Trenger hjelp med hijack this log Ny logg

Håvard · 28. september 2005

Hallo.

Sitter å hjelper naboen med pcn, og kjørte hijack this..

Hva skal jeg fixe?

Logfile of HijackThis v1.99.1
Scan saved at 16:22:30, on 28.09.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Programfiler\BearShare\BearShare.exe
C:\Programfiler\Save\Save.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\RUNDLL32.EXE
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\WINNT\System32\alg.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\System32\wuauclt.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\WINNT\System32\msiexec.exe
C:\Programfiler\WinRAR\WinRAR.exe
C:\DOCUME~1\MSNLAR~1\LOKALE~1\Temp\Rar$EX00.885\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENONO/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINNT\System32\bzjrd.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programfiler\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programfiler\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programfiler\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.4000.1001\no\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.4000.1001\no\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINNT\System32\bzjrd.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "C:\Programfiler\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [MSConfig] C:\WINNT\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Programfiler\SpywareGuard\sgmain.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{009CD6DF-4D92-40D3-BAE2-DB9873A61EB8}: NameServer = 85.255.113.146,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C3FE0C0-BB55-4EB1-9DE2-61A1F8F6DFD4}: NameServer = 85.255.113.146,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EC3415A-1AD1-4E23-8B0A-0B81B2067256}: NameServer = 85.255.113.146,85.255.112.23
O17 - HKLM\System\CS1\Services\Tcpip\..\{009CD6DF-4D92-40D3-BAE2-DB9873A61EB8}: NameServer = 85.255.113.146,85.255.112.23
O17 - HKLM\System\CS2\Services\Tcpip\..\{009CD6DF-4D92-40D3-BAE2-DB9873A61EB8}: NameServer = 85.255.113.146,85.255.112.23
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programfiler\Sygate\SPF\smc.exe

Endret 28. september 2005 av Hrisebro

zjulik · 28. september 2005

O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINNT\System32\bzjrd.dll

O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINNT\System32\bzjrd.dll

- mystiske søkeverktøy.

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

- unødvendig prosess

O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe

- unødvendig prosess

O4 - HKLM\..\Run: [bearShare] "C:\Programfiler\BearShare\BearShare.exe" /pause

- denne er ansvarlig for den prosessen du har gående som heter save.exe og som er spyware. Your choice.

O4 - HKLM\..\Run: [MSConfig] C:\WINNT\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

- hva i alle dager er dette?

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

- denne MÅ vekk

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

- unødvendig prosess

Endret 28. september 2005 av zjulik

Alastor · 28. september 2005

Du kan jo også evt bare la ms antispyware søke og prøve å fikse det automatisk der. MS antispyware har også en veldig fin immuniser-funksjon, som hindrer pcen å bli reinfisert.

www.microsoft.com

Håvard · 28. september 2005

siden hijack this virka bra til å finne skummle ting på pcn scanna jeg pcn min å..

