Hijack this. Hjælp med at rydde ud!
Sidder ved en kammerats maskine og den er temmelig tæt på at være for "syg" til at kunne bruges efterhånden....Jeg har lige ørt ad-aware.
Hijackthis log-filen ser nu således ud:
Logfile of HijackThis v1.99.1
Scan saved at 16:03:48, on 09-08-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\outlook\outlook.exe
C:\dfndrff_8.exe
C:\kybrdff_8.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\nwnmff_8.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Fælles filer\{E0A9E2D8-08A3-1030-1017-05051110002d}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\License_Manager\license_manager.exe
C:\PROGRA~1\FLLESF~1\ffqf\ffqfm.exe
C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\svchost.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\cm9ubnk\command.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
c:\ucmoreiex.exe
C:\Programmer\ISTsvc\istsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\ronny\Skrivebord\hijackthis.exe
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Class - {5A8D59AE-DB7D-7CAC-F410-7B1956861598} - C:\WINDOWS\ylfrh1.dll (file missing)
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Programmer\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [outlook] C:\Programmer\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_8.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_8.exe
O4 - HKLM\..\Run: [sid70e18] RUNDLL32.EXE w0b34000.dll,n 00270e160000000a0b34000
O4 - HKLM\..\Run: [newname] C:\\nwnmff_8.exe
O4 - HKLM\..\Run: [MfO1e] C:\WINDOWS\nrvthj.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IST Service] C:\Programmer\ISTsvc\istsvc.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [License Manager] "C:\Programmer\License_Manager\license_manager.exe " /silent
O4 - HKCU\..\Run: [Discipl2GalleanSetup.exe] /r
O4 - HKCU\..\Run: [ffqf] C:\PROGRA~1\FLLESF~1\ffqf\ffqfm.exe
O4 - HKCU\..\Run: [DeadlyDozenSetup.exe] C:\DOCUME~1\ronny\LOKALE~1\Temp\TEMPOR~1\Content.IE5\YD8ZQHQ5\DEADLY~1.EXE /r
O4 - Startup: ubisoft register.lnk = C:\Programmer\Ubi Soft\Register\schedule.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: svchost.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\spil\Free\pac-manic\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\spil\Free\pac-manic\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\spil\Free\pac-manic\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\spil\Free\pac-manic\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154633114828
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SharedDlls - C:\WINDOWS\system32\jt0607dse.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\cm9ubnk\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Programmer\Network Monitor\netmon.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
