--- title: "tyda HiJackThis log fil" type: "forum-thread" url: "https://www.webforum.nu/amne/datasakerhet/100665-tyda-hijackthis-log-fil" topic: "Datasäkerhet" topic_url: "https://www.webforum.nu/amne/datasakerhet" author: "eddy1" published: "2004-03-31T06:08:05.000Z" updated: "2004-03-31T06:52:08.000Z" replies: 1 views: 245 page: 1 pages: 1 language: "sv-SE" site: "webForum — webforum.nu" rights: "Upphovsrätten till varje inlägg tillhör dess författare." attribution: "Citera som: webForum, https://www.webforum.nu/amne/datasakerhet/100665-tyda-hijackthis-log-fil" --- # tyda HiJackThis log fil ## #1 — eddy1, 2004-03-31T06:08Z Hoppas någon med lite erfarenhet kan hjälpa mig tyda min log fil från hijackthis. Det är nämligen så att min sök sida ändra hela tiden till "res://mshp.dll/index.html#37049" och får även massa pop'ups !! Logfile of HijackThis v1.97.7 Scan saved at 07:59:38, on 2004-03-31 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\\Windows\\System32\\smss.exe C:\\Windows\\system32\\winlogon.exe C:\\Windows\\system32\\services.exe C:\\Windows\\system32\\lsass.exe C:\\Windows\\system32\\svchost.exe C:\\Windows\\System32\\svchost.exe C:\\Windows\\system32\\spoolsv.exe C:\\COMPAQ\\ACLIENT\\ACLIENT.exe C:\\Program\\Network Associates\\VirusScan\\Avsynmgr.exe C:\\Program\\Compaq\\Compaq Management Agents\\cpqalert.exe C:\\Windows\\Cpqdiag\\Cpqdfwag.exe C:\\Program\\Compaq\\COMPAQ\~1\\CPQWEB\~1\\WebDmi.exe C:\\Program\\Delade filer\\Microsoft Shared\\VS7Debug\\mdm.exe C:\\Windows\\System32\\NMSSvc.exe C:\\Program\\Network Associates\\VirusScan\\VsStat.exe C:\\Windows\\System32\\svchost.exe C:\\Program\\Network Associates\\VirusScan\\Vshwin32.exe C:\\Program\\Compaq\\Compaq Management Agents\\Dmi\\Win32\\bin\\Win32sl.exe C:\\Program\\Compaq\\COMPAQ\~1\\cpqdmi.exe C:\\Program\\Delade filer\\Network Associates\\McShield\\Mcshield.exe C:\\Program\\Network Associates\\VirusScan\\Avconsol.exe z:\\win32\\clntrust.exe C:\\Windows\\Explorer.EXE C:\\Program\\Analog Devices\\SoundMAX\\Smtray.exe C:\\Program\\COMPAQ\\Easy Access Button Support\\StartEAK.exe C:\\Windows\\System32\\PROMon.exe C:\\Program\\Compaq\\COMPAQ\~1\\CHKADMIN.EXE C:\\Windows\\System32\\NWTRAY.EXE C:\\Program\\Adobe\\Acrobat 6.0\\Distillr\\acrotray.exe C:\\Program\\Microsoft Office\\Office\\FINDFAST.EXE C:\\Program\\Microsoft Office\\Office\\OSA.EXE C:\\Program\\Compaq\\Easy Access Button Support\\CPQEAKSYSTEMTRAY.EXE C:\\Program\\Compaq\\Easy Access Button Support\\CPQEADM.EXE C:\\Compaq\\EAKDRV\\EAUSBKBD.EXE C:\\Program\\Compaq\\EASYAC\~1\\BttnServ.exe C:\\Program\\MICROS\~2\\Office10\\OUTLOOK.EXE C:\\Program\\Internet Explorer\\iexplore.exe C:\\Program\\Internet Explorer\\iexplore.exe X:\\1 Gemensamma Program\\PC Program\\Spyboot search & destroy\\HijackThis.exe C:\\WUTemp\\com_microsoft.824141_WXP_SP2_WinSE_49433_Critical\\WindowsXP-KB824141-x86-sve.exe c:\\d1c4f1fb4619abdc30e7\\xpsp1hfm.exe c:\\d1c4f1fb4619abdc30e7\\sp2\\update\\update.exe R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = about:blank R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = res://mshp.dll/sp.html#37049 R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = res://mshp.dll/index.html#37049 R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = about:blank R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = res://mshp.dll/index.html#37049 