Problemer med errorsafe

[kroghelg]

Har litt problemer med errorsafe.

Bruker opera til vanlig. Av og til kommer

det opp en tom side, med siden til errorsafe.

 

Er ikke stort problem, men ønsker å bli kvitt det.

Har forsøkte ewido kjørt i sikker modus, uten at det hjalp.

 

Legger ved en hijack-logg

 

Logfile of HijackThis v1.99.1

Scan saved at 17:11:41, on 19.06.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\Eset\nod32kui.exe

C:\Programfiler\Logitech\SetPoint\KEM.exe

C:\Programfiler\Logitech\SetPoint\KHALMNPR.EXE

C:\Programfiler\ewido anti-malware\ewidoctrl.exe

C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe

C:\Programfiler\Eset\nod32krn.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\NetLimiter 2 Lite\NLClient.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\DOCUME~1\Kent\LOKALE~1\Temp\Rar$EX25.814\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=24.20.9.243:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [nod32kui] "C:\Programfiler\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - Global Startup: Logitech SetPoint.lnk = C:\Programfiler\Logitech\SetPoint\KEM.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab

O16 - DPF: {39D420B3-E0EB-424C-89AA-C24F8DE7EF79} (KooPlayer Control) - http://www.tvkoo.com/update/KooPlayer.ocx

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1150310145217

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.icanal.no/spill/commerce/catalo...es/ExentCtl.ocx

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1149778783868

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} (WStarter Control) - http://live.pdbox.co.kr:8057/WStarter.cab

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab

O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido anti-malware\ewidoctrl.exe

O23 - Service: ManageEngineOpManagerApache - Unknown owner - C:\Programfiler\AdventNet\ME\OpManager\apache\bin\Apache.exe" -k runservice (file missing)

O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programfiler\Eset\nod32krn.exe

O23 - Service: ManageEngine OpManager (OpManager) - Unknown owner - C:\Programfiler\AdventNet\ME\OpManager\wrapper.exe (file missing)

O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programfiler\TuneUp Utilities 2006\WinStylerThemeSvc.exe

 

 

 

edit:linken jeg får opp er:http://www.errorsafe.com/pages/scanner/index.php?aid=tiger&lid=swf&ax=1&ex=1&ed=2(tom side)

Endret 19. juni 2006 av kroghelg

[berxter]

Tja, ingenting tyder på at du har en aktiv infeksjon av greia,men:

Bruker du clubbox?

Ellers kan du få HJT til å fixe

O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab

Bruker du disse?

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.icanal.no/spill/commerce/catalo...es/ExentCtl.ocx

O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} (WStarter Control) - http://live.pdbox.co.kr:8057/WStarter.cab

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab

Ellers bør du få HJT til å fixe dem.

 

fix disse:

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

den siste er/var en sniffer.

Du har kjørt Panda, kan vi få se loggen, men vennligst kjør en runde ccleaner (google) først?

 

Bernt K

Endret 19. juni 2006 av berxter

[zjulik]

Har litt problemer med errorsafe.

Bruker opera til vanlig. Av og til kommer

det opp en tom side, med siden til errorsafe.

 

Er ikke stort problem, men ønsker å bli kvitt det.

 

Jeg har veldig lyst til å legge til at du bør endre holdningen din til ubehageligheter. Hadde du vært like avslappet hvis du en gang i mellom så en rotte i kjellern? Ta tak i den minste antydning til smitte umiddelbart, så unngår du at et lite problem blir stort.

Endret 19. juni 2006 av zjulik

[kroghelg]

Tja, ingenting tyder på at du har en aktiv infeksjon av greia,men:

Bruker du clubbox?

Ellers kan du få HJT til å fixe

O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab

Bruker du disse?

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.icanal.no/spill/commerce/catalo...es/ExentCtl.ocx

O16 - DPF: {9BF607E0-4CC1-4099-9A07-362C9E4FB090} (WStarter Control) - http://live.pdbox.co.kr:8057/WStarter.cab

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab

Ellers bør du få HJT til å fixe dem.

 

fix disse:

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

den siste er/var en sniffer.

Du har kjørt Panda, kan vi få se loggen, men vennligst kjør en runde ccleaner (google) først?

