Søg
Avatar billede warberg22 Nybegynder
07. april 2005 - 19:08 Der er 5 kommentarer og
1 løsning

hijackthis.log

Her kommer en hijack log.
Jeg plages af noget der hedder VX2, som bl.a. indebærer at startsiden sættes til "about: blank" og der kommer popups. AdAware kan ikke fjerne den, den ondsindede proces kloner sig konstant.

Jeg har ikke brugt hijackthis før. Håber I kan hjælpe :-)

Logfile of HijackThis v1.99.1
Scan saved at 19:03:17, on 07-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Programmer\Winamp3\winampa.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
E:\mysql\bin\winmysqladmin.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\system32\addrh.exe
C:\WINDOWS\system32\winfo32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\devldr32.exe
E:\download\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {1C968847-4882-41CB-CE85-55AAE933BC71} - C:\WINDOWS\apiql.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programmer\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [WinampAgent] "e:\Programmer\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [addgc32.exe] C:\WINDOWS\system32\addgc32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [sdkts32.exe] C:\WINDOWS\system32\sdkts32.exe
O4 - HKLM\..\Run: [winfo32.exe] C:\WINDOWS\system32\winfo32.exe
O4 - HKLM\..\RunOnce: [syszi.exe] C:\WINDOWS\system32\syszi.exe
O4 - HKLM\..\RunOnce: [msig.exe] C:\WINDOWS\msig.exe
O4 - HKLM\..\RunOnce: [javavo.exe] C:\WINDOWS\system32\javavo.exe
O4 - HKLM\..\RunOnce: [atlwz.exe] C:\WINDOWS\system32\atlwz.exe
O4 - HKLM\..\RunOnce: [wintl.exe] C:\WINDOWS\system32\wintl.exe
O4 - HKLM\..\RunOnce: [ntmp32.exe] C:\WINDOWS\system32\ntmp32.exe
O4 - HKLM\..\RunOnce: [mfcei32.exe] C:\WINDOWS\system32\mfcei32.exe
O4 - HKLM\..\RunOnce: [msti.exe] C:\WINDOWS\msti.exe
O4 - HKLM\..\RunOnce: [ntxe.exe] C:\WINDOWS\ntxe.exe
O4 - HKLM\..\RunOnce: [d3lx32.exe] C:\WINDOWS\system32\d3lx32.exe
O4 - HKLM\..\RunOnce: [sdkvy32.exe] C:\WINDOWS\sdkvy32.exe
O4 - HKLM\..\RunOnce: [msoh.exe] C:\WINDOWS\system32\msoh.exe
O4 - HKLM\..\RunOnce: [crao32.exe] C:\WINDOWS\system32\crao32.exe
O4 - HKLM\..\RunOnce: [apigw.exe] C:\WINDOWS\system32\apigw.exe
O4 - HKLM\..\RunOnce: [netvj.exe] C:\WINDOWS\netvj.exe
O4 - HKLM\..\RunOnce: [addrh.exe] C:\WINDOWS\system32\addrh.exe
O4 - Startup: WinMySQLadmin.lnk = E:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\Programmer\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\Programmer\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: E:\Programmer\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addla.exe"  /s (file missing)
O23 - Service: Apache - Unknown owner - E:\Programmer\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: MySql - Unknown owner - E:/mysql/bin/mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Avatar billede johnstigers Seniormester
07. april 2005 - 19:48 #1
Kigger på den.
Avatar billede johnstigers Seniormester
07. april 2005 - 20:04 #2
Hent denne (Kaspersky) scanner, den skal du bruge senere.
http://www.spywareinfo.dk/download/mwav.exe - Virusscanner.

Så skal du genstarte pc'en i fejlsikret tilstand. Klik F8 under opstart.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

C:\WINDOWS\system32\addrh.exe
C:\WINDOWS\system32\winfo32.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nrmdt.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {1C968847-4882-41CB-CE85-55AAE933BC71} - C:\WINDOWS\apiql.dll
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sdkts32.exe] C:\WINDOWS\system32\sdkts32.exe
O4 - HKLM\..\Run: [winfo32.exe] C:\WINDOWS\system32\winfo32.exe
O4 - HKLM\..\RunOnce: [syszi.exe] C:\WINDOWS\system32\syszi.exe
O4 - HKLM\..\RunOnce: [msig.exe] C:\WINDOWS\msig.exe
O4 - HKLM\..\RunOnce: [javavo.exe] C:\WINDOWS\system32\javavo.exe
O4 - HKLM\..\RunOnce: [atlwz.exe] C:\WINDOWS\system32\atlwz.exe
O4 - HKLM\..\RunOnce: [wintl.exe] C:\WINDOWS\system32\wintl.exe
O4 - HKLM\..\RunOnce: [ntmp32.exe] C:\WINDOWS\system32\ntmp32.exe
O4 - HKLM\..\RunOnce: [mfcei32.exe] C:\WINDOWS\system32\mfcei32.exe
O4 - HKLM\..\RunOnce: [msti.exe] C:\WINDOWS\msti.exe
O4 - HKLM\..\RunOnce: [ntxe.exe] C:\WINDOWS\ntxe.exe
O4 - HKLM\..\RunOnce: [d3lx32.exe] C:\WINDOWS\system32\d3lx32.exe
O4 - HKLM\..\RunOnce: [sdkvy32.exe] C:\WINDOWS\sdkvy32.exe
O4 - HKLM\..\RunOnce: [msoh.exe] C:\WINDOWS\system32\msoh.exe
O4 - HKLM\..\RunOnce: [crao32.exe] C:\WINDOWS\system32\crao32.exe
O4 - HKLM\..\RunOnce: [apigw.exe] C:\WINDOWS\system32\apigw.exe
O4 - HKLM\..\RunOnce: [netvj.exe] C:\WINDOWS\netvj.exe
O4 - HKLM\..\RunOnce: [addrh.exe] C:\WINDOWS\system32\addrh.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\Programmer\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\Programmer\PartyPoker\PartyPoker.exe (file missing)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addla.exe"  /s (file missing)


