v1.97.7
Scan saved at 18:00:44, on 26-11-2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\Programmer\COMPAQ\CpqWebDMI\webdmi.EXE
C:\WINNT\System32\svchost.exe
C:\Programmer\CA\eTrust Antivirus\InoRpc.exe
C:\Programmer\CA\eTrust Antivirus\InoRT.exe
C:\Programmer\CA\eTrust Antivirus\InoTask.exe
C:\WINNT\INV32CLI.EXE
C:\Programmer\Compaq\LCRMS\LCRMS.EXE
C:\WINNT\System32\NTME\METHWNT.EXE
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\NTME\brad32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
c:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\WUSER32.EXE
C:\WINNT\System32\cpqdmi.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Smtray.exe
C:\Programmer\Compaq\Compaq EAB Software\cpqek.exe
C:\WINNT\System32\CHKADMIN.EXE
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Real\RealPlayer\RealPlay.exe
C:\WINNT\loadqm.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Programmer\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINNT\System32\twink64.exe
C:\WINNT\System32\ymzggcg.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\Administrator\Application Data\istw.exe
C:\WINNT\System32\l?ass.exe
C:\Programmer\ORL\VNC\WinVNC.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\INST\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.10.29
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://213.159.117.134/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINNT\localNRD.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {38DB352B-C541-2B93-D170-175508F32F35} - C:\WINNT\System32\gviui.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programmer\SideFind\sfbho.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [cpqek] C:\Programmer\Compaq\Compaq EAB Software\cpqek.exe
O4 - HKLM\..\Run: [CHKADMIN] CHKADMIN.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RealTray] C:\Programmer\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Programmer\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\System32\twink64.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [jogbfkwul] C:\WINNT\System32\ymzggcg.exe
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SysTime] C:\WINNT\System32\systime.exe
O4 - HKCU\..\Run: [Strs] C:\Documents and Settings\Administrator\Application Data\istw.exe
O4 - HKCU\..\Run: [Ykirt] C:\WINNT\System32\l?ass.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Run WinVNC (App Mode).lnk = C:\Programmer\ORL\VNC\WinVNC.exe
O9 - Extra button: SideFind (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .au: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mid: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .qt: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\Programmer\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{15978C6B-2B23-42BA-B7E9-B8C1E2CCB1BF}: NameServer = 194.239.134.83,172.16.10.29
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = frederiksvaerk.dk
O17 - HKLM\System\CS1\Services\Tcpip\..\{15978C6B-2B23-42BA-B7E9-B8C1E2CCB1BF}: NameServer = 194.239.134.83,172.16.10.29
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = frederiksvaerk.dk
O17 - HKLM\System\CS2\Services\Tcpip\..\{15978C6B-2B23-42BA-B7E9-B8C1E2CCB1BF}: NameServer = 194.239.134.83,172.16.10.29
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = frederiksvaerk.dk