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = res://mshp.dll/sp.html#37049 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = res://mshp.dll/index.html#37049 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = res://mshp.dll/sp.html#37049 R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,SearchAssistant = about:blank R1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyServer = 192.168.0.1:8080 R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Länkar R1 - HKCU\\Software\\Microsoft\\Internet Explorer,SearchAssistant = R1 - HKCU\\Software\\Microsoft\\Internet Explorer,CustomizeSearch = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program\\Adobe\\Acrobat 6.0\\Acrobat\\ActiveX\\AcroIEHelper.dll O2 - BHO: . - {587DBF2D-9145-4c9e-92C2-1F953DA73773} - C:\\Windows\\winwt\\winwt32.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\\Program\\Adobe\\Acrobat 6.0\\Acrobat\\AcroIEFavClient.dll O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\\Windows\\iedb\\mssearch.dll O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\\Windows\\winwt\\msiesh.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\\WINDOWS\\System32\\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\\Program\\Adobe\\Acrobat 6.0\\Acrobat\\AcroIEFavClient.dll O4 - HKLM\\..\\Run: \[Smapp\] C:\\Program\\Analog Devices\\SoundMAX\\Smtray.exe O4 - HKLM\\..\\Run: \[CPQEASYACC\] C:\\Program\\COMPAQ\\Easy Access Button Support\\StartEAK.exe O4 - HKLM\\..\\Run: \[PROMon.exe\] PROMon.exe O4 - HKLM\\..\\Run: \[ChkAdmin\] C:\\Program\\Compaq\\COMPAQ\~1\\CHKADMIN.EXE O4 - HKLM\\..\\Run: \[NWTRAY\] NWTRAY.EXE O4 - HKLM\\..\\Run: \[Image\] rundll32 C:\\Windows\\image.dll,Install O4 - HKLM\\..\\RunServices: \[CPQDFWAG\] C:\\Windows\\Cpqdiag\\CpqDfwAg.exe O4 - HKCU\\..\\RunServices: \[Image\] rundll32 C:\\Windows\\image.dll,Install O4 - HKLM\\..\\RunOnce: \[KB826939\] rundll32.exe apphelp.dll,ShimFlushCache O4 - Startup: Microsoft Outlook.lnk = ? O4 - Global Startup: Acrobat Assistant.lnk = C:\\Program\\Adobe\\Acrobat 6.0\\Distillr\\acrotray.exe O4 - Global Startup: Microsoft Office Snabbsökning.lnk = C:\\Program\\Microsoft Office\\Office\\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\\Program\\Microsoft Office\\Office10\\OSA.EXE O4 - Global Startup: Office-autostart.lnk = C:\\Program\\Microsoft Office\\Office\\OSA.EXE O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\\Program\\MICROS\~2\\Office10\\EXCEL.EXE/3000 O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - Permalänk: https://www.webforum.nu/p/100665 ## #2 — Peeer, 2004-03-31T06:52Z > **http://forums.devshed.com/showpost.php?p=575002&postcount=19 skrev:** > > It's a program called Logical Online Portal(LOP) .Simply go to Start menu/control panel/add/remove programs and look for the above item(Logical Online Portal). When you klik on uninstall, it comes back with some gibberish looking 7 digit number it asks you to copy and insert, (checking to make sure you're really a person!). Do that and ,"Voila!",bye-bye LOP! A great oldie by the Everly Brothers,LOL! Hjälper inget av ovanstående så prova det vanliga (adaware & avprogram) Permalänk: https://www.webforum.nu/p/1312078 --- Tråden på webben: https://www.webforum.nu/amne/datasakerhet/100665-tyda-hijackthis-log-fil