---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Alle filer og mapper"
Klik på "Avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
e:\Programmer\PartyPoker

Filer:

C:\WINDOWS\system32\sdkts32.exe
C:\WINDOWS\system32\winfo32.exe
C:\WINDOWS\system32\syszi.exe
C:\WINDOWS\msig.exe
C:\WINDOWS\system32\javavo.exe
C:\WINDOWS\system32\atlwz.exe
C:\WINDOWS\system32\wintl.exe
C:\WINDOWS\system32\ntmp32.exe
C:\WINDOWS\system32\mfcei32.exe
C:\WINDOWS\msti.exe
C:\WINDOWS\ntxe.exe
C:\WINDOWS\system32\d3lx32.exe
C:\WINDOWS\sdkvy32.exe
C:\WINDOWS\system32\msoh.exe
C:\WINDOWS\system32\crao32.exe
C:\WINDOWS\system32\apigw.exe
C:\WINDOWS\netvj.exe
C:\WINDOWS\system32\addrh.exe
C:\WINDOWS\addla.exe

Så kører du engangsskanneren fra Kaspersky - Aktiver det hele i opsætningen derinde, så den kan skanne alt igennem.
Genstart, husk at genaktivere ALLE sikkerhedsprogrammer inden du går på nettet.

Genstart og kom med en ny HiJackThis logfil til kontrol.
Avatar billede warberg22 Nybegynder
07. april 2005 - 22:00 #3
Mange tak, så skulle det værste være ovre. Nu er der i hvert fald ingen dumme startsider og popups. Der er dog stadig en process windows/system32/devldr32.exe som jeg ikke er helt sikker på.

Men her seneste hijack log

Logfile of HijackThis v1.99.1
Scan saved at 22:00:07, on 07-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
E:\Programmer\Winamp3\winampa.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
E:\mysql\bin\winmysqladmin.exe
E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\System32\devldr32.exe
E:\hijack\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.dk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programmer\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [WinampAgent] "e:\Programmer\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - Startup: WinMySQLadmin.lnk = E:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: E:\Programmer\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addla.exe"  /s (file missing)
O23 - Service: Apache - Unknown owner - E:\Programmer\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: MySql - Unknown owner - E:/mysql/bin/mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Avatar billede johnstigers Seniormester
07. april 2005 - 22:09 #4
Læs her om windows/system32/devldr32.exe http://www.liutilities.com/products/wintaskspro/processlibrary/devldr32

Fix lige:
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addla.exe"  /s (file missing)

Og en ny log efter en genastart - så tror jeg at din maskine er ren
Avatar billede warberg22 Nybegynder
08. april 2005 - 16:29 #5
Så skulle alt være fjernet. Et spørgsmål her på faldrebet: kan det betale sig at køre med Norton Antivirus (Auto-Protect) hvis man har ZoneAlarm kørende (havde ikke før jeg blev angrebet) og man løbende tjekker med f.eks. Kapersky...?

Logfile of HijackThis v1.99.1
Scan saved at 22:37:33, on 07-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
E:\Programmer\Winamp3\winampa.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
E:\mysql\bin\winmysqladmin.exe
E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\mdm.exe
C:\Programmer\Outlook Express\msimn.exe
E:\hijack\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.dk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programmer\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [WinampAgent] "e:\Programmer\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - Startup: WinMySQLadmin.lnk = E:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: E:\Programmer\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O23 - Service: Apache - Unknown owner - E:\Programmer\Apache Group\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - E:\PROGRA~2\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: MySql - Unknown owner - E:/mysql/bin/mysqld-nt.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Programmer\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\PROGRA~2\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Avatar billede johnstigers Seniormester
08. april 2005 - 20:15 #6
Ja - det kan slet ikke betale sig at lade være.

Loggen er ren :)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Andet sikkerhed kategorien

Titel Indlæg Oprettet Seneste aktivitet
hvilken afløser kan I anbefale? Af jcr18 i Andet sikkerhed 5 17/03/202610:32 18/03/202615:36
Advarsler om datalæk for nogle apps Af nu_igen i Andet sikkerhed 6 02/02/202614:54 03/02/202613:45
Mail fra Yousee ? Svindel? Af nu_igen i Andet sikkerhed 4 13/01/202617:27 14/01/202609:36
Er det sandsynligt, at jeg har været udsat for phishing Af Slettet bruger i Andet sikkerhed 4 13/11/202515:09 14/11/202510:45
Google fake Af johp i Andet sikkerhed 3 27/10/202516:31 28/10/202506:52
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
31/0310:22 Makro der gemmer vedhæftet fil fra Msg og omdøber filen Af lokesa i Excel
30/0313:45 Kablet forbindelse mellem android telefon og windows 11 pc Af 1Dorte i Android
30/0312:04 Elementtype vises - og ikke billedet? Af hkprofil i Billedbehandling
29/0312:08 Problemer med replay af købte kursusvideoer Af annam i Browsere
28/0311:18 DENVER DVB-tMPEG-4 HD TUNER Af ole falsted i Fjernsyn & projektorer
White papers
Flere white papers »