Virus

[eiriksen]

Inntil videre kan du lese denne artikkelen om svchost.exe fra MS, så skal jeg sjekke litt ut.

 

Edit: Sjekk ut denne forumtråden, tror nok du finner det interesant å lese der

Endret 27. januar 2004 av eiriksen

[donald D]

Jeg ble ikke så veldig mer klokere men takk skal du ha.

[Gunnar B]

Gå på start-run-skriv: msconfig-startup,og fortell hva som starter opp der.

[donald D]

Klarer ikke å få opp startmenyen vet du. Finnes det en hanne måte å starte kjør på.

[eiriksen]

Jeg ble ikke så veldig mer klokere men takk skal du ha.

Last ned HijackThis og kjør programmet. Når du er ferdig copy og paster du loggen inn hit.

[Gunnar B]

C:\WINDOWS\PCHealth\HelpCtr\Binaries-msconfig.exe

[donald D]

Det som starter opp er

 

-carpserv

 

-avgcc32

 

-hgqcmon

 

-hgqs2wnd

 

-NeroCheck

 

-InCD

 

-atiptaxx

 

-Asus Prob

 

-gttash

 

-LaunehList

 

-Zlcient

 

-Forbruksmåler

 

-SahAgent

 

-tca

 

-tcm

 

-ctfmon

 

-msnmsgr

 

-FreeRamXP Pro

 

-Microsoft Office

 

-raid toal e.x.e

 

-Ultimate Zip

[Gunnar B]

Disse er ikke nødvendige i oppstarten.

SahAgent-Muligens Spyware

atiptaxx -Unødvendig

NeroCheck-unødvendig

Microsoft Office-unødvendig

 

De under her hadde ikke jeg nølt med å ta vekk.

InCD

hgqcmon ?

hgqs2wnd ?

gttash ?

LaunehList?

tca?

tcm?

raid toal e.x.e?

 

Zlcient- har du zonealarm?

Ultimate Zip USB tilkobling?

Har du oppdatert å kjørt Spyboot og adaware?

 

Har kun AVG i min startup i msconfig.

Endret 27. januar 2004 av ghbing

[pellemann]

Sahagent er agenten til seti@home

[Gunnar B]

Sahagent er agenten til seti@home

Ok, fant litt forskjellige svar ute på nett.

 

http://sarc.com/avcenter/venc/data/adware.sahagent.html

http://www.richswebdesign.com/news9.shtml#6d

[donald D]

Hei, Eiriksen jeg gikk inn på det forume som du hadde gidd meg en link til jeg gjorde det som sto der men scaner greie fant ingen ting jeg legger nå inn min logg fra HijackThis .

 

 

Logfile of HijackThis v1.97.7

Scan saved at 13:42:52, on 28.01.2004

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\PROGRA~1\Grisoft\AVG6\avgserv.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\carpserv.exe

C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

D:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe

C:\Program Files\Telenor Plus\Forbruksmåler\Forbruksmåler.exe

C:\WINDOWS\System32\SahAgent.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\The Cleaner\tcm.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\Program Files\UltimateZip 2.7\uzqkst.exe

C:\WINDOWS\explorer.exe

C:\PROGRA~1\ULTIMA~1.7\uzip.exe

C:\DOCUME~1\ANDRE`~1\LOCALS~1\TEMP\HIJACKTHIS.EXE

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.no/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP

O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [LaunchList] D:\Program Files\Pinnacle Studio\LaunchList.exe

O4 - HKLM\..\Run: [Zone Labs Client] D:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe

O4 - HKLM\..\Run: [start_forbruksmåler] C:\Program Files\Telenor Plus\Forbruksmåler\Forbruksmåler.exe C:\Program Files\Telenor Plus\Forbruksmåler

O4 - HKLM\..\Run: [sAHAgent] C:\WINDOWS\System32\SahAgent.exe

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRAM XP Pro\FreeRAM XP Pro 1.22.exe" -win

O4 - Startup: UltimateZip Quick Start.lnk = C:\Program Files\UltimateZip 2.7\uzqkst.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe

O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm

O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm

O9 - Extra button: RealGuide (HKLM)

O10 - Broken Internet access because of LSP provider 'lsp.dll' missing

O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

 

Åper dere finner noe ut av dette.

[donald D]

Pc er fiksa no

[Kjetil Lura]

Pc er fiksa no

Bra, men kunne du skrive inn hva som var problemet. Var det seti@home som jobbet, eller hva.

Nyttig om du kan skrive det, på grunn av at da kan andre lese denne tråden, for de kan ha samme problem med sin pc.