Kan ikke tilgå microsoft.com og antivirus hjemmesider
Jeg har et problem med vores netværk.Jeg får "siden kan ikke vises", når jeg forsøger at besøge enten microsoft eller antivirus-hjemmesider.
Det er jo nok noget spyware der har sneget sig ind.
Scanning med F-secure viser ikke nogen problemer.
Herunder indsat en log fra HiJack-this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:52 PM, on 9/7/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\Documents and Settings\Administrator\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\dns.exe
C:\WINDOWS\system32\PMService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\System32\ismserv.exe
C:\Program Files\Fujitsu Siemens\RAID\bin\mr2kserv.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\WINDOWS\system32\ntfrs.exe
C:\Program Files\Fujitsu Siemens\ServerView Agents\GlobalFlash\gf_agent.exe
C:\Program Files\Fujitsu Siemens\Remote Connector\SVRemoteConnector.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Fujitsu Siemens\RAID\bin\SpySer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe
C:\WINDOWS\system32\lserver.exe
C:\WINDOWS\system32\tftpd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fujitsu Siemens\RAID\amService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Fujitsu Siemens\ServerView Agents\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\Symantec\Ghost\bin\rteng9.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_13\bin\jusched.exe
C:\Program Files\Broadcom\BACS\BacsTray.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Symantec\Ghost\ngtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Linksys\Network Storage\Network Drive Mapping Utility.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bjergmarkskolen.dk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bjergmarkskolen.dk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bjergmarkskolen.dk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.microsoft.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Bjergmarkskolen
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.11.1:8080;https=192.168.11.1:8080;ftp=192.168.11.1:8080;gopher=192.168.11.1:8080;socks=192.168.11.1:1080
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_13\bin\jusched.exe"
O4 - HKLM\..\Run: [bacstray] C:\Program Files\Broadcom\BACS\BacsTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NGTray] "C:\Program Files\Symantec\Ghost\ngtray.exe"
O4 - HKLM\..\Run: [Network Drive Mapping Utility] "C:\Program Files\Linksys\Network Storage\Network Drive Mapping Utility.exe" Z
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [EPA_EZ_GPO_Tool] C:\WINDOWS\system32\EZ_GPO_Tool.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Network Drive Mapping Utility] "C:\Program Files\Linksys\Network Storage\Network Drive Mapping Utility.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O10 - Broken Internet access because of LSP provider 'c:\documents and settings\administrator\windows\system32\mswsock.dll' missing
O15 - ESC Trusted Zone: *.bjergmarkskolen.dk
O15 - ESC Trusted Zone: http://dw.com.com
O15 - ESC Trusted Zone: http://www.emu.dk
O15 - ESC Trusted Zone: *.emu.dk
O15 - ESC Trusted Zone: http://runonce.msn.com
O15 - ESC Trusted Zone: http://download.norman.no
O15 - ESC Trusted Zone: http://www.rarlab.com
O15 - ESC Trusted Zone: *.skoleintra.dk
O15 - ESC Trusted Zone: http://www.trendsecure.com
O15 - ESC Trusted Zone: *.uni-c.dk
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://runonce.msn.com (HKLM)
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200311061125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bjergmarkskolen.uv
O17 - HKLM\Software\..\Telephony: DomainName = bjergmarkskolen.uv
O17 - HKLM\System\CCS\Services\Tcpip\..\{52DAC1B1-D7C8-4D42-8737-B09F996C43CC}: NameServer = 192.168.11.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bjergmarkskolen.uv
O23 - Service: ServerView Raid (amService) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens\RAID\amService.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Energy Star(TM) EZ GPO Power Management Configuration Tool (EPA_GPO_PMService) - TerraNovum - C:\WINDOWS\system32\PMService.exe
O23 - Service: F-Secure BackWeb LAN Access - F-Secure Corporation - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mr2kserv - LSI Logic Corporation - C:\Program Files\Fujitsu Siemens\RAID\bin\mr2kserv.exe
O23 - Service: Symantec Ghost Database Service Wrapper (NGDBSERV) - Symantec Corporation - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Symantec Ghost Configuration Server (NGSERVER) - Symantec Corporation - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: OfflineFlash - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens\ServerView Agents\GlobalFlash\gf_agent.exe
O23 - Service: ServerView Remote Connector (RemoteConnector) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens\Remote Connector\SVRemoteConnector.exe
O23 - Service: SpySer - Unknown owner - C:\Program Files\Fujitsu Siemens\RAID\bin\SpySer.exe
O23 - Service: Server Control Service (SrvCtrl) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens\ServerView Agents\OnlineDiagnostic\TestManager\TestHandler.exe
--
End of file - 10032 bytes