her er loggen

Logfile of HijackThis v1.99.1
Scan saved at 22:24:57, on 28.09.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\WINDOWS\SOUNDMAN.EXE
F:\Programfiler\D-Link\AirPlus XtremeG\AirPlusCFG.exe
F:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe
F:\WINDOWS\system32\rundll32.exe
F:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe
F:\Programfiler\D-Tools\daemon.exe
F:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe
F:\Programfiler\F-Secure Internet Security\Common\FSM32.EXE
F:\Programfiler\iTunes\iTunesHelper.exe
F:\Programfiler\QuickTime\qttask.exe
F:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe
F:\Programfiler\Fellesfiler\Ulead Systems\DVD\USISrv.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programfiler\MSN Messenger\MsnMsgr.Exe
F:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Desktop Sidebar\dsidebar.exe
C:\Programfiler\Skype\Phone\Skype.exe
C:\Programfiler\HDD Health\hddhealth.exe
C:\Programfiler\Free Download Manager\fdm.exe
F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
F:\Programfiler\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
F:\Programfiler\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
F:\Programfiler\F-Secure Internet Security\Common\FSMA32.EXE
F:\Programfiler\F-Secure Internet Security\Anti-Virus\fssm32.exe
F:\WINDOWS\System32\nvsvc32.exe
F:\Programfiler\F-Secure Internet Security\Common\FSMB32.EXE
F:\WINDOWS\System32\svchost.exe
F:\Programfiler\SpywareGuard\sgmain.exe
F:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe
F:\Programfiler\Bonjour\mDNSResponder.exe
F:\Programfiler\F-Secure Internet Security\Common\FCH32.EXE
F:\Programfiler\iPod\bin\iPodService.exe
F:\Programfiler\F-Secure Internet Security\Common\FAMEH32.EXE
F:\Programfiler\F-Secure Internet Security\FSPC\fspc.exe
C:\Programfiler\Xfire\Xfire.exe
F:\Programfiler\F-Secure Internet Security\FWES\Program\fsdfwd.exe
F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsav32.exe
F:\Programfiler\SpywareGuard\sgbhp.exe
F:\Programfiler\F-Secure Internet Security\FSGUI\fsguiexe.exe
F:\Programfiler\MediaMonkey\MediaMonkey.exe
C:\Programfiler\BitComet\BitComet.exe
F:\PROGRA~1\ULTIMA~1\uzip.exe
F:\DOCUME~1\HVARD~1\LOKALE~1\TEMP\UZ_9551\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.wilderssecurity.net/sglist.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Programfiler\Desktop Sidebar\sbhelp.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - F:\Programfiler\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVIDIA nTune] "F:\Programfiler\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] F:\Programfiler\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] F:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Programfiler\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [RemoteControl] F:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [F-Secure Manager] "F:\Programfiler\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "F:\Programfiler\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "F:\Programfiler\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [iTunesHelper] "F:\Programfiler\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] F:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Programfiler\Ulead Systems\Ulead DVD MovieFactory 4.0 Disc Creator TBYB\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] F:\Programfiler\Fellesfiler\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "F:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Programfiler\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MSMSGS] "F:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SIDEBAR] "C:\Programfiler\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programfiler\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [HDDHealth] C:\Programfiler\HDD Health\hddhealth.exe -wl
O4 - HKCU\..\Run: [Free Download Manager] C:\Programfiler\Free Download Manager\fdm.exe -autorun
O4 - Startup: SpywareGuard.lnk = F:\Programfiler\SpywareGuard\sgmain.exe
O4 - Startup: Xfire.lnk = C:\Programfiler\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programfiler\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://C:\Programfiler\Desktop Sidebar\sbhelp.dll/menuhandler.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programfiler\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programfiler\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programfiler\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programfiler\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Webfilter - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Vis webområde&liste - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Stopp websidefilter midlertidig - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Forby dette webområdet - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Tillat dette webområdet - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programfiler\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: f:\programfiler\bonjour\mdnsnsp.dll
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: F-Secure product (BackWeb Plug-in - 4476822) - Unknown owner - F:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Computer, Inc. - F:\Programfiler\Bonjour\mDNSResponder.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - F:\Programfiler\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Programfiler\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe

Hva bør fjærnes?

toretors · 29. september 2005

Kjør MS antispyware først, også avslutter du alle programmene før du skriver ut neste logg.

b21a · 29. september 2005

Eller les denne og fjern det som du ikke vil ha

Håvard · 29. september 2005

Ny logg

Logfile of HijackThis v1.99.1
Scan saved at 17:25:03, on 29.09.2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

F:\WINDOWS\System32\smss.exe

F:\WINDOWS\system32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\system32\spoolsv.exe

F:\WINDOWS\Explorer.EXE

F:\WINDOWS\system32\RUNDLL32.EXE

F:\WINDOWS\SOUNDMAN.EXE

F:\WINDOWS\system32\rundll32.exe

F:\Programfiler\D-Link\AirPlus XtremeG\AirPlusCFG.exe

F:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

F:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

F:\Programfiler\D-Tools\daemon.exe

F:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

F:\Programfiler\F-Secure Internet Security\Common\FSM32.EXE

F:\Programfiler\iTunes\iTunesHelper.exe

F:\Programfiler\QuickTime\qttask.exe

F:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe

F:\Programfiler\Fellesfiler\Ulead Systems\DVD\USISrv.exe

C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe

F:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Microsoft AntiSpyware\gcasDtServ.exe

F:\Programfiler\Messenger\msmsgs.exe

F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsgk32st.exe

F:\Programfiler\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe

F:\Programfiler\F-Secure Internet Security\Anti-Virus\FSGK32.EXE

F:\Programfiler\F-Secure Internet Security\Anti-Virus\fssm32.exe

F:\Programfiler\F-Secure Internet Security\Common\FSMA32.EXE

F:\Programfiler\F-Secure Internet Security\Common\FSMB32.EXE

F:\WINDOWS\System32\nvsvc32.exe

F:\WINDOWS\System32\svchost.exe

F:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe

F:\Programfiler\F-Secure Internet Security\Common\FCH32.EXE

F:\Programfiler\Bonjour\mDNSResponder.exe

C:\Programfiler\Skype\Phone\Skype.exe

F:\Programfiler\F-Secure Internet Security\Common\FAMEH32.EXE

F:\Programfiler\F-Secure Internet Security\FSPC\fspc.exe

F:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\HDD Health\hddhealth.exe

C:\Programfiler\Free Download Manager\fdm.exe

F:\Programfiler\F-Secure Internet Security\FWES\Program\fsdfwd.exe

F:\Programfiler\SpywareGuard\sgmain.exe

F:\Programfiler\SpywareGuard\sgbhp.exe

F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsav32.exe

C:\Programfiler\Xfire\Xfire.exe

F:\Programfiler\F-Secure Internet Security\FSGUI\fsguiexe.exe

F:\Programfiler\MSN Messenger\msnmsgr.exe

C:\Programfiler\ABC\abc.exe

F:\Programfiler\MediaMonkey\MediaMonkey.exe

C:\Programfiler\Trillian\trillian.exe

F:\Programfiler\Mozilla Firefox\firefox.exe

D:\Install shit\Programmer\Sikkerhets prog\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.wilderssecurity.net/sglist.html

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Programfiler\Desktop Sidebar\sbhelp.dll

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - F:\Programfiler\SpywareGuard\dlprotect.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NVIDIA nTune] "F:\Programfiler\NVIDIA Corporation\nTune\\nTune.exe" clear

O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] F:\Programfiler\D-Link\AirPlus XtremeG\AirPlusCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] F:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] F:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Programfiler\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [RemoteControl] F:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [F-Secure Manager] "F:\Programfiler\F-Secure Internet Security\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "F:\Programfiler\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [F-Secure Startup Wizard] "F:\Programfiler\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot

O4 - HKLM\..\Run: [iTunesHelper] "F:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "F:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ulead AutoDetector v2] F:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [ulead Quick-Drop] "C:\Programfiler\Ulead Systems\Ulead DVD MovieFactory 4.0 Disc Creator TBYB\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL

O4 - HKLM\..\Run: [uSIUDF_Eject_Monitor] F:\Programfiler\Fellesfiler\Ulead Systems\DVD\USISrv.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "F:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] C:\Programfiler\Valve\Steam\Steam.exe -silent

O4 - HKCU\..\Run: [MSMSGS] "F:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [sIDEBAR] "C:\Programfiler\Desktop Sidebar\dsidebar.exe"

O4 - HKCU\..\Run: [skype] "C:\Programfiler\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [HDDHealth] C:\Programfiler\HDD Health\hddhealth.exe -wl

O4 - HKCU\..\Run: [Free Download Manager] C:\Programfiler\Free Download Manager\fdm.exe -autorun

O4 - Startup: SpywareGuard.lnk = F:\Programfiler\SpywareGuard\sgmain.exe

O4 - Startup: Xfire.lnk = C:\Programfiler\Xfire\Xfire.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programfiler\Free Download Manager\dllink.htm

O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programfiler\Free Download Manager\dlpage.htm

O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://C:\Programfiler\Desktop Sidebar\sbhelp.dll/menuhandler.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programfiler\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programfiler\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programfiler\Desktop Sidebar\sbhelp.dll

O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Programfiler\Desktop Sidebar\sbhelp.dll

O9 - Extra button: Webfilter - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Vis webområde&liste - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: &Stopp websidefilter midlertidig - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: &Forby dette webområdet - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: &Tillat dette webområdet - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - F:\Programfiler\F-Secure Internet Security\FSPC\fspcmsie.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programfiler\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: f:\programfiler\bonjour\mdnsnsp.dll

O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: F-Secure product (BackWeb Plug-in - 4476822) - Unknown owner - F:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Computer, Inc. - F:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - F:\Programfiler\F-Secure Internet Security\Anti-Virus\fsgk32st.exe

O23 - Service: fsbwsys - F-Secure Corp. - F:\Programfiler\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\FSPC\fshttps\fshttps.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - F:\Programfiler\F-Secure Internet Security\Common\FSMA32.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - F:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe

Håvard · 30. september 2005

*bump* selvom den er langt oppe

Er det noen som kan hjelpe meg med den loggen?

Alastor · 30. september 2005

Scanna du med ms antispyware?

Håvard · 30. september 2005

Scanna du med ms antispyware?

jepp

zjulik · 30. september 2005

Kan du ikke begynne med å lime inn loggen i en online-analysator:

http://www.hijackthis.de/index.php?langselect=english

Så har du noe å holde på med utover kvelden :thumbup:

Håvard · 30. september 2005

Kan du ikke begynne med å lime inn loggen i en online-analysator:
http://www.hijackthis.de/index.php?langselect=english

Så har du noe å holde på med utover kvelden

Yes

Logg inn

Trenger hjelp med hijack this log Ny logg

Anbefalte innlegg

Håvard

Lenke til kommentar

Videoannonse

zjulik

Lenke til kommentar

Alastor

Lenke til kommentar

Håvard

Lenke til kommentar

toretors

Lenke til kommentar

b21a

Lenke til kommentar

Håvard

Lenke til kommentar

Håvard

Lenke til kommentar

Alastor

Lenke til kommentar

Håvard

Lenke til kommentar

zjulik

Lenke til kommentar

Håvard

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Populær nå

AP går inn for fri abort til uke 18 1 2 3 4 56

Woke i moderne underholdningsindustri 1 2 3 4 498

Hvem er aktive 0 medlemmer

Trenger hjelp med hijack this log *Ny logg*

Anbefalte innlegg

Lenke til kommentar

Videoannonse

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Populær nå

Hvem er aktive 0 medlemmer

Trenger hjelp med hijack this log Ny logg