Ukjent program starter

[eriknj]

Jeg er plaget av et program som starter (dukker opp på oppgavelinjen...) i ca 1. sekund, før det så blir borte. Dette er relativt plagsomt fordi det hender at fullskjermprogrammer blir minimert osv. Jeg finner ikke ut hva slags program dette der, siden jeg ikke får startet oppgavebehandling før programmet avsluttes. Programmet starter kanskje sånn ca 1 gang hvert 15 min, uavhengig av hva jeg driver med.

 

Jeg tror det vil funke med et program som logger prosessene som starter og kjører på systemet mitt, men jeg vet ikke om et slikt program. Kjenner noen til et slikt program, eller har andre tips? =)

[zjulik]

Last ned Hijackthis fra min signatur, scan til en loggfil, lim inn loggen her.

[eriknj]

Last ned Hijackthis fra min signatur, scan til en loggfil, lim inn loggen her.

6430616[/snapback]

 

Logfile of HijackThis v1.99.1

Scan saved at 00:13:49, on 04.07.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\MAFWTray.exe

C:\Programfiler\DAEMON Tools\daemon.exe

C:\Programfiler\HP\hpcoretech\hpcmpmgr.exe

C:\Programfiler\HP\HP Software Update\HPWuSchd2.exe

C:\Programfiler\SyncroSoft\Pos\H2O\cledx.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\Programfiler\Norton Ghost\Agent\GhostTray.exe

C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe

C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe

C:\Programfiler\Internet Download Manager\IDMan.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqgalry.exe

C:\Programfiler\Avast4\aswUpdSv.exe

C:\Programfiler\Avast4\ashServ.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\System32\GEARSec.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Norton Ghost\Agent\VProSvc.exe

C:\Programfiler\SolidConverterPDF\SCPDF\SolidPdfService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Programfiler\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Erik N\Mine dokumenter\Downloads\Programs\sdsetup.exe

C:\DOCUME~1\ERIKN~1\LOKALE~1\Temp\is-438ID.tmp\is-7PK0G.tmp

C:\Programfiler\Spyware Doctor\sdhelp.exe

C:\Programfiler\Unlocker\UnlockerAssistant.exe

C:\Programfiler\Spyware Doctor\swdoctor.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\DOCUME~1\ERIKN~1\LOKALE~1\Temp\Rar$EX00.219\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = (= Wiii =)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Programfiler\Internet Download Manager\IDMIECC.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programfiler\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar1.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programfiler\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programfiler\Fellesfiler\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [HP Component Manager] "C:\Programfiler\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [H2O] C:\Programfiler\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Programfiler\Norton Ghost\Agent\GhostTray.exe"

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Programfiler\Unlocker\UnlockerAssistant.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Creative Detector] C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [iDMan] C:\Programfiler\Internet Download Manager\IDMan.exe /onboot

O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: HP Image Zone Hurtigstart.lnk = C:\Programfiler\HP\Digital Imaging\bin\hpqthb08.exe

O8 - Extra context menu item: &Google Search - res://c:\programfiler\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\programfiler\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\programfiler\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programfiler\google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Download All Links with IDM - C:\Programfiler\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download with IDM - C:\Programfiler\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\programfiler\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\programfiler\google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru...cat-no-eula.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programfiler\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programfiler\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Norton Ghost - Symantec Corporation - C:\Programfiler\Norton Ghost\Agent\VProSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Programfiler\SolidConverterPDF\SCPDF\SolidPdfService.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programfiler\Spyware Doctor\sdhelp.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

[Zethyr]

C:\Programfiler\SyncroSoft\Pos\H2O\cledx.exe

C:\Documents and Settings\Erik N\Mine

C:\DOCUME~1\ERIKN~1\LOKALE~1\Temp\is-438ID.tmp\is-7PK0G.tmp

Vet du hva disse er? Hvis ikke bør du undersøke litt og så fjerne dem om de er unødvendige.. cledx.exe er et navn som brukes på både av virus og av det ekte programmet, så der bør du være forsiktig.

 

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

Bør fjernes!

[eriknj]

C:\Programfiler\SyncroSoft\Pos\H2O\cledx.exe

C:\Documents and Settings\Erik N\Mine

C:\DOCUME~1\ERIKN~1\LOKALE~1\Temp\is-438ID.tmp\is-7PK0G.tmp

Vet du hva disse er? Hvis ikke bør du undersøke litt og så fjerne dem om de er unødvendige.. cledx.exe er et navn som brukes på både av virus og av det ekte programmet, så der bør du være forsiktig.

 

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

Bør fjernes!

6430838[/snapback]

 

Takk for svar

Har slettet is-7PK0G.tmp nå. Resten av disse filene vet jeg hva er.. idmmbc.dll er f.eks en Internet Download Manager. Jeg har fortsatt dette problemet! Skjønner ikke hva jeg skal gjøre! :S

[berxter]

OK.

- Du har prosesser fra både Symantec og Avast! gående samtidig. Kvitt deg med ett av dem. Du kan godt ha begge installert, men de må ikke begge autostarte, for da krøller de det til for hverandre.

- Hva er

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = (= Wiii =) ?

Hvis du ikke vet det, få HJT til å fixe det.

-Last ned og kjør ccleaner

-Last ned og oppdater Ewido; sett den opp slik (den har kommet i ny versjon, så jeg er ikke høggsikker på om oppsettet her er helt relevant) kjør den i safe mode (f8 under oppstart)

-I tillegg ville jeg kjørt Panda Activescan.

 

Hva angår idmmbc.dll leser jeg rundt omkring at denne downloadmanageren har vært assosiert med spyware tidligere...

 

Bernt K