Hijackthis log. Firefox lukker seg.

[Looke]

Logfile of HijackThis v1.99.1

Scan saved at 15:26:02, on 21.02.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Microsoft Shared\DAO\svchost.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\Programfiler\UltraMon\UltraMon.exe

C:\Programfiler\UltraMon\UltraMonTaskbar.exe

C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\uTorrent\utorrent.exe

C:\Programfiler\ATI Multimedia\RemCtrl\ATIRW.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\mIRC\mirc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Documents and Settings\Simonowns\Skrivebord\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Windows LSASS Service] C:\Programfiler\Fellesfiler\Microsoft Shared\DAO\svchost.exe

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ultraMon] "C:\Programfiler\UltraMon\UltraMon.exe" /auto

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [µTorrent] "C:\Programfiler\uTorrent\utorrent.exe"

O4 - HKCU\..\Run: [ATI Remote Control] C:\Programfiler\ATI Multimedia\RemCtrl\ATIRW.EXE

O4 - Startup: Loke standard skjerm.lnk = ?

O4 - Startup: mIRC (2).lnk = C:\Programfiler\mIRC\mirc.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{AC9BB085-88DD-44A7-86D6-1B6CDDDA919C}: NameServer = 130.67.15.198,193.213.112.4

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

 

 

 

Spywaren jeg tror jeg har er noe som lukker nettleseren når jeg søker på spyware, og når jeg prøver å installere spyware cleanere, så lukker den det også.

 

Kan noen hjelpe meg ? ganske irriterende problem

 

Takk

[norbat]

Sørg for at du kan se skjulte filer og mapper (kontrollpanel->mappealt.->vis->"vis skjulte filer og mapper")

 

Last ned SAS, installer og oppdater.

 

Restart i sikker modus (tapp f8 under oppstart)

 

Bruk utforsker til å finne og slette (i bold):

C:\Programfiler\Fellesfiler\Microsoft Shared\DAO\svchost.exe

 

Kjør en complete scan med SAS, slett alt den finner.

 

Restart i normal modus

 

Kjør HJT og sett merke framfor følgende linjer (hvis de finnes), klikk Fix checked:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Windows LSASS Service] C:\Programfiler\Fellesfiler\Microsoft Shared\DAO\svchost.exe

 

Post en ny HJT-logg sammen med loggen fra SAS (preferences->statistics/logs)

[Looke]

Logfile of HijackThis v1.99.1

Scan saved at 16:47:44, on 21.02.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RunDLL32.exe

C:\Programfiler\UltraMon\UltraMon.exe

C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\uTorrent\utorrent.exe

C:\Programfiler\ATI Multimedia\RemCtrl\ATIRW.EXE

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\UltraMon\UltraMonTaskbar.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\mIRC\mirc.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Simonowns\Skrivebord\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ultraMon] "C:\Programfiler\UltraMon\UltraMon.exe" /auto

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [µTorrent] "C:\Programfiler\uTorrent\utorrent.exe"

O4 - HKCU\..\Run: [ATI Remote Control] C:\Programfiler\ATI Multimedia\RemCtrl\ATIRW.EXE

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: Loke standard skjerm.lnk = ?

O4 - Startup: mIRC (2).lnk = C:\Programfiler\mIRC\mirc.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{AC9BB085-88DD-44A7-86D6-1B6CDDDA919C}: NameServer = 130.67.15.198,193.213.112.4

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

 

 

 

SUPERAntiSpyware Scan Log

Generated 02/21/2007 at 04:42 PM

 

Application Version : 3.5.1016

 

Core Rules Database Version : 3186

Trace Rules Database Version: 1196

 

Scan type : Complete Scan

Total Scan Time : 00:24:43

 

Memory items scanned : 344

Memory threats detected : 0

Registry items scanned : 4237

Registry threats detected : 0

File items scanned : 42108

File threats detected : 1

 

Adware.WhenU

C:\PROGRAMFILER\DAEMON TOOLS\SETUPDTSB.EXE

 

 

Nå funker det å installere spyware cleanere og å søke på det så alt jeg har å si er tusen takk norbat, du fiksa pcen min

[norbat]

Din logg er ren

 

En liten opprydding:

 

Kjør HJT og fix:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

 

Last ned CCleaner. Start programmet. Gå til 'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer......." Klikk på 'Renser' og deretter 'Kjør CCleaner'.

 

Du bør nullstille gjenopprettingsmappa slik at du ikke blir infisert ved en evt. systemgjenoppretting.

Kontrollpanel->system->systemgjenoppretting . Sett merke framfor "Slå av .....",

restart pc, fjern merket igjen for å aktivere funksjonen.

 

Etterpå lager du deg et gjenopprettingspunkt manuelt

Tilbehør->systemverktøy->systemgjenoppretting . Velg å opprette

et nytt. Navgi det og klikk opprett.

 

Gå til (kontrollpanel->mappealt.->vis->"vis skjulte filer og mapper") igjen og skjul filer og mapper slik at du ikke ved en feil kommer i skade å sletter viktige filer.

 

Kan ikke se at du kjører noen antivirusprogram på pc'n. Det bør du ha. AVG er et godt valg.

Endret 21. februar 2007 av norbat

[Looke]

Takker, skal fikse det nå