hijackthis log

Jeg kigger lige på den ..

Hmm... loggen er faktisk 100% ren. Du kan evt lægge en log fra den allernyeste version af HiJackThis, som du kan hente her:
http://www.spywarefri.dk/vaerktoj.htm

Det er version 1.99.1 og den viser lidt mere end den du har lagt, men jeg tvivler på at den vil afsløre snavs.

Har du problemer med pc'en ?

Logfile of HijackThis v1.99.1
Scan saved at 01:41:25, on 19-02-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Programmer\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Programmer\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\G-VGA.exe
C:\Programmer\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Programmer\ATI Technologies\ATI HydraVision\HydraMD.exe
C:\programmer\powerstrip\pstrip.exe
C:\Programmer\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\games\steam\steam.exe
C:\Programmer\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\3Com_DMI\3CDMINIC.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\mIRC\mirc.exe
C:\Programmer\Creative\MediaSource\CTCMS.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kenneth\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmer\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Programmer\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Programmer\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Programmer\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VGAUtil] C:\WINDOWS\system32\G-VGA.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmer\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [HydraVisionViewport] C:\Programmer\ATI Technologies\ATI HydraVision\HydraMD.exe
O4 - HKLM\..\Run: [PowerStrip] c:\programmer\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmer\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Programmer\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\steam\steam.exe" -silent
O4 - Global Startup: RAID Tool.lnk = C:\Programmer\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{08259F31-9738-4D87-BC94-B8E3DA598441}: NameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{08259F31-9738-4D87-BC94-B8E3DA598441}: NameServer = 10.0.0.1
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\system32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe

Den fandt 2 viruser, men kan ikke finde dem nu... Brugte panda antivirus...
Det gør at jeg fps' dropper...

Den nye log viste ikke mere end den forrige.

Du kan fixe disse 2 i HiJackThis:

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

Den første fordi den er unødvendig og den sidste fordi den ikke skal bruges på en XP, kun på windows 98/me.

Hvis du vil være 100% sikker på at der ikke er virus på maskinne så gør dette:

Hent denne Kaspersky scanner, den skal du bruge senere.
http://www.spywareinfo.dk/download/mwav.exe - Virusscanner.

Genstart i fejlsikret tilstand.

Kør virusscanneren. (obs tryk ikke på knappen, kør ved hver start af systemet)

Genstart normalt og fortæl hvad den fandt

Kan spørgsmålet lukkes ?

Du lukker det ved at markere mit navn nede til venstre og trykke accepter.