Notifikationer

Markér alle som læst Log ud

perhol Seniormester

24. marts 2005 - 17:41 Der er 14 kommentarer og
1 løsning

HijackThis log

Min comp er blevet noget langsom, desuden går den ned med BSOD en gang i mellem.
Er beskyttet med Antivir og Zonealarm. Scanner desuden Ad-Aware og Spybot med jævne mellemrum samt har SpywareBlaster kørende.
Jeg har selv gennemgået en HijackThis log og renset efter bedste evne, der var ikke noget særligt.
Den nye log følger i kommentaren nedenfor. Er der en der vil gennemgå den for mig?

Synes godt om

perhol Seniormester

24. marts 2005 - 17:41 #1

Logfile of HijackThis v1.97.7
Scan saved at 17:34:52, on 24-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Hotkeycontrol XP\hkcontrol.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Setup\ShirusuPad\ShirusuPad.exe
C:\Programmer\Volumouse\volumouse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Restore Desktop\RestoreDesktop.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\STARDO~1\stardown.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\Programmer\mozilla.org\Mozilla\Mozilla.exe
C:\Programmer\Rainlendar\Rainlendar.exe
C:\Programmer\foobar2000\foobar2000.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
C:\Programmer\iPod\bin\iPodService.exe
C:\Setup\Antivirus\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Hotkeycontrol] C:\Programmer\Hotkeycontrol XP\hkcontrol.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programmer\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [$Volumouse$] "C:\Programmer\Volumouse\volumouse.exe" /nodlg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RestoreDesktop] C:\Programmer\Restore Desktop\RestoreDesktop.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Star Downloader Free] C:\PROGRA~1\STARDO~1\stardown.exe
O4 - HKCU\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programmer\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - Startup: Thumbs.db
O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
O4 - Startup: foobar2000.lnk = C:\Programmer\foobar2000\foobar2000.exe
O8 - Extra context menu item: Download with Star Downloader - C:\Setup\StarDownloader\sdie.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Overfør med Star Downloader - C:\PROGRA~1\STARDO~1\sdie.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Run WinHTTrack (HKLM)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack (HKLM)
O9 - Extra button: Opslag (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/danmark/templateGallery/msotd.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093789612348
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38240.1798032407
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/dj/qdiagh.cab?223
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4236/mcfscan.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://80.198.90.242/webgis/acgm/acgm.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab

Synes godt om

perhol Seniormester

24. marts 2005 - 17:43 #2

PS:
Tror 'bare' at computerens langsommelighed skyldes at jeg ofte downloader og prøver gratisprogrammer.
Imødeser en evt. nyinstallation.

Synes godt om

kalp Novice

24. marts 2005 - 17:46 #3

ser på den

Synes godt om

kalp Novice

24. marts 2005 - 17:47 #4

hmm lidt gammel version af hijackthis hent lige den nye og kom med en ny log som jeg istedet kan læse igennem:)

http://downloadportal.dk/showdownload.asp?rid=3967&sp=Hijackthis%201.91
eller
http://arlet.dk/index.html?/hjt.htm

Synes godt om

perhol Seniormester

24. marts 2005 - 17:51 #5

Her er den nye log:

Logfile of HijackThis v1.99.1
Scan saved at 17:50:05, on 24-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Hotkeycontrol XP\hkcontrol.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Setup\ShirusuPad\ShirusuPad.exe
C:\Programmer\Volumouse\volumouse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Restore Desktop\RestoreDesktop.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\STARDO~1\stardown.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\Programmer\mozilla.org\Mozilla\Mozilla.exe
C:\Programmer\Rainlendar\Rainlendar.exe
C:\Programmer\foobar2000\foobar2000.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
C:\Programmer\iPod\bin\iPodService.exe
C:\Setup\Antivirus\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.google.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName

= Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no

file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} -

C:\PROGRA~1\STARDO~1\SDIEInt.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Hotkeycontrol] C:\Programmer\Hotkeycontrol

