Søg
Avatar billede woogoo Nybegynder
11. februar 2005 - 16:08 Der er 10 kommentarer og
2 løsninger

Hjælp til Hijackthis.

Hey experter.

Jeg har lige en computer her som kører rigtig dårligt.. så vi prøvede hijackthis. er der nogen der vil kigge denne log igennem for mig? Syntes selv det ser meget slemt ud.. og jeg har ingen forstand på at analysere de her logs..:

Logfile of HijackThis v1.99.0
Scan saved at 16:04:46, on 11-02-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\soft.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Messenger Plus! 3\MsgPlus.exe
C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
C:\WINDOWS\System32\keyhook.exe
C:\Programmer\desksite\bin\cma.exe
C:\Programmer\D-Tools\daemon.exe
C:\WINDOWS\System32\winis.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Programmer\ISTsvc\istsvc.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\dddd.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Documents and Settings\Charlotte jensen\Application Data\hnot.exe
C:\WINDOWS\system32\m?config.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\windows\system32\hgsvjnlk.exe
C:\windows\system32\calc.exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\Charlotte jensen\Dokumenter\Modtagne filer\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=1002699
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://letgohome.com/hp.htm?id=11281
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=1002699
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.challesrotteri.tk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - C:\Programmer\SurfSideKick 2\SskBho.dll
F3 - REG:win.ini: run=C:\WINDOWS\System32\soft.exe
O2 - BHO: (no name) - {006DC1E8-2721-2ED9-28D4-5587EAF4BCEA} - C:\WINDOWS\System32\qvio.dll
O2 - BHO: (no name) - {3E8F60E3-5D75-3272-18EE-D7B853EB5288} - C:\WINDOWS\System32\zlnhtdgv.dll
O2 - BHO: (no name) - {6696C9C7-3560-AB98-1223-FB853F8E74B4} - C:\WINDOWS\System32\zxpvhdem.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: (no name) - {C097EFB6-0730-0474-0CC8-9EF5A31BAAF5} - C:\WINDOWS\System32\xatggofi.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [Desksite CMA] C:\Programmer\desksite\bin\cma.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [win32] winhost.exe
O4 - HKLM\..\Run: [update] winis.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [KAZAA] "C:\Programmer\Kazaa Lite K++\kpp.exe" "C:\Programmer\Kazaa Lite K++\KazaaLite.kpp" /SYSTRAY
O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\System32\wmplayer.exe
O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\ieloader.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [hgsvjnlk] c:\windows\system32\hgsvjnlk.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Programmer\SurfSideKick 2\Ssk.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [rs5S36V] athcon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [antiware] C:\windows\system32\elitegsg32.exe
O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [SvcH0st] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [IST Service] C:\Programmer\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [fZMifQ3dM] C:\WINDOWS\urmyfudo.exe
O4 - HKLM\..\Run: [sais] c:\programmer\180solutions\sais.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [atifkv] C:\WINDOWS\atifkv.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\se.dll,DllInstall
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\dddd.exe
O4 - HKLM\..\RunServices: [win32] winhost.exe
O4 - HKLM\..\RunServices: [update] winis.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmer\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\System32\wmplayer.exe
O4 - HKCU\..\Run: [Eaed] C:\Documents and Settings\Charlotte jensen\Application Data\hnot.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Programmer\SurfSideKick 2\Ssk.exe
O4 - HKCU\..\Run: [aBu2RWZ7i] xcoui2.exe
O4 - HKCU\..\Run: [Wajkme] C:\WINDOWS\System32\m?config.exe
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\dddd.exe
O4 - Startup: Webshots.lnk = C:\Programmer\Webshots\Launcher.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Programmer\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adware Filter.lnk = C:\Programmer\AdwareFilter\AdwareFilter.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm41464US
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programmer\SideFind\sidefind.dll
O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programmer\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dk.msnusers.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=4583
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {EDAF796E-9210-4417-ADDC-2AB18E4F6C27} (Hjemmeside.KvikFoto) - http://www.123hjemmeside.dk/builder/pages/KvikFoto.CAB
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - AppInit_DLLs: cysskdcisb78trll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll
O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: qcvdowfjxlcq - Unknown - C:\WINDOWS\System32\ehtthbej5.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe
Avatar billede levich Nybegynder
11. februar 2005 - 16:12 #1
Jeg ser på den...
Avatar billede woogoo Nybegynder
11. februar 2005 - 16:24 #2
tak.. :)
Avatar billede levich Nybegynder
11. februar 2005 - 16:59 #3
(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Hent http://www.spywarefri.dk/vaerktoj.htm#spybot (Spybot).
Start programmet, opdater og scan. Slet linjerne med rød tekst.
Genstart computeren.

