Avatar billede sstp Nybegynder
09. april 2005 - 19:16 Der er 5 kommentarer og
1 løsning

Hijackthis log og Regcleaner log Meget snavs

Heey..

Her er to logs, kunne godt tænke mig at få set dem i gennem :-)

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 19:13:50, on 09-04-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton Internet Security\NISUM.EXE
C:\Programmer\Norton Utilities\NPROTECT.EXE
C:\Programmer\Speed Disk\nopdb.exe
C:\Programmer\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Programmer\Norton Internet Security\IAMAPP.EXE
C:\Programmer\Common files\SearchUpgrader\SearchUpgrader.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\temp\salm.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Norton Utilities\SYSDOC32.EXE
C:\Programmer\WinZip\WZQKPICK.EXE
C:\Programmer\Norton Internet Security\NISSERV.EXE
C:\Documents and Settings\Administrator\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.dk/0SEDADK/SAOS01
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Programmer\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [SearchUpgrader] C:\Programmer\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [oxmt] C:\WINDOWS\oxmt.exe
O4 - HKLM\..\Run: [Rhtbo] C:\Program Files\Sjgwd\Zwmvpli.exe
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmer\INSTAFINK\InstaFinderK_inst.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Norton System Doctor.lnk = C:\Programmer\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.master69.biz
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.yeak.net
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Programmer\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Programmer\Norton Internet Security\NISUM.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programmer\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FÆLLES~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Programmer\Speed Disk\nopdb.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Regcleaner:

RegCleaner 4.3 by Jouni Vuorio
Software registered to the Registry. You should delete every program's entries you know you've had, but don't have anymore
[syntax:  Author, Software, Age ]

[Unknown], bpjffb, New
[Unknown], Rhtbo, New
[Unknown], WildTangent, New
[Unknown], WinSock2, New
[Unknown], AppConf, New
[Unknown], Avenue Media, New
[Unknown], salm, New
[Unknown], WinZip Computing, New
Adobe, Adobe SVG Viewer, New
Adobe, CommonFiles, New
Adobe, Reader, New
Adobe, Acrobat Reader, New
Adobe, Acrobat, New
Avenue Media, Internet Optimizer, New
Borland, Database Engine, New
C07ft5Y, WinXP, New
Cddb, Control, New
Convar Deutschland GmbH, PC Inspector File Recovery, New
Creative Tech, Creative MediaSource, New
Creative Tech, Creative MediaSource AudioSync Plugin, New
Creative Tech, Creative MediaSource Detector, New
Creative Tech, Creative MediaSource NOMAD II/MG Plugin, New
Creative Tech, Creative MediaSource NOMAD Jukebox 2/3/Zen Plugin, New
Creative Tech, Creative MediaSource NOMAD Jukebox Plugin, New
Creative Tech, Creative MediaSource NOMAD MuVo Plugin, New
Creative Tech, Creative MediaSource Player Skin Pack, New
Creative Tech, Engine Installer, New
Creative Tech, Installation, New
Creative Tech, License, New
Creative Tech, MediaSourceGo, New
Creative Tech, NOMAD MuVo TX, New
Creative Tech, Product Registration, New
Creative Tech, Redist, New
Creative Tech, Software Installed, New
Creative Tech, Component Installed, New
Creative Tech, Detector, New
Creative Tech, Media Database 2, New
Creative Tech, MediaSource, New
Creative Tech, Theme, New
DivXNetworks, Artwork, New
DivXNetworks, AutoUpdate, New
DivXNetworks, DivX Player, New
DivXNetworks, DivX Player 2.0, New
DivXNetworks, DivX, New
DivXNetworks, DivX4Windows, New
E-SafeKey, Personal, New
Gator.com, AppInfo, New
Gator.com, Cmeii, New
Gator.com, GInternet, New
Gator.com, Trickler, New
Gator.com, Trickles, New
Gator.com, DashBar, New
Gemplus, Cryptography, New
Google, NavClient, New
Image-Line, FL Studio 5, New
Image-Line, Shared, New
Intel, Indeo, New
InterTrust, DocBox, New
Jasc, Ereg, New
Jasc, Paint Shop Pro 7, New
Kazaa, Bandwidth, New
Kazaa, CloudLoad, New
Kazaa, ConnectionInfo, New
Kazaa, Advanced, New
Kazaa, LocalContent, New
Kazaa, Settings, New
Kazaa, Transfer, New
Macromedia, FlashPlayer, New
Macromedia, Shockwave 10, New
MyWay, MyBar, New
Netscape, Netscape Navigator, New
Nico Mak Computing, WinZip, New
PepiMK Software, SpybotSnD, New
Schlumberger, Smart Cards And Terminals, New
SearchUpgrader, {7ee60cf1-2dff-41b5-91c9-9c1c518053fc}, New
Symantec, Ids, New
Symantec, InstalledApps, New
Symantec, Norton CleanSweep, New
Symantec, Norton CleanSweep Deluxe, New
Symantec, Norton Speed Disk, New
Symantec, PatchInst, New
Symantec, ScriptBlocking, New
Symantec, Shared Technology, New
Symantec, SharedDefs, New
Symantec, SharedUsage, New
Symantec, Speed Disk, New
Symantec, Symevent, New
Symantec, SymInterface, New
Symantec, SymNetDrv, New
Symantec, SymSC, New
Symantec, Common, New
Symantec, Fast & Safe, New
Symantec, Iam, New
Symantec, Norton AntiVirus, New
Symantec, Norton Utilities, New
Symantec, Norton WinDoctor, New
Symantec, NortonUndo, New
Symantec, Shared Technology, New
Avatar billede kalp Novice
09. april 2005 - 19:33 #1
ser på det:)
Avatar billede kalp Novice
09. april 2005 - 19:40 #2
Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.