XP\hkcontrol.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [zBrowser Launcher]

C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon

initialize
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone

Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Picasa Media Detector]

C:\Programmer\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0

-k
O4 - HKCU\..\Run: [$Volumouse$]

"C:\Programmer\Volumouse\volumouse.exe" /nodlg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RestoreDesktop] C:\Programmer\Restore

Desktop\RestoreDesktop.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Star Downloader Free] C:\PROGRA~1\STARDO~1

\stardown.exe
O4 - HKCU\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe"

/nosplash /minimized
O4 - HKCU\..\Run: [Mozilla Quick Launch]

"C:\Programmer\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - Startup: Thumbs.db
O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
O4 - Startup: foobar2000.lnk = C:\Programmer\foobar2000\foobar2000.exe
O8 - Extra context menu item: Download with Star Downloader -

C:\Setup\StarDownloader\sdie.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel -

res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Overfør med Star Downloader -

C:\PROGRA~1\STARDO~1\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-

AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01

\bin\npjpi150_01.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-

AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-

092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

- (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}

- C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-

BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) -

http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software

AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility)

- http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -

http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX

Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download

Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF}

(PatchInstaller.Installer) -

file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)

-

http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/cli

ent/wuweb_site.cab?1093789612348
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control)

-

http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.

com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD

Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime

Environment 1.4.0_03) -
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} -
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj

Class) - http://h30043.www3.hp.com/dj/qdiagh.cab?223
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-

us/tools/mcfscan/1,4,0,4236/mcfscan.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) -

http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control)

- http://80.198.90.242/webgis/acgm/acgm.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software

AutoUpdate Support Package) -

http://www.creative.com/su/ocx/15010/CTPID.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik

GmbH - C:\Programmer\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH,

Germany - C:\Programmer\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. -

C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA

Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -

C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE

Synes godt om

kalp Novice

24. marts 2005 - 17:51 #6

takker

Synes godt om

kalp Novice

24. marts 2005 - 18:02 #7

Genstart i Fejlsikret tilstand ved at taste F8 under opstart. Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelt tjeck alt kom med!. Klik herefter "Fixchecked" i hijackthis:

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet DownloadControl Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF}(PatchInstaller.Installer) -file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control)- http://80.198.90.242/webgis/acgm/acgm.cab

find og slet disse filer

D:\Content\include\msSecUcd.cab
D:\content\include\XPPatchInstaller.CAB

genstart normalt og ny log...

ja tog lidt tid at copy paste linjerne hehe

Synes godt om

perhol Seniormester

24. marts 2005 - 18:33 #8

Af nysgerrighed: hvad er det egentlig du har fundet?
Har lidt tidligere i dag installeret 2 opdateringer fra Microsoft, deriblandt en slags 'virusscanner' der efter sigende hentes, installeres, kører usynligt og afinstallerer sig selv.

Her har du den nye log:

Logfile of HijackThis v1.99.1
Scan saved at 18:28:54, on 24-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Hotkeycontrol XP\hkcontrol.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Setup\ShirusuPad\ShirusuPad.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Volumouse\volumouse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Restore Desktop\RestoreDesktop.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE
C:\PROGRA~1\STARDO~1\stardown.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\mozilla.org\Mozilla\Mozilla.exe
C:\Programmer\Rainlendar\Rainlendar.exe
C:\Programmer\foobar2000\foobar2000.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Setup\Antivirus\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.google.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.dk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName

= Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no

file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} -

C:\PROGRA~1\STARDO~1\SDIEInt.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Hotkeycontrol] C:\Programmer\Hotkeycontrol

XP\hkcontrol.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [zBrowser Launcher]

C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon

initialize
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone

Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Picasa Media Detector]

C:\Programmer\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmer\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKCU\..\Run: [$Volumouse$]

"C:\Programmer\Volumouse\volumouse.exe" /nodlg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RestoreDesktop] C:\Programmer\Restore

