det var hele loggen fra hijack
her er loggen (rapporten) fra CWShredder
**** Run Keys ****
RUN: [C-Media Mixer] Mixer.exe /startup
RUN: [WINDVDPatch] CTHELPER.EXE
RUN: [UpdReg] C:\WINDOWS\UpdReg.EXE
RUN: [Jet Detection] C:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
RUN: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
RUN: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
RUN: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
RUN: [nwiz] nwiz.exe /install
RUN: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
RUN: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
RUN: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe" -lang 1033
RUN: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
RUN: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
RUN: [Ad-watch] C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
RUN: [Ad-aware] C:\Programmer\Lavasoft\Ad-aware 6\Ad-aware.exe +c
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
RUN: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
RUN: [Steam] C:\games\hl2\Steam\\Steam.exe -silent
RUN: [Norton SystemWorks] "C:\Programmer\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
RUN: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
**** Browser Helper Objects ****
**** IE Toolbars ****
TOOLBAR: [Norton AntiVirus] C:\Programmer\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
**** IE Extensions ****
IEExt: [Messenger] C:\Programmer\Messenger\msmsgs.exe
**** Hosts File Entries ****
HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1
www.igetnet.com HOSTS: 127.0.0.1 code.ignphrases.com
HOSTS: 127.0.0.1 clear-search.com
HOSTS: 127.0.0.1 r1.clrsch.com
HOSTS: 127.0.0.1 sds.clrsch.com
HOSTS: 127.0.0.1 status.clrsch.com
HOSTS: 127.0.0.1
www.clrsch.com HOSTS: 127.0.0.1 clr-sch.com
HOSTS: 127.0.0.1 sds-qckads.com
HOSTS: 127.0.0.1 status.qckads.com
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 search.netscape.com
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 auto.search.msn.com
HOSTS: 69.20.16.183 ieautosearch
HOSTS: 69.20.16.183 ieautosearch
**** IE Settings ****
Default Page:
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Default Search:
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Local Page: C:\WINDOWS\system32\blank.htm
Search Bar:
http://www.couldnotfind.com/search_page.html?&account_id=152294 Search Page:
http://www.couldnotfind.com/search_page.html?&account_id=152294 **** IE Context Menu (Right click) ****
IEContext: [E&ksporter til Microsoft Excel]
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 **** Layered Service Providers ****
LSP: aklsp.dll over [MSAFD Tcpip [TCP/IP]]
LSP: aklsp.dll over [MSAFD Tcpip [UDP/IP]]
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A538EABB-166C-44CB-B125-5A87B92A2759}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A538EABB-166C-44CB-B125-5A87B92A2759}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{2583F1E8-5AB3-4908-BB20-F9EC4C5D92FE}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{2583F1E8-5AB3-4908-BB20-F9EC4C5D92FE}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BBFF2CF7-4678-4927-AC87-06AAA606B6F2}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BBFF2CF7-4678-4927-AC87-06AAA606B6F2}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{93D16745-01F1-4C9D-967C-50C06EF2E2C0}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{93D16745-01F1-4C9D-967C-50C06EF2E2C0}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{22F002C9-B675-4EA0-9869-A54B360E268D}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{22F002C9-B675-4EA0-9869-A54B360E268D}] DATAGRAM 2
**** Blocked Control Panel Items ****
BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No
**** Downloaded Program Files ****
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [
http://www.apple.com/qtactivex/qtplugin.cab] {386A771C-E96A-421F-8BA7-32F1B706892F} [
http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab] C:\WINDOWS\Downloaded Program Files\ISTactivex.dll
{6414512B-B978-451D-A0D8-FCFDF33E833C} [
http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096096130301] {79849612-A98F-45B8-95E9-4D13C7B6B35C} [
http://static.topconverting.com/activex/loader2.ocx] {8AD9C840-044E-11D1-B3E9-00805F499D93} [
http://java.sun.com/products/plugin/1.3.1/jinstall-131_03-win.cab] {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} [
http://java.sun.com/products/plugin/1.3.1/jinstall-131_03-win.cab] {D27CDB6E-AE6D-11CF-96B8-444553540000} [
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab] **** Windows Services ****
[Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
[ALG] %SystemRoot%\System32\alg.exe
[AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
[aspnet_state] %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
[AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
[Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
[ccEvtMgr] "C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe"
[ccProxy] "C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe"
[ccPwdSvc] "C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe"
[ccSetMgr] "C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe"
[cisvc] C:\WINDOWS\System32\cisvc.exe
[ClipSrv] %SystemRoot%\system32\clipsrv.exe
[COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
[CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[DcomLaunch] %SystemRoot%\system32\svchost -k DcomLaunch
[Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
[dmadmin] %SystemRoot%\System32\dmadmin.exe /com
[dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
[ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[Eventlog] %SystemRoot%\system32\services.exe
[EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
[FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
[helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
[HTTPFilter] %SystemRoot%\System32\svchost.exe -k HTTPFilter
[ImapiService] C:\WINDOWS\System32\imapi.exe
[ISEXEng] C:\WINDOWS\system32\angelex.exe
[lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
[lanmanworkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
[LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
[Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
[mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
[MSDTC] C:\WINDOWS\System32\msdtc.exe
[MSIServer] C:\WINDOWS\System32\msiexec.exe /V
[navapsvc] "C:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"
[NetDDE] %SystemRoot%\system32\netdde.exe
[NetDDEdsdm] %SystemRoot%\system32\netdde.exe
[Netlogon] %SystemRoot%\System32\lsass.exe
[Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
[Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
[NPFMntor] "C:\Programmer\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe"
[NProtectService] C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
[NtLmSsp] %SystemRoot%\System32\lsass.exe
[NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
[NVSvc] %SystemRoot%\system32\nvsvc32.exe
[PlugPlay] %SystemRoot%\system32\services.exe
[PolicyAgent] %SystemRoot%\System32\lsass.exe
[ProtectedStorage] %SystemRoot%\system32\lsass.exe
[RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
[RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
[RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
[RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[RemoteRegistry] %SystemRoot%\system32\svchost.exe -k LocalService
[RpcLocator] %SystemRoot%\System32\locator.exe
[RpcSs] %SystemRoot%\system32\svchost -k rpcss
[RSVP] %SystemRoot%\System32\rsvp.exe
[SamSs] %SystemRoot%\system32\lsass.exe
[SAVScan] "C:\Programmer\Norton SystemWorks\Norton AntiVirus\SAVScan.exe"
[SBService] C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
[SCardSvr] %SystemRoot%\System32\SCardSvr.exe
[Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
[seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
[SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
[SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
[ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
[SNDSrvc] "C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe"
[SPBBCSvc] "C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe"
[Speed Disk service] C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
[Spooler] %SystemRoot%\system32\spoolsv.exe
[srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
[SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
[stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
[SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{BCF32501-FB32-4DC2-933F-34B1380A11DC}
[Symantec Core LC] C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
[SymWSC] "C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe"
[SysmonLog] %SystemRoot%\system32\smlogsvc.exe
[TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
[TermService] %SystemRoot%\System32\svchost -k DComLaunch
[Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
[TlntSvr] C:\WINDOWS\System32\tlntsvr.exe
[TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
[UMWdf] C:\WINDOWS\system32\wdfmgr.exe
[upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
[UPS] %SystemRoot%\System32\ups.exe
[VSS] %SystemRoot%\System32\vssvc.exe
[W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
[WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
[winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
[WmdmPmSN] %SystemRoot%\System32\svchost.exe -k netsvcs
[Wmi] %SystemRoot%\System32\svchost.exe -k netsvcs
[WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
[wscsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
[wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
[WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs
[xmlprov] %SystemRoot%\System32\svchost.exe -k netsvcs
**** Custom IE Search Items ****
SEARCH: [SearchAssistant]
http://www.couldnotfind.com/search_page.html?&account_id=152294 SEARCH: [SearchAssistant]
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm SEARCH: [CustomizeSearch]
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm **** Complete IE Options ****
IEOPT: [NoUpdateCheck]
IEOPT: [NoJITSetup]
IEOPT: [Disable Script Debugger] yes
IEOPT: [Show_ChannelBand] No
IEOPT: [Anchor Underline] yes
IEOPT: [Cache_Update_Frequency] Once_Per_Session
IEOPT: [Display Inline Images] yes
IEOPT: [Do404Search]
IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
IEOPT: [Save_Session_History_On_Exit] no
IEOPT: [Show_FullURL] no
IEOPT: [Show_StatusBar] yes
IEOPT: [Show_ToolBar] yes
IEOPT: [Show_URLinStatusBar] yes
IEOPT: [Show_URLToolBar] yes
IEOPT: [Start Page]
http://www.google.dk/ IEOPT: [Use_DlgBox_Colors] yes
IEOPT: [Search Page]
http://www.couldnotfind.com/search_page.html?&account_id=152294 IEOPT: [Check_Associations] yes
IEOPT: [FullScreen] no
IEOPT: [Window_Placement] ,
IEOPT: [NotifyDownloadComplete] yes
IEOPT: [Error Dlg Displayed On Every Error] no
IEOPT: [Error Dlg Details Pane Open] no
IEOPT: [Use FormSuggest] yes
IEOPT: [FormSuggest Passwords] yes
IEOPT: [FormSuggest PW Ask] yes
IEOPT: [FavChevron_Complete] 2
IEOPT: [FavChevron_Failed] 9
IEOPT: [FavChevron_Error] 27
IEOPT: [Use_Combobox_DlgBox_Colors_Complete] 2
IEOPT: [Use_Combobox_DlgBox_Colors_Failed] 9
IEOPT: [Use_Combobox_DlgBox_Colors_Error] 27
IEOPT: [Save Directory] C:\Dokumenter\
IEOPT: [AutoSearch]
IEOPT: [AddToFavoritesExpanded]
IEOPT: [BandRest] Never
IEOPT: [Search Bar]
http://www.couldnotfind.com/search_page.html?&account_id=152294 IEOPT: [Search Page_bak]
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IEOPT: [Use Search Assistant] no
IEOPT: [Default_Page_URL]
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IEOPT: [Default_Search_URL]
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IEOPT: [Search Page]
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IEOPT: [Enable_Disk_Cache] yes
IEOPT: [Cache_Percent_of_Disk]
IEOPT: [Delete_Temp_Files_On_Exit] yes
IEOPT: [Local Page] %SystemRoot%\system32\blank.htm
IEOPT: [Anchor_Visitation_Horizon]
IEOPT: [Use_Async_DNS] yes
IEOPT: [Placeholder_Width]
IEOPT: [Placeholder_Height]
IEOPT: [Start Page]
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IEOPT: [CompanyName] Microsoft Corporation
IEOPT: [Custom_Key] MICROSO
IEOPT: [Wizard_Version] 6.0.2600.0000
IEOPT: [FullScreen] no
IEOPT: [BandRest] Never