HJÆLP spyware - HijackThis log
jeg tror jeg har fået spyware min startside er http://allwebseek.com/ også selvom jeg ændre detjeg har lige installeret norman virus control og opdateret
men den skriver:
installation eller opdatering af norman virus control kunne ikke gennem føres, da der opstod en uventet fejl.
gem dit arbejde og klik derefter på knappen genstert nu
og når jeg gensarter den står det der igen
hvad er der gjaldt..?
Logfile of HijackThis v1.99.0
Scan saved at 16:16:33, on 09-02-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\usbtapnp.exe
C:\WINDOWS\system32\iexplore32.exe
C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
C:\WINDOWS\system32\wininit32.exe
C:\SlySoft\AnyDVD\AnyDVD.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\WINDOWS\System32\comctl32.exe
C:\Programmer\Archive\archive.exe
C:\Programmer\Parallel Tasking\ptask.exe
C:\Program Files\Okdehor\Kyqotb.exe
C:\Norman\NVC\BIN\ZLH.EXE
C:\WINDOWS\system32\hiden.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\winttr.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Norman\NVC\BIN\Zanda.exe
C:\WINDOWS\System32\comrepl.exe
C:\Documents and Settings\michael thomsen\Application Data\wp?h.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Spyware fjerner\spywareguard\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Spyware fjerner\hijackthis\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allwebseek.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allwebseek.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://allwebseek.com
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Spyware fjerner\spywareguard\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYWAR~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programmer\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [USBTA] C:\WINDOWS\System32\usbtapnp.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [IELoader32] iexplore32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [SysInit] wininit32.exe -services
O4 - HKLM\..\Run: [frsk] C:\WINDOWS\frsk.exe
O4 - HKLM\..\Run: [AnyDVD] C:\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Programmer\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [AEY7PeX.exe] C:\documents and settings\michael thomsen\lokale indstillinger\temp\AEY7PeX.exe
O4 - HKLM\..\Run: [XtGrui.exe] C:\documents and settings\michael thomsen\lokale indstillinger\temp\XtGrui.exe
O4 - HKLM\..\Run: [7844ea71e894] C:\WINDOWS\System32\comctl32.exe
O4 - HKLM\..\Run: [Archive] C:\Programmer\Archive\archive.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Parallel Tasking] C:\Programmer\Parallel Tasking\ptask.exe
O4 - HKLM\..\Run: [Icjooma] C:\Program Files\Okdehor\Kyqotb.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\NVC\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [hiden.exe] hiden.exe
O4 - HKLM\..\RunServices: [SysInit] wininit32.exe -services
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WCPS] C:\WINDOWS\System32\winttr.exe
O4 - HKCU\..\Run: [comrepl] C:\WINDOWS\System32\comrepl.exe
O4 - HKCU\..\Run: [Scbl] C:\Documents and Settings\michael thomsen\Application Data\wp?h.exe
O4 - HKCU\..\Run: [ESFTP] C:\ESFTP\esftp.exe /STARTUP
O4 - HKCU\..\Run: [RollerCoasterTycoon2Setup.exe] C:\DOWNLO~1\ROLLER~1.EXE /r
O4 - HKCU\..\Run: [SysInit] wininit32.exe -drivers
O4 - Startup: SpywareGuard.lnk = C:\Spyware fjerner\spywareguard\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O8 - Extra context menu item: Download alle med Net Transport - C:\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download med Net Transport - C:\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Programmer\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norman NJeeves - Unknown - C:\NORMAN\Nvc\BIN\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Norman\NVC\BIN\Zanda.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