Desktop\RestoreDesktop.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Star Downloader Free] C:\PROGRA~1\STARDO~1

\stardown.exe
O4 - HKCU\..\Run: [ShirusuPad] C:\Setup\ShirusuPad\ShirusuPad.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe"

/nosplash /minimized
O4 - HKCU\..\Run: [Mozilla Quick Launch]

"C:\Programmer\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - Startup: Thumbs.db
O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
O4 - Startup: foobar2000.lnk = C:\Programmer\foobar2000\foobar2000.exe
O8 - Extra context menu item: Download with Star Downloader -

C:\Setup\StarDownloader\sdie.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel -

res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Overfør med Star Downloader -

C:\PROGRA~1\STARDO~1\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-

AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01

\bin\npjpi150_01.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-

AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-

092E-AFF36D6C7040} - C:\Programmer\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

- (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}

- C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-

BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) -

http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software

AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility)

- http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -

http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX

Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)

-

http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/cli

ent/wuweb_site.cab?1093789612348
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control)

-

http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.

com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} -
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime

Environment 1.4.0_03) -
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} -
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj

Class) - http://h30043.www3.hp.com/dj/qdiagh.cab?223
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-

us/tools/mcfscan/1,4,0,4236/mcfscan.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) -

http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} -
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software

AutoUpdate Support Package) -

http://www.creative.com/su/ocx/15010/CTPID.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik

GmbH - C:\Programmer\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH,

Germany - C:\Programmer\AVPersonal\AVWUPSRV.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. -

C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA

Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -

C:\WINDOWS\SYSTEM32\ZONELABS\VSMON.EXE

Synes godt om

perhol Seniormester

24. marts 2005 - 18:35 #9

Disse kunne jeg ikke finde:

D:\Content\include\msSecUcd.cab
D:\content\include\XPPatchInstaller.CAB

Drev D: er i øvrigt mit CD-drev

Synes godt om

kalp Novice

24. marts 2005 - 18:37 #10

fix lige disse 2 i fejlsikret så er der ikke mere

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

det er unødvendige add-ons i IE

Synes godt om

perhol Seniormester

24. marts 2005 - 18:45 #11

Ja, men så skulle 'jeg' vel være renset.
Tildeler point.
Tak.

Synes godt om

kalp Novice

24. marts 2005 - 18:49 #12

selv tak:) og ja det da meget flot klaret når man tænker på alle de småting du downloader:P

Synes godt om

perhol Seniormester

24. marts 2005 - 18:52 #13

Ja, ikke ;-)
Og jeg starter da også en del ting i opstarten. Meget godt klaret med en 466 MHZ comp af ældre model.
Burde der egentlig ikke findes en slags 'register' over alle de ting man roligt kan fjerne?

Synes godt om

kalp Novice

24. marts 2005 - 18:55 #14

tryk start->kør og skriv "msconfig" vælge fanen start og fjern flueben i hvad du ikke vil have starter op automatisk med windows

Synes godt om

perhol Seniormester

24. marts 2005 - 19:04 #15

Har MSCONFIG liggende som genvej i min QuickStart men bruger ellers en lille kontrol-panel aplet der hedder Startup Control Panel.
Mente bare at der jo er flere der virkelig gør meget ud af at hjælpe os andre med at rense ud.
Måske var det en ide at lægge de ting man roligt selv kan rense i en slags register så man bedre kan hjælpe sig selv.

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Windows kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
oprette et installationsmedie Af Malm i Windows	4	16/09/202618:13	23/09/202617:38
Popup ved opstart Af mort1 i Windows	1	06/09/202611:21	06/09/202611:31
Slet lokal konto Af ErikHg i Windows	9	04/09/202618:50	07/09/202615:51
Dette er ikke en kommerciel session i Windows 11 Af eksmojo i Windows	3	04/09/202613:47	05/09/202622:31
installere windows på separat diskpartition Af Malm i Windows	2	20/08/202614:16	21/08/202622:01

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS