Tjek af hijackthis log

Fjern bearshare, genstart og ny log.

Logfile of HijackThis v1.99.1
Scan saved at 20:14:31, on 07-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAMMER\AVPERSONAL\AVGUARD.EXE
C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe
C:\Windows\Reminder.exe
C:\Programmer\OSD\OSD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\D-Tools\daemon.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\WhatPulse\WhatPulse.exe
C:\Programmer\108Mbps Wireless LAN Adapter\WLANPRO.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmer\108Mbps Wireless LAN Adapter\Reg.exe
D:\Documents and Settings\René\Dokumenter\hijackthis\hijackthis.exe
C:\Programmer\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eksperten.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Reminder] C:\Windows\Reminder.exe
O4 - HKLM\..\Run: [OSD] C:\Programmer\OSD\OSD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmer\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "C:\Programmer\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LemmingsRevolutionSetup.exe] C:\DOCUME~1\REN~1\SKRIVE~1\LEMMIN~1.EXE /r
O4 - HKCU\..\Run: [WhatPulse] C:\Programmer\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [WhenUSave] "C:\Programmer\Save\Save.exe"
O4 - Global Startup: 108Mbps Wireless LAN Adapter Configuration Utility.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Programmer\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Reg.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131011676109
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMMER\AVPERSONAL\AVGUARD.EXE
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programmer\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS

sådan...

kigger

Jeg kan intet finde i din log - men jeg sender lige bud efter en anden logtyder som muligvis har et bud...

Efter nærmere eftertanke...
Den er faktisk ren (blandede lige din log sammen med en anden)

Jeg takker for hjælpen...

Nej, den er ikke ren..

Disse skal fixes i hijackthis:

O4 - HKLM\..\Run: [BearShare] "C:\Programmer\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [WhenUSave] "C:\Programmer\Save\Save.exe"

find og slet:
C:\Programmer\BearShare<- hele mappen
C:\Programmer\Save<-hele mappen

Jeg har gjort som du har sagt arlet...

Jeg takker for din hjælp...

Velbekommen*S*

Så 'mistænkeligt' ud - er det meningen at dette program skal loades - altid:
O4 - HKCU\..\Run: [WhatPulse] C:\Programmer\WhatPulse\WhatPulse.exe
Ref.: http://www.bleepingcomputer.com/startups/WhatPulse.exe-11843.html

Samme med
O4 - HKCU\..\Run: [LemmingsRevolutionSetup.exe] C:\DOCUME~1\REN~1\SKRIVE~1\LEMMIN~1.EXE /r

Ikke fordi det er 'snavs' men...

Det skal være der...Det er et program det tæller hvor mange gange jeg klikker på musen og tasteturet...

arlet> http://exp.dk/spm/670479

John ->Jeg kiggede bare med..

Behold du bare dine point.