Mr.Anki Skrevet 28. november 2006 Del Skrevet 28. november 2006 Noen som kan skjekke denne hijackthis loggen ? D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\WINDOWS\Explorer.EXE D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe D:\WINDOWS\system32\nvsvc32.exe D:\Programfiler\CyberLink\Shared files\RichVideo.exe D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE D:\Programfiler\Analog Devices\Core\smax4pnp.exe D:\Programfiler\Analog Devices\SoundMAX\Smax4.exe D:\Programfiler\Winamp\winampa.exe D:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe D:\Programfiler\Unlocker\UnlockerAssistant.exe D:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe D:\Programfiler\DAEMON Tools\daemon.exe D:\Programfiler\ASUS\AI Nap\AiNap.exe D:\WINDOWS\system32\rundll32.exe D:\Programfiler\Razer\Copperhead\razerhid.exe D:\WINDOWS\system32\RunDLL32.exe D:\Documents and Settings\Andreas\winstall.exe D:\WINDOWS\system32\ctfmon.exe D:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe D:\Programfiler\Razer\Copperhead\razertra.exe D:\Programfiler\Razer\Copperhead\razerofa.exe D:\Programfiler\ASUS WiFi-AP Solo\RtWLan.exe D:\Programfiler\Logitech\SetPoint\SetPoint.exe D:\Programfiler\Fellesfiler\Logitech\KHAL\KHALMNPR.EXE D:\Programfiler\MSN Messenger\msnmsgr.exe D:\Programfiler\MSN Messenger\usnsvc.exe D:\Programfiler\uTorrent\utorrent.exe D:\WINDOWS\system32\wscntfy.exe D:\Programfiler\MSN Messenger\msnmsgr.exe D:\Programfiler\Opera\Opera.exe D:\Programfiler\MSN Messenger\msnmsgr.exe D:\Programfiler\MSN Messenger\msrr.exe D:\Programfiler\Fellesfiler\{8CABD10F-08A2-1044-0627-06040406002f}\Update.exe D:\Programfiler\WinRAR\WinRAR.exe D:\DOCUME~1\Andreas\LOKALE~1\Temp\Rar$EX00.359\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - D:\PROGRA~1\FELLES~1\{3CABD~1\888Bar.dll O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - D:\PROGRA~1\FELLES~1\{3CABD~1\888Bar.dll O4 - HKLM\..\Run: [pccguide.exe] "D:\Programfiler\Trend Micro\Internet Security 14\pccguide.exe" O4 - HKLM\..\Run: [soundMAXPnP] D:\Programfiler\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "D:\Programfiler\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] D:\Programfiler\Winamp\winampa.exe O4 - HKLM\..\Run: [RemoteControl] D:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\Programfiler\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [unlockerAssistant] "D:\Programfiler\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Ai Nap] "D:\Programfiler\ASUS\AI Nap\AiNap.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [amd_dc_opt] "D:\Programfiler\AMD\amd_dc_opt\amd_dc_opt.exe" O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [razer] D:\Programfiler\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [explorer] D:\Documents and Settings\Andreas\winstall.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "D:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [LDM] D:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - Startup: Adobe Gamma.lnk = D:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ? O4 - Global Startup: AutoCAD Startup Accelerator.lnk = D:\Programfiler\Fellesfiler\Autodesk Shared\acstart17.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = D:\Programfiler\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programfiler\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1162909761359 O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppD...ap/DigWXMSN.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - D:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - D:\Programfiler\Fellesfiler\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE" -k runservice (file missing) O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: OLE multi config - Unknown owner - D:\WINDOWS\system32\ole2.exe (file missing) O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - D:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programfiler\CyberLink\Shared files\RichVideo.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - D:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - D:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - D:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe Tusen takk for all hjelp Lenke til kommentar
norbat Skrevet 28. november 2006 Del Skrevet 28. november 2006 Avinstaller fra legg til/fjern programmer: 888bar Logitech desktop messenger Kjør HJT og merk for sletting: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - D:\PROGRA~1\FELLES~1\{3CABD~1\888Bar.dll O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - D:\PROGRA~1\FELLES~1\{3CABD~1\888Bar.dll O4 - HKLM\..\Run: [explorer] D:\Documents and Settings\Andreas\winstall.exe O23 - Service: OLE multi config - Unknown owner - D:\WINDOWS\system32\ole2.exe (file missing) Sørg for at du ser skjulte filer og mapper (kontrollpanel->mappealt. ->Vis->"vis skjulte filer og mapper" Restart i sikker modus (tapp f8 under oppstart) Bruk utforsker og slett fila (i bold) D:\Documents and Settings\Andreas\winstall.exe Restart i normal modus Last ned combofix, kjør fila. Post ny HJT-logg Lenke til kommentar
Mr.Anki Skrevet 28. november 2006 Forfatter Del Skrevet 28. november 2006 Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe D:\WINDOWS\system32\nvsvc32.exe D:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe D:\Programfiler\CyberLink\Shared files\RichVideo.exe D:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE D:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe D:\WINDOWS\Explorer.EXE D:\Programfiler\Trend Micro\Internet Security 14\pccguide.exe D:\Programfiler\Analog Devices\Core\smax4pnp.exe D:\Programfiler\Analog Devices\SoundMAX\Smax4.exe D:\Programfiler\Winamp\winampa.exe D:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe D:\Programfiler\Unlocker\UnlockerAssistant.exe D:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe D:\Programfiler\DAEMON Tools\daemon.exe D:\Programfiler\ASUS\AI Nap\AiNap.exe D:\WINDOWS\system32\rundll32.exe D:\Programfiler\Razer\Copperhead\razerhid.exe D:\WINDOWS\system32\RunDLL32.exe D:\WINDOWS\system32\winstall.exe D:\WINDOWS\system32\ctfmon.exe D:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe D:\Programfiler\Razer\Copperhead\razertra.exe D:\Programfiler\Razer\Copperhead\razerofa.exe D:\Programfiler\ASUS WiFi-AP Solo\RtWLan.exe D:\Programfiler\Logitech\SetPoint\SetPoint.exe D:\Programfiler\Fellesfiler\Logitech\KHAL\KHALMNPR.EXE D:\Programfiler\MSN Messenger\msnmsgr.exe D:\Programfiler\MSN Messenger\msrr.exe D:\WINDOWS\system32\wuauclt.exe D:\Programfiler\Opera\Opera.exe D:\Programfiler\WinRAR\WinRAR.exe D:\DOCUME~1\Andreas\LOKALE~1\Temp\Rar$EX00.547\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O4 - HKLM\..\Run: [pccguide.exe] "D:\Programfiler\Trend Micro\Internet Security 14\pccguide.exe" O4 - HKLM\..\Run: [soundMAXPnP] D:\Programfiler\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "D:\Programfiler\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] D:\Programfiler\Winamp\winampa.exe O4 - HKLM\..\Run: [RemoteControl] D:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\Programfiler\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [unlockerAssistant] "D:\Programfiler\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Ai Nap] "D:\Programfiler\ASUS\AI Nap\AiNap.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [amd_dc_opt] "D:\Programfiler\AMD\amd_dc_opt\amd_dc_opt.exe" O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [razer] D:\Programfiler\Razer\Copperhead\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [explorer] D:\WINDOWS\system32\winstall.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "D:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [sUPERAntiSpyware] D:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\RunOnce: [DeleteDLL] cmd.exe /c del D:\PROGRA~1\FELLES~1\{3CABD~1\888Bar.dll > nul O4 - Startup: Adobe Gamma.lnk = D:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ? O4 - Global Startup: AutoCAD Startup Accelerator.lnk = D:\Programfiler\Fellesfiler\Autodesk Shared\acstart17.exe O4 - Global Startup: Logitech SetPoint.lnk = D:\Programfiler\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programfiler\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nvappfilter.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1162909761359 O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppD...ap/DigWXMSN.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: SASWinLogon - D:\Programfiler\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - D:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - D:\Programfiler\Fellesfiler\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - D:\PROGRAMFILER\NVIDIA CORPORATION\NETWORKACCESSMANAGER\APACHE GROUP\APACHE2\BIN\APACHE.EXE" -k runservice (file missing) O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - D:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - D:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programfiler\CyberLink\Shared files\RichVideo.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - D:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - D:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - D:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe Lenke til kommentar
norbat Skrevet 28. november 2006 Del Skrevet 28. november 2006 Last ned drweb Kjør HJT og merk for slett: O4 - HKLM\..\Run: [explorer] D:\WINDOWS\system32\winstall.exe Restart i sikker modus Finn og slett fila (i bold) D:\WINDOWS\system32\winstall.exe Kjør drweb-cureit.exe (si ja til å kjøre en express scan) Når dette er ferdig klikker du på Option -> Change settings. Under fanearket Scan, fjerner du haken ved Heuristic analysis. Under fanearket Actions, skal alle punkt under Malware settes til Rename. Velg partisjon du vil scanne og klikk deretter på den grønne pilen for å starte scanningen. Velg "yes to all" når det finner noe for første gang. Kjør en full scan med Superantispyware (SAS) Restart i normal modus Ny HJT-logg Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå