hardcore spyware

  • :evil: jeg har et eller andet spyware som jeg ikke kan slette den har ændred min bagrund start side pc til at fryse og masse andet har prøvet Ad-aware spybot hijackthis men det kommer bare igen :( det hedder noget med ( secure )

  • her er min hijackthis log



    Logfile of HijackThis v1.97.7
    Scan saved at 07:08:17, on 10-07-2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)


    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\csrss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\Ati2evxx.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\Ati2evxx.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\sstray.exe
    C:\Program Files\ABIT uGuru\uGuru.exe
    C:\PROGRA~1\DAP\DAP.EXE
    C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Highlight Zone II\Highlight.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\PROGRA~1\ZONEAL~1\zapro.exe
    C:\WINNT\explorer.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\DOCUME~1\Ramfamg\LOCALS~1\Temp\Rar$EX81.469\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.dk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINNT\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINNT\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.dk
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.dk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\secure.html
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
    O4 - HKLM\..\Run: [Alcohol.exe Autorun] C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe /startup
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZoneAlarm\zapro.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Highlight Zone II.lnk = C:\Program Files\Highlight Zone II\Highlight.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.micros…uctl.CAB?38176.5069444444
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab

  • Fjern nedenstående... og smid et nyt log herind...




    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.dk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINNT\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\secure.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINNT\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.dk
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\secure.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.dk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.dk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\secure.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\secure.html


    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm

  • Jeg har også haft mine kvaler med den dér.


    Jeg måtte i regedit og fjerne alt der havde noget med c:\winnt\Secure.html at gøre.


    husk at ændre startsiden efter du har fjernet dem fra regedit

    Asus P6T Deluxe V2 - Antec Nine Hundred
    Core i7 920 - Scyhte Mugen 2
    ASUS GTX 580 - NorthQ 1000W
    3x2GB OCZ PC12800 cl8 - X-Fi Xtreme Gamer
    Intel 320 128Gb SSD
    2x250 GB Samsung SP2504C RAID 0
    My flickr

  • Hvordan fik du den så fjernet?

    Asus P6T Deluxe V2 - Antec Nine Hundred
    Core i7 920 - Scyhte Mugen 2
    ASUS GTX 580 - NorthQ 1000W
    3x2GB OCZ PC12800 cl8 - X-Fi Xtreme Gamer
    Intel 320 128Gb SSD
    2x250 GB Samsung SP2504C RAID 0
    My flickr