 

Bernt K

6342190[/snapback]

 

De du nevner kjenner jeg til(unntatt www.nullsoft.com),,,,,,fixer alle dissse.

 

Her følger en fersk panda-logg:

 

Skjult tekst: (Marker innholdet i feltet for å se teksten):

Incident Status Location Hacktool:HackTool/EvID Not disinfected C:\Programfiler\GAOV\Mysee\XP_SP2_tcpPatch.exe Hacktool:HackTool/EvID Not disinfected C:\Programfiler\PPLive TV\SynaLiveSetup.exe[EvID4226Patch.exe] Virus:Trj/Agent.BLZ Disinfected C:\WINDOWS\system32\PcastUpdate.dll

 

Kjenner alle disse programmen, har hatt de en stund.

[berxter]

Vel, da ser du hva som bør slettes (hvis det ikke er noe du bruker, da):

C:\Programfiler\GAOV\Mysee\XP_SP2_tcpPatch.exe

evt hele folderen

C:\Programfiler\GAOV\Mysee\

 

C:\Programfiler\PPLive TV\SynaLiveSetup.exe[EvID4226Patch.exe]

 

Bernt K

[kroghelg]

Flott, takker så mye!

 

Ellers er det ingenting som tyder på errorsafe?

(tenker siden jeg får opp en tom siden med adressen

dere på)

[berxter]

Ser ikke noe direkte; du kan jo bruke regedit og se om du finner

 

"ErrorSafe" = "%ProgramFiles%\ErrorSafe\ers.exe /scan"

 

i subkeyen

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

eller keyen

HKEY_CURRENT_USER\Software\ErrorSafe

 

I såfall har du'n.

 

Bernt K

Endret 20. juni 2006 av berxter

[kroghelg]

Ok,skal sjekke det senere.

 

Igjen flott hjelp å få på forumet her

[MrLee]

Du har altså ikke fått dette drittet selv om den Blå popup skjermen kommer?

 

ewido eller Spybot registrerer ikke noe, og jeg fant heller ikke noe spesiellt i hijack this loggen:

 

Logfile of HijackThis v1.99.1

Scan saved at 21:10:46, on 19.06.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

F:\WINDOWS\System32\smss.exe

F:\WINDOWS\system32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\Explorer.EXE

F:\Documents and Settings\mrlee\Desktop\New Folder\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [NVMixerTray] "F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Zone Labs Client] F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [MBM 5] "F:\Program Files\Motherboard Monitor 5\MBM5.EXE"

O4 - HKCU\..\Run: [MsnMsgr] "F:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Startup: FileZilla Server Interface.lnk = F:\Program Files\FileZilla Server\FileZilla Server Interface.exe

O4 - Startup: Shortcut to EMIII.exe.lnk = F:\Documents and Settings\mrlee\Desktop\em3\EMIII.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1135621667578

O17 - HKLM\System\CCS\Services\Tcpip\..\{01F048EA-0E50-4EA2-AC51-30D8320DFA83}: NameServer = 217.13.4.21,217.13.7.136

O17 - HKLM\System\CCS\Services\Tcpip\..\{DD42B1FC-EE6F-4446-BC5E-165BF2979B6E}: NameServer = 217.13.4.21,217.13.7.136

O17 - HKLM\System\CS1\Services\Tcpip\..\{01F048EA-0E50-4EA2-AC51-30D8320DFA83}: NameServer = 217.13.4.21,217.13.7.136

O17 - HKLM\System\CS2\Services\Tcpip\..\{01F048EA-0E50-4EA2-AC51-30D8320DFA83}: NameServer = 217.13.4.21,217.13.7.136

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - F:\Program Files\DynDNS Updater\DynDNS.exe

O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - F:\Program Files\ewido anti-malware\ewidoguard.exe

O23 - Service: FAH@F:+Program Files+FoldingAtHome3+FAH504-Console.exe - Stanford University - F:\Program Files\FoldingAtHome3\FAH504-Console.exe

O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - F:\Program Files\FileZilla Server\FileZilla Server.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - F:\WINDOWS\system32\ZoneLabs\vsmon.exe

[zjulik]

Har han fremdeles uregelmessigheter så har han fremdeles styggedom.

MrLee hvis du postet loggen din for å få diagnose så må du starte en ny tråd

[MrLee]

en ny tråd? når "problemet" omhandler samme sak?