Noen som kan skjekke Hijackthis logg?

Atlesen · 23. mai 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:47, on 2008-05-25

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ATKKBService.exe

C:\Programfiler\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\Programfiler\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ATK0100\HControl.exe

C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Programfiler\ASUS\Power4 Gear\BatteryLife.exe

C:\Programfiler\Wireless Console 2\wcourier.exe

C:\Programfiler\NETGEAR\WG511SCU\Utility\Gear511.exe

C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Programfiler\Fellesfiler\InstallShield\UpdateService\issch.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\LXSUPMON.EXE

C:\Programfiler\ASUS\WLAN Card Utilities\Center.exe

C:\Programfiler\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe

C:\Programfiler\ASUS\Net4Switch\Net4Switch.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\ATK0100\ATKOSD.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Documents and Settings\Atle Øyhus\Mine dokumenter\HijackThis.exe

C:\Documents and Settings\Atle Øyhus\Mine dokumenter\tull.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.sol.no

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: (no name) - {03B74C71-BD3F-42D1-B72D-6502055CD757} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {0D07C058-D769-4C7F-BEA4-B337E1EB2D00} - (no file)

O2 - BHO: (no name) - {104962E0-8AB6-486E-BE12-F822F24A7C72} - (no file)

O2 - BHO: (no name) - {108B08EB-8754-40E6-8B2A-9B0B415090E6} - (no file)

O2 - BHO: (no name) - {11C4B90F-CC86-4D88-BCF2-A09F1C859EAD} - (no file)

O2 - BHO: (no name) - {11EA4283-DAC5-4AD4-899D-A21631839906} - (no file)

O2 - BHO: (no name) - {14B2DEF2-7D3E-4A09-8969-E70A07B93338} - (no file)

O2 - BHO: (no name) - {15C3E0D2-4A60-4681-8D24-72AC5D08F82B} - (no file)

O2 - BHO: (no name) - {1fd942c1-4d48-4f7c-9b51-fcf2802672f9} - (no file)

O2 - BHO: (no name) - {20D27977-4841-49B1-A0EA-D12ADC6BA954} - (no file)

O2 - BHO: (no name) - {25d0aa97-fc20-4c3d-938d-640fe4fd1572} - (no file)

O2 - BHO: (no name) - {2878cec1-6c9c-4315-b04d-42c312f28ab2} - (no file)

O2 - BHO: (no name) - {3283eb91-7ddb-41ee-9179-bcc38e8e9184} - (no file)

O2 - BHO: (no name) - {335aa1b1-4b66-4bdf-9565-c1075711044e} - (no file)

O2 - BHO: (no name) - {341E3B1B-F117-45DE-94D2-2DCB15B7B862} - (no file)

O2 - BHO: (no name) - {34DEFE3A-EF5A-4CFD-B5B5-85D2C8987E5E} - (no file)

O2 - BHO: (no name) - {385089a5-e20d-4778-be41-6d914a96ac27} - (no file)

O2 - BHO: (no name) - {38A35596-A942-4701-9AF3-01154C1FE3C6} - (no file)

O2 - BHO: (no name) - {3FD5C219-D5B8-4C68-A020-D5A72DB59748} - (no file)

O2 - BHO: (no name) - {4059D2FA-5EC9-4341-A506-347180508208} - (no file)

O2 - BHO: (no name) - {43b67c47-9cb4-4c8a-886f-d5d1b31e3f90} - (no file)

O2 - BHO: (no name) - {4621D4C3-F94F-48DF-9B04-1D21FEEFACB5} - (no file)

O2 - BHO: (no name) - {4ad6088f-454c-4467-aa91-5a36239e562e} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programfiler\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {57BF85F5-0AAD-4050-96EF-BDE83B4ABDB3} - (no file)

O2 - BHO: (no name) - {5d32ae15-e31e-42eb-9af8-0e1fd276148b} - (no file)

O2 - BHO: (no name) - {5fa52f71-321c-4038-8aa8-548f3bc550ae} - (no file)

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

O2 - BHO: (no name) - {63A70E1D-D692-4237-8132-6FE7BBEFE321} - (no file)

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FELLES~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: (no name) - {6dc8b7c3-62c6-40ec-ad5f-1a1b42509a94} - (no file)

O2 - BHO: (no name) - {702987F6-53A2-4935-BDEF-74C866F3F635} - (no file)

O2 - BHO: (no name) - {7503E538-DAE1-49D6-979D-7A846FF9A2B1} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7614B25D-5906-4936-AC68-6807C3384095} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {828BFB27-9807-4E29-8E15-5CE477BCF814} - (no file)

O2 - BHO: (no name) - {8F6D9342-7D73-4327-9CEA-08398A0EAEE1} - (no file)

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {932C1733-76F6-456B-B3A6-BA03C090540D} - (no file)

O2 - BHO: (no name) - {99A92688-FBAB-4D94-97D9-F0B2D5F44942} - (no file)

O2 - BHO: (no name) - {A4D086A7-2A33-41E5-A412-8DEA08F10E52} - (no file)

O2 - BHO: (no name) - {b69e5e93-fd73-457b-8143-1008231bd759} - (no file)

O2 - BHO: (no name) - {BC7D8DE8-EF3D-4F44-8B54-03759FAC1367} - (no file)

O2 - BHO: (no name) - {BE58BB0C-6976-43E1-9276-E1E6A6508134} - (no file)

O2 - BHO: (no name) - {C0F9A626-0E55-4562-A7D7-4BAAC9F9805F} - (no file)

O2 - BHO: (no name) - {C4391594-5570-4935-8431-8515A0E52569} - (no file)

O2 - BHO: (no name) - {CAEA6657-CB73-44C4-96ED-A6A92DA35C71} - (no file)

O2 - BHO: (no name) - {CE85F640-E12A-4875-99FF-C8BD89FF786D} - (no file)

O2 - BHO: (no name) - {E4B1393E-FC01-47E3-8481-C0A1729E6F7A} - (no file)

O2 - BHO: (no name) - {EBB03547-27BA-4D97-BEFC-5BE3718D162E} - (no file)

O2 - BHO: (no name) - {FCADD00C-69DE-4BC2-8D26-6BA2F33650FF} - (no file)

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe

O4 - HKLM\..\Run: [ATIPTA] "C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Power_Gear] C:\Programfiler\ASUS\Power4 Gear\BatteryLife.exe 1

O4 - HKLM\..\Run: [Wireless Console 2] C:\Programfiler\Wireless Console 2\wcourier.exe

O4 - HKLM\..\Run: [AS00_Gear511] C:\Programfiler\NETGEAR\WG511SCU\Utility\Gear511.exe -hide

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FELLES~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Programfiler\Fellesfiler\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN

O4 - HKLM\..\Run: [Control Center] C:\Programfiler\ASUS\WLAN Card Utilities\Center.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programfiler\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Programfiler\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Net4Switch] C:\Programfiler\ASUS\Net4Switch\Net4Switch.exe

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programfiler\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [filehippo.com] "C:\Programfiler\filehippo.com\UpdateChecker.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1210171259825

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1210173629046

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: ssqRHXoo - C:\WINDOWS\

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Programfiler\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: Automatisk LiveUpdate-planlegging (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: LiveUpdate - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programfiler\Spyware Terminator\sp_rsser.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FELLES~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--

End of file - 12792 bytes

Atle

Endret 25. mai 2008 av Atlesen

norbat · 23. mai 2008

Ja, du kan kjøre gjennom langversjonen i følgende post: https://www.diskusjon.no/index.php?showtopic=691246.

Loggene det spørres etter, poster du her i din egen post, så skal vi nok få has på denne infeksjonen

Atlesen · 25. mai 2008

litt oppdatert!

norbat · 25. mai 2008

Start hjt, velg "Do a system scan only", sett merke framfor følgende linjer og klikk Fix checked: (åpne spoileren)

Lukk nettleseren før du fixer linjene.