(3)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe, og kør den.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files
Og så trykker du på Scan Clean
Scanningen kan godt tage et par timer.

(4)
Fix følgende linjer med HijackThis:
C:\WINDOWS\System32\soft.exe
C:\WINDOWS\System32\winis.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Programmer\ISTsvc\istsvc.exe
C:\WINDOWS\System32\dddd.exe
C:\Documents and Settings\Charlotte jensen\Application Data\hnot.exe
C:\WINDOWS\system32\m?config.exe
C:\windows\system32\hgsvjnlk.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=1002699
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://letgohome.com/hp.htm?id=11281
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=1002699
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.challesrotteri.tk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - C:\Programmer\SurfSideKick 2\SskBho.dll
F3 - REG:win.ini: run=C:\WINDOWS\System32\soft.exe
O2 - BHO: (no name) - {006DC1E8-2721-2ED9-28D4-5587EAF4BCEA} - C:\WINDOWS\System32\qvio.dll
O2 - BHO: (no name) - {3E8F60E3-5D75-3272-18EE-D7B853EB5288} - C:\WINDOWS\System32\zlnhtdgv.dll
O2 - BHO: (no name) - {6696C9C7-3560-AB98-1223-FB853F8E74B4} - C:\WINDOWS\System32\zxpvhdem.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: (no name) - {C097EFB6-0730-0474-0CC8-9EF5A31BAAF5} - C:\WINDOWS\System32\xatggofi.dll
O4 - HKLM\..\Run: [win32] winhost.exe
O4 - HKLM\..\Run: [update] winis.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [KAZAA] "C:\Programmer\Kazaa Lite K++\kpp.exe" "C:\Programmer\Kazaa Lite K++\KazaaLite.kpp" /SYSTRAY
O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\System32\wmplayer.exe
O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\ieloader.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [hgsvjnlk] c:\windows\system32\hgsvjnlk.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Programmer\SurfSideKick 2\Ssk.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [rs5S36V] athcon.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [antiware] C:\windows\system32\elitegsg32.exe
O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe
O4 - HKLM\..\Run: [SvcH0st] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [IST Service] C:\Programmer\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [fZMifQ3dM] C:\WINDOWS\urmyfudo.exe
O4 - HKLM\..\Run: [sais] c:\programmer\180solutions\sais.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmer\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [atifkv] C:\WINDOWS\atifkv.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\se.dll,DllInstall
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\dddd.exe
O4 - HKLM\..\RunServices: [win32] winhost.exe
O4 - HKLM\..\RunServices: [update] winis.exe
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\System32\wmplayer.exe
O4 - HKCU\..\Run: [Eaed] C:\Documents and Settings\Charlotte jensen\Application Data\hnot.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Programmer\SurfSideKick 2\Ssk.exe
O4 - HKCU\..\Run: [aBu2RWZ7i] xcoui2.exe
O4 - HKCU\..\Run: [Wajkme] C:\WINDOWS\System32\m?config.exe
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\dddd.exe
O4 - Startup: Webshots.lnk = C:\Programmer\Webshots\Launcher.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Programmer\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm41464US
O8 - Extra context menu item: Web Rebates - file://C:\Programmer\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programmer\SideFind\sidefind.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {9E98E84C-79E1-49C3-82EB-798FCD552EFB} (VacPro.internazionale_ver4) - http://advnt01.com/dialer/internazionale_ver4.CAB
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=4583
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - AppInit_DLLs: cysskdcisb78trll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll
O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: qcvdowfjxlcq - Unknown - C:\WINDOWS\System32\ehtthbej5.exe

(5)
Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
søg efter og slet nedenstående filer ved at genstarte i fejlsikret tilstand (tryk F8 når Windows starter op):
alle de filer som er nævnt i loggen

(6)
Start -> programmer -> tilbehør -> systemværktøjer -> diskoprydning -> Slet Temporary internet files, papirkurv og midlertidige filer.

Det var en lang smøre. Jeg er lidt i tvivl om nogle få linjer i loggen.

Har du installeret et programmer ved navn:
AdwareFilter?
(MSN Photo Upload Tool?

Når vi er helt færdige, så husk at Aktiver systemgendannelse igen.
Avatar billede majsmarken Nybegynder
11. februar 2005 - 17:10 #4
<woogoo> Hvad har du gjort siden at kunne få SÅ meget 'snavs' på din putter ?

Et gæt kunne være:
* Kazaa Lite K++
* Messenger Plus! 3

Men det ER du jo blevet advaret mod ved http://www.eksperten.dk/spm/576380 - nå ja den mangler du vist at afslutte; der er flere der venter på dig:
http://www.eksperten.dk/list.phtml?sort=&order=DESC&status_2=on&spm_creator=woogoo&spm_part=&spm_answer=&find=&engine=exp
Avatar billede woogoo Nybegynder
11. februar 2005 - 19:37 #5
hmm.. det er ikke min computer.. det er en venindes.. og ved godt at Messenger Plus er en dårlig idé.. og bruger ikke selv kazaa.. såå.. :P men.. har afsluttet de andre.. tak fordi du gjorde mig opmærksom på det.. :)
Avatar billede majsmarken Nybegynder
11. februar 2005 - 21:10 #6
Fint - ingen "gule flag" tilbage i skrivende stund...

Kazaa og rester derfra kan ædes med:
http://danborg.org/spy/Kazaabegone/Kazaabegone.zip
Avatar billede majsmarken Nybegynder
11. februar 2005 - 21:11 #7
... men rul endelig videre med det som <levich> har beskrevet så godt...
Avatar billede tonnybrandt Nybegynder
11. februar 2005 - 21:40 #8
Følg blot levich's anvisning men hent disse 2 programmer først idet der er risiko for at miste internetforbindelsen med de infektioner !!!!

Hent de her to programmer:
http://cexx.org/lspfix.zip
http://danborg.org/spy/Newnet/winsockxpfix.exe

Kør først LSPfix, sæt flueben i I know what I am doing, klik på finish, genstart så burde det virke.
Gør det ikke det, så prøv Winsockfix, klik først på Reg-backup, og gem en kopi af din regdatabase, når det er slut klik på Fix, når den er færdig genstart og så skulle du gerne kunne komme på nettet igen.
Avatar billede tonnybrandt Nybegynder
11. februar 2005 - 21:41 #9
Ovenstående skal kun køres, hvis du mister internetforbindelsen efter udrensningen.
Avatar billede woogoo Nybegynder
19. februar 2005 - 14:16 #10
levich smider du ikke lige et svar? så får du point?
Avatar billede levich Nybegynder
19. februar 2005 - 14:46 #11
svar
Avatar billede levich Nybegynder
09. marts 2005 - 10:49 #12
svar
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Windows kategorien

Titel Indlæg Oprettet Seneste aktivitet
oprette et installationsmedie Af Malm i Windows 4 16/09/202618:13 23/09/202617:38
Popup ved opstart Af mort1 i Windows 1 06/09/202611:21 06/09/202611:31
Slet lokal konto Af ErikHg i Windows 9 04/09/202618:50 07/09/202615:51
Dette er ikke en kommerciel session i Windows 11 Af eksmojo i Windows 3 04/09/202613:47 05/09/202622:31
installere windows på separat diskpartition Af Malm i Windows 2 20/08/202614:16 21/08/202622:01
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I går 21:29 Vedr. Windows 11 version 26H2 Af ErikHg i Fri debat
I går 18:16 Tømme gammel PC for indhold, kan ikke tændes Af Mai i Andet software
01/1017:41 NVIDIA Geforce GTX 1060 6 GB som "snakker" Af dcedata1977 i Andet hardware
27/0916:43 Nomad Tracking Car Af fleknes i Apps til Android
25/0916:15 Internet forsvinder hele tiden Af TTA i Internetforbindelser
White papers
Flere white papers »