Afinstaller disse mapper i tilføj og fjern programmer hvis de er der (under kontrolpanelet) og ellers slet mapperne manuelt. evt begge dele hvis muligt:)

C:\Programmer\Common files\SearchUpgrader\
C:\Program Files\Internet Optimizer
C:\Program Files\Sjgwd\
C:\Programmer\INSTAFINK\

Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelttjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O4 - HKLM\..\Run: [SearchUpgrader] C:\Programmer\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [oxmt] C:\WINDOWS\oxmt.exe
O4 - HKLM\..\Run: [Rhtbo] C:\Program Files\Sjgwd\Zwmvpli.exe
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmer\INSTAFINK\InstaFinderK_inst.exe

Har du ikke selv lavet disse skal de fikses
O15 - Trusted Zone: www.master69.biz
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.yeak.net

Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Find og slet (Kig godt efter!!.. Det du ikke finder har hijackthis nok fjernet!)

Filerne

C:\temp\salm.exe
C:\WINDOWS\oxmt.exe

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Fix disse i log 2

[Unknown], bpjffb, New
[Unknown], Rhtbo, New
[Unknown], WildTangent, New
[Unknown], WinSock2, New
[Unknown], AppConf, New
[Unknown], Avenue Media, New
[Unknown], salm, New
Avenue Media, Internet Optimizer, New
Gator.com, AppInfo, New
Gator.com, Cmeii, New
Gator.com, GInternet, New
Gator.com, Trickler, New
Gator.com, Trickles, New
Gator.com, DashBar, New
Kazaa, Bandwidth, New
Kazaa, CloudLoad, New
Kazaa, ConnectionInfo, New
Kazaa, Advanced, New
Kazaa, LocalContent, New
Kazaa, Settings, New
Kazaa, Transfer, New
MyWay, MyBar, New
SearchUpgrader, {7ee60cf1-2dff-41b5-91c9-9c1c518053fc}, New

og det andet burde du kunne fixe hvis det er regcleaner du har anvendt.
men du kan starte med dem der.

Genstart normalt og kopir en ny log herind så jeg kan se om vi fik ramt på det hele eller om noget er blevet overset:)
Avatar billede sstp Nybegynder
10. april 2005 - 02:05 #3
okai, smutter over til min kammi her en af dagene og fixer det for ham.. Tror ik lige helt selv han kan finde ud af det hehe.. :-)

Men jeg siger på forhånd tak.. ;)

Vender tilbage en af dagene..
Avatar billede kalp Novice
22. april 2005 - 10:15 #4
har du været forbi ham?
Avatar billede sstp Nybegynder
08. maj 2005 - 01:33 #5
sorry, ja det har jeg, men han siger han ikke selv kan finde ud af det, så må fixe det for ham en dag, og inden det, acceptere jeg lige dit svar..
Avatar billede majsmarken Nybegynder
08. maj 2005 - 22:31 #6
<sstp>: Du skal også lige have denne 'sang':
Ka' de dog ikke snart lære det - samme plade:

Du har ikke opdateret dit Windows XP til ServicePack2 (SP2).
[1Klik.dk: Ubeskyttede pc’er holder i 20 minutter]:
http://1klik.dk/news_1klik/nyhed_32992.html

Det er ikke så godt, for så er du ikke sikret mod mange af de vira, der suser rundt på nettet og kigger efter uopdaterede maskiner.

Du kan hente SP2 her som 'løs' fil (~280Mb):
http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/
Download/copy til et passende medie.
Afbryd fra det 'farlige' internet (stikket fysisk UD).
Instaler SP2 pakken.
Når det er så gået godt og efter en genstart eller to - først DA tilslut internettet igen og gå i start ->programmer ->Windowsupdate og lade din maskine scanne for nyeste opdateringer. Installer dem du får anbefalet.

Good Luck... men først når putter er erklæret 'ren' ...

(Tja - hvis du ikke får dette gennemført ses vi nok snart igen...i virus kategorien?)

----
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester