Er der en der vil se denne Hijackthis igennem.

Logfile of HijackThis v1.99.1
Scan saved at 11:05:25, on 27-03-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\New Boundary\PrismXL\ChannelDeploy.sys
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\oracle\ora92\bin\omtsreco.exe
C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS
C:\Programmer\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Programmer\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Programmer\Sophos\Remote Management System\AutoUpdateAgentNT.exe
C:\Programmer\Sophos\AutoUpdate\ALsvc.exe
C:\Programmer\Sophos\Remote Management System\RouterNT.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmer\Prism Deploy\Client\PTClient.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\BGINFO~1\Bginfo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Sophos\AutoUpdate\ALMon.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\mom\Lokale indstillinger\Temporary Internet Files\Content.IE5\V6SBJ1WH\hijackthis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.dk/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sdu.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sdu.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by IT-service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Prism Deploy Client] "C:\Programmer\Prism Deploy\Client\PTClient.exe" /Subscriber
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [BGinfo] C:\PROGRA~1\BGINFO~1\Bginfo.exe C:\PROGRA~1\BGINFO~1\SDU-BG~1.BGI /taskbar
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programmer\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programmer\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Programmer\PTPNDFLS\PTPNDFLS.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sdu.dk/
O15 - Trusted Zone: http://*.csc.dk
O15 - Trusted Zone: http://*.e-boks.dk
O15 - Trusted Zone: http://guard.group4login.com
O15 - Trusted Zone: http://*.oes.dk
O15 - Trusted Zone: http://info.adm.sdu.dk
O15 - Trusted Zone: http://intern.sdu.dk
O15 - Trusted Zone: http://nova.adm.sdu.dk
O15 - Trusted Zone: http://*.sdu.dk
O15 - Trusted Zone: http://*.csc.dk (HKLM)
O15 - Trusted Zone: http://*.e-boks.dk (HKLM)
O15 - Trusted Zone: http://guard.group4login.com (HKLM)
O15 - Trusted Zone: http://*.oes.dk (HKLM)
O15 - Trusted Zone: http://info.adm.sdu.dk (HKLM)
O15 - Trusted Zone: http://nova.adm.sdu.dk (HKLM)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138529092078
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O17 - HKLM\Software\..\Telephony: DomainName = adm.c.sdu.dk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Channel Deployer - New Boundary Technologies, Inc. - C:\Programmer\Fælles filer\New Boundary\PrismXL\ChannelDeploy.sys
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\Programmer\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\Programmer\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos plc - C:\Programmer\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos plc - C:\Programmer\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Unknown owner - C:\Programmer\Sophos\Remote Management System\ManagementAgentNT.exe" -service -name Agent (file missing)
O23 - Service: Sophos AutoUpdate Agent - Unknown owner - C:\Programmer\Sophos\Remote Management System\AutoUpdateAgentNT.exe" -service -name ALC (file missing)
O23 - Service: Sophos AutoUpdate Service - Sophos plc - C:\Programmer\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Unknown owner - C:\Programmer\Sophos\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 (file missing)

Loggen er ren.

Var det blot et check eller har du problemer med den ?

Ewino fandt 2 som jeg har fjernet, så er der mere ?


Logfile of HijackThis v1.99.1
Scan saved at 11:55:13, on 27-03-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\New Boundary\PrismXL\ChannelDeploy.sys
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Programmer\ewido anti-malware\ewidoctrl.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\oracle\ora92\bin\omtsreco.exe
C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS
C:\Programmer\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Programmer\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Programmer\Sophos\Remote Management System\AutoUpdateAgentNT.exe
C:\Programmer\Sophos\AutoUpdate\ALsvc.exe
C:\Programmer\Sophos\Remote Management System\RouterNT.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmer\Prism Deploy\Client\PTClient.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\BGINFO~1\Bginfo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Sophos\AutoUpdate\ALMon.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\mom\Skrivebord\Ole´s\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.dk/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sdu.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sdu.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by IT-service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Prism Deploy Client] "C:\Programmer\Prism Deploy\Client\PTClient.exe" /Subscriber
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [BGinfo] C:\PROGRA~1\BGINFO~1\Bginfo.exe C:\PROGRA~1\BGINFO~1\SDU-BG~1.BGI /taskbar
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programmer\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programmer\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Programmer\PTPNDFLS\PTPNDFLS.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sdu.dk/
O15 - Trusted Zone: http://*.csc.dk
O15 - Trusted Zone: http://*.e-boks.dk
O15 - Trusted Zone: http://guard.group4login.com
O15 - Trusted Zone: http://*.oes.dk
O15 - Trusted Zone: http://info.adm.sdu.dk
O15 - Trusted Zone: http://intern.sdu.dk
O15 - Trusted Zone: http://nova.adm.sdu.dk
O15 - Trusted Zone: http://*.sdu.dk
O15 - Trusted Zone: http://*.csc.dk (HKLM)
O15 - Trusted Zone: http://*.e-boks.dk (HKLM)
O15 - Trusted Zone: http://guard.group4login.com (HKLM)
O15 - Trusted Zone: http://*.oes.dk (HKLM)
O15 - Trusted Zone: http://info.adm.sdu.dk (HKLM)
O15 - Trusted Zone: http://nova.adm.sdu.dk (HKLM)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138529092078
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O17 - HKLM\Software\..\Telephony: DomainName = adm.c.sdu.dk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = adm.c.sdu.dk
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Channel Deployer - New Boundary Technologies, Inc. - C:\Programmer\Fælles filer\New Boundary\PrismXL\ChannelDeploy.sys
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido anti-malware\ewidoctrl.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\Programmer\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\Programmer\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Programmer\Fælles filer\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos plc - C:\Programmer\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos plc - C:\Programmer\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Unknown owner - C:\Programmer\Sophos\Remote Management System\ManagementAgentNT.exe" -service -name Agent (file missing)
O23 - Service: Sophos AutoUpdate Agent - Unknown owner - C:\Programmer\Sophos\Remote Management System\AutoUpdateAgentNT.exe" -service -name ALC (file missing)
O23 - Service: Sophos AutoUpdate Service - Sophos plc - C:\Programmer\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Unknown owner - C:\Programmer\Sophos\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 (file missing)

Tak for din tid. du vil ike have point ?

Og nej den kører fint, men Ewino bliver ved at finde noget, som er heldigvis er nemt at fjerne.

Hvad er det for noget Ewido finder ?

Der er nogle helt nye varianter af SpyFalcon som ikke kan ses i nogen logs. Hvis du kan finde loggen fra Ewido, kan vi måske spore os ind på hvad det er for noget.

Den har jeg selfølgelig da lige netop ikke gemt.

Men når det sker næste gang, så smider jeg den på.

Fino, jeg smider lige et svar, mens jeg husker det ..

Jeg har sammelignet de to Hijackthis.

der er kun to ( 2 )  023 - sevice der er væk.

Det betyder vel ingen ting.

Takker for point.

Jeg har efterfølgende sammenlignet de 2 logs og kan altså ikke se at der skulle være forsvundet nogle tjenester.

Jeg er ren amatør i denne gesjeft, så jeg printede dem ud og lagde dem ned på bordret. og der var 2 023 mere på den ene.
Men det kan sagtens være mig !! da jeg som sagt ikke ved en sk.. om Hijackthis.

Det var jo næsten det samme jeg gjorde, blot printede jeg dem ikke ud.

Men prøv at tælle efter. Der er 13 stk 023 linier i begge logs, så der mangler altså ikke nogen *s*

10 - 4 tak