--- title: "Rekalm i Windows" type: "forum-thread" url: "https://www.webforum.nu/amne/datasakerhet/126478-rekalm-i-windows" topic: "Datasäkerhet" topic_url: "https://www.webforum.nu/amne/datasakerhet" author: "Wiskman" published: "2005-04-15T16:07:48.000Z" updated: "2005-04-15T16:39:26.000Z" replies: 4 views: 228 page: 1 pages: 1 language: "sv-SE" site: "webForum — webforum.nu" rights: "Upphovsrätten till varje inlägg tillhör dess författare." attribution: "Citera som: webForum, https://www.webforum.nu/amne/datasakerhet/126478-rekalm-i-windows" --- # Rekalm i Windows ## #1 — Wiskman, 2005-04-15T16:07Z Jag har ett problem. Jag får upp en massa reklam i datorn, jag behöver inte ha öppen internet explorer, men jag får det ändå. jag har sökt i datorn med Spybot och Ad-aware utan det gett några rsultat, vad kan jag göra? jätte irriterande verkligen. Här är en logg ifrån HijackThis Logfile of HijackThis v1.99.1 Scan saved at 22:21:42, on 2005-04-18 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\\WINDOWS\\System32\\smss.exe C:\\WINDOWS\\system32\\winlogon.exe C:\\WINDOWS\\system32\\services.exe C:\\WINDOWS\\system32\\lsass.exe C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\System32\\svchost.exe C:\\Program\\TGTSoft\\StyleXP\\StyleXPService.exe C:\\Program\\Delade filer\\Symantec Shared\\ccSetMgr.exe C:\\Program\\Delade filer\\Symantec Shared\\ccEvtMgr.exe C:\\WINDOWS\\Explorer.EXE C:\\WINDOWS\\system32\\spoolsv.exe C:\\Program\\Delade filer\\Microsoft Shared\\VS7DEBUG\\MDM.EXE C:\\Program\\Norton AntiVirus\\navapsvc.exe C:\\WINDOWS\\system32\\nvsvc32.exe C:\\WINDOWS\\System32\\svchost.exe C:\\Program\\Delade filer\\Symantec Shared\\Security Center\\SymWSC.exe C:\\Program\\Norton AntiVirus\\SAVScan.exe C:\\Program\\Microsoft IntelliType Pro\\type32.exe C:\\Program\\Microsoft IntelliPoint\\point32.exe C:\\Program\\Java\\j2re1.4.2_06\\bin\\jusched.exe C:\\WINDOWS\\System32\\LVCOMSX.EXE C:\\Program\\Delade filer\\Real\\Update_OB\\realsched.exe C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe C:\\Program\\HP\\hpcoretech\\hpcmpmgr.exe D:\\Program\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe C:\\WINDOWS\\System32\\hphmon05.exe C:\\WINDOWS\\SOUNDMAN.EXE C:\\WINDOWS\\System32\\HPZipm12.exe C:\\Program\\Delade filer\\Symantec Shared\\ccApp.exe C:\\Program\\Messenger\\msmsgs.exe C:\\WINDOWS\\system32\\ctfmon.exe D:\\Program\\MSI\\Core Center\\CoreCenter.exe C:\\Program\\MSN Messenger\\MsnMsgr.Exe C:\\Program\\Internet Explorer\\iexplore.exe C:\\Program\\Internet Explorer\\iexplore.exe C:\\Program\\Internet Explorer\\iexplore.exe C:\\Documents and Settings\\Daniel\\Skrivbord\\HijackThis.exe R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Länkar R3 - Default URLSearchHook is missing F3 - REG:win.ini: load=C:\\Program\\WAFFLEz\\mlg1.exe O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file) O4 - HKLM\\..\\Run: \[IgfxTray\] C:\\WINDOWS\\System32\\igfxtray.exe O4 - HKLM\\..\\Run: \[HotKeysCmds\] C:\\WINDOWS\\System32\\hkcmd.exe O4 - HKLM\\..\\Run: \[type32\] "C:\\Program\\Microsoft IntelliType Pro\\type32.exe" O4 - HKLM\\..\\Run: \[IntelliPoint\] "C:\\Program\\Microsoft IntelliPoint\\point32.exe" O4 - HKLM\\..\\Run: \[SunJavaUpdateSched\] C:\\Program\\Java\\j2re1.4.2_06\\bin\\jusched.exe O4 - HKLM\\..\\Run: \[PinnacleDriverCheck\] C:\\WINDOWS\\System32\\PSDrvCheck.exe -CheckReg O4 - HKLM\\..\\Run: \[LVCOMSX\] C:\\WINDOWS\\System32\\LVCOMSX.EXE O4 - HKLM\\..\\Run: \[QuickTime Task\] "D:\\Program\\QuickTime\\qttask.exe" -atboottime O4 - HKLM\\..\\Run: \[TkBellExe\] "C:\\Program\\Delade filer\\Real\\Update_OB\\realsched.exe" -osboot O4 - HKLM\\..\\Run: \[HPDJ Taskbar Utility\] C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe O4 - HKLM\\..\\Run: \[HPHUPD05\] D:\\Program\\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\\hphupd05.exe O4 - HKLM\\..\\Run: \[HP Component Manager\] "C:\\Program\\HP\\hpcoretech\\hpcmpmgr.exe" O4 - HKLM\\..\\Run: \[HP Software Update\] "D:\\Program\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe" O4 - HKLM\\..\\Run: \[HPHmon05\] C:\\WINDOWS\\System32\\hphmon05.exe O4 - HKLM\\..\\Run: \[SoundMan\] SOUNDMAN.EXE O4 - HKLM\\..\\Run: \[NeroFilterCheck\] C:\\WINDOWS\\system32\\NeroCheck.exe O4 - HKLM\\..\\Run: \[Media Access\] C:\\Program Files\\Media Access\\MediaAccK.exe O4 - HKLM\\..\\Run: \[gah95on6\] C:\\WINDOWS\\system32\\gah95on6.exe O4 - HKLM\\..\\Run: \[Reeci\] c:\\Program Files\\Xsovk\\Pxtmb.exe O4 - HKLM\\..\\Run: \[Jndnca\] c:\\Program Files\\Ansxn\\Gbyyppp.exe O4 - HKLM\\..\\Run: \[etbrun\] C:\\windows\\system32\\eliteamg32.exe O4 - HKLM\\..\\Run: \[Services\] C:\\windows.exe O4 - HKLM\\..\\Run: \[Media Pass\] C:\\Program Files\\Media Pass\\MediaPassK.exe O4 - HKLM\\..\\Run: \[hgh\] C:\\WINDOWS\\hgh.exe O4 - HKLM\\..\\Run: \[ccApp\] "C:\\Program\\Delade filer\\Symantec Shared\\ccApp.exe" O4 - HKLM\\..\\Run: \[YONVwaq\] C:\\WINDOWS\\rthysfnl.exe O4 - HKLM\\..\\Run: \[Symantec NetDriver Monitor\] C:\\Program\\SYMNET\~1\\SNDMon.exe O4 - HKLM\\..\\Run: \[NvCplDaemon\] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup O4 - HKLM\\..\\Run: \[nwiz\] nwiz.exe /install O4 - HKLM\\..\\Run: \[NvMediaCenter\] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit O4 - HKCU\\..\\Run: \[MSMSGS\] "C:\\Program\\Messenger\\msmsgs.exe" /background O4 - HKCU\\..\\Run: \[ctfmon.exe\] C:\\WINDOWS\\system32\\ctfmon.exe O4 - HKCU\\..\\Run: \[STYLEXP\] C:\\Program\\TGTSoft\\StyleXP\\StyleXP.exe -Hide O4 - Global Startup: Adobe Gamma Loader.lnk = C:\\Program\\Delade filer\\Adobe\\Calibration\\Adobe Gamma Loader.exe O4 - Global Startup: CoreCenter.lnk = D:\\Program\\MSI\\Core Center\\CoreCenter.exe O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\\Program\\MICROS\~1\\OFFICE11\\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\WINDOWS\\System32\\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\WINDOWS\\System32\\msjava.dll O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\\Program\\MICROS\~1\\OFFICE11\\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program\\Messenger\\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program\\Messenger\\msmsgs.exe O15 - Trusted Zone: (HKLM) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} (FileSharingCtrl Class) - O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - O20 - Winlogon Notify: igfxcui - C:\\WINDOWS\\SYSTEM32\\igfxsrvc.dll O23 - Service: Adobe LM Service - Unknown owner - C:\\Program\\Delade filer\\Adobe Systems Shared\\Service\\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\ccSetMgr.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\\Program\\Delade filer\\Macromedia Shared\\Service\\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec Corporation - C:\\Program\\Norton AntiVirus\\navapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\\WINDOWS\\System32\\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\\Program\\Norton AntiVirus\\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\\Program\\DELADE\~1\\SYMANT\~1\\SCRIPT\~1\\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\SNDSrvc.exe O23 - Service: StyleXPService - Unknown owner - C:\\Program\\TGTSoft\\StyleXP\\StyleXPService.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\Security Center\\SymWSC.exe Permalänk: https://www.webforum.nu/p/126478 ## #2 — Josef, 2005-04-15T16:10Z Gäller det pop-ups? Är du säker på att både Ad-aware och Spybot är uppdaterade? Annat antivirus-skydd? Permalänk: https://www.webforum.nu/p/1592638 ## #3 — PersianBulldog, 2005-04-15T16:10Z Reklam i form av vad? Jag föreslår att du kör [HijackThis](http://www.bleepingcomputer.com/files/Merijn/HijackThis.zip) och postar sedan loggen här. Då får man en klar översikt över potentiell ad-ware. Permalänk: https://www.webforum.nu/p/1592639 ## #4 — Wiskman, 2005-04-15T16:16Z allt är uppdaterat.. Permalänk: https://www.webforum.nu/p/1592644 ## #5 — legis, 2005-04-15T16:39Z Flyttas från Windows Permalänk: https://www.webforum.nu/p/1592658 --- Tråden på webben: https://www.webforum.nu/amne/datasakerhet/126478-rekalm-i-windows