Hijack This Log til gennemsyn
HejHar bøvlet med en pc, der var kommet privacy center på.. måtte have harddisken til en anden pc og have det lort slettet, for at kunne boote den op... herefter har jeg opdateret AVG og scannet med ad-aware. maskinen er ikke tilsluttet internettet endnu.
Den kører sådan set fint nok nu.. men det skulle ikke undre mig at den gemmer på mere..
Her er loggen:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:27, on 04-05-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmer\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programmer\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmer\OpenOffice.org1.1.2\program\soffice.exe
C:\WINDOWS\system32\wuauclt.exe
E:\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {74ab9896-c30a-3b38-7634-d47c9fd6cc12} - {21cc6df9-c74d-4367-83b3-a03c6989ba47} - C:\WINDOWS\system32\__c007B2D2.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Programmer\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {D032570A-5F63-4812-A094-87D007C23012} - C:\PROGRA~1\PRIVAC~1\tools\sp\spp.dll (file missing)
O2 - BHO: QXK Rhythm - {D327717B-B49E-4197-A4E5-46B478A6C0CD} - C:\WINDOWS\fvowketqofb.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FD85A070-D92D-4D42-B54F-DA3E10A89359} - C:\WINDOWS\system32\ssqpq.dll (file missing)
O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Programmer\Video ActiveX Access\iesbpl.dll (file missing)
O3 - Toolbar: Internet Service - {94A5C93F-BD18-4C46-B777-C94C145C3CAB} - C:\Programmer\Applications\iebr.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [lphc5rdj0ea99] C:\WINDOWS\system32\lphc5rdj0ea99.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Programmer\SAV\sav.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Programmer\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\w-w-w-dot-com\update.exe" /background
O4 - HKCU\..\Run: [WebSUpdater] "C:\Program Files\w-w-w-dot-com\wupda.exe" /background
O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\Ejer\LOKALE~1\Temp\video1162.cfg.exe
O4 - HKCU\..\Run: [MonMsgWin] C:\WINDOWS\system32\odefofil.exe
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Programmer\SAV\sav.exe
O4 - HKCU\..\Run: [agent.exe] C:\Programmer\Privacy center\agent.exe
O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Programmer\Applications\wcs.exe
O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Programmer\Applications\iebtm.exe
O4 - HKLM\..\Policies\Explorer\Run: [6uqk1bMjFl] C:\Documents and Settings\All Users\Application Data\fuzwjofs\farybmto.exe
O4 - Startup: OpenOffice.org 1.1.2.lnk = C:\Programmer\OpenOffice.org1.1.2\program\quickstart.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{19C98E53-904F-4DC9-8D1B-B3166676E950}: NameServer = 85.255.116.124,85.255.112.131
O17 - HKLM\System\CCS\Services\Tcpip\..\{45AE230A-B67B-4397-BB4B-958E2157DA4C}: NameServer = 85.255.116.124,85.255.112.131
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{19C98E53-904F-4DC9-8D1B-B3166676E950}: NameServer = 85.255.116.124,85.255.112.131
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\..\{19C98E53-904F-4DC9-8D1B-B3166676E950}: NameServer = 85.255.116.124,85.255.112.131
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: qomnnop - qomnnop.dll (file missing)
O21 - SSODL: mpfanvqg - {07E9EAA0-477E-48FF-BBAA-1479AFA2691E} - C:\WINDOWS\mpfanvqg.dll (file missing)
O21 - SSODL: vbksrofa - {9869D5A0-CC22-4F29-A9A1-88092BEE227C} - C:\WINDOWS\vbksrofa.dll (file missing)
O22 - SharedTaskScheduler: athermancies - {ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22} - C:\WINDOWS\system32\tiqmcx.dll (file missing)
O22 - SharedTaskScheduler: babblement - {d3b82107-f8fa-4ef3-8066-136e22872d4e} - C:\WINDOWS\system32\sjrggq.dll (file missing)
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
--
End of file - 6905 bytes
