csrss.exe, wmiprvse, wmiapsrv, smss??

June 19, 2007

Hej!

Kostar alla mina frågor en miljon kan ni sluta läsa redan nu

Är inne på blip och spelar ibland och rätt vad det är "hänger" sig datorn eller låååångsammar sig nåt fruktansvärt. Tar man fram aktivitets hanteraren och kollar prestandan är cpu-användningen 100%, men kollar man programmen är det bara blip som körs!? När det väl börjat håller det på så med jämna mellanrum. Då brukar jag logga ut, starta om dator och sedan får jag göra så med jämna mellanrum.

Har tittat runt lite på andra trådar och tror, efter vad jag läst, att min dator har nåt skräp som inte borde vara där. Kör ad-aware så fort jag loggat in blip.se och får upp mellan tre och 12 filer jag plockar bort varje gång, de vanligaste är:

[log]Ad-Aware SE Build 1.05

Logfile Created on:den 19 juni 2007 13:23:49

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R175 11.06.2007

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

MRU List(TAC index:0):9 total references

Tracking Cookie(TAC index:3):10 total references

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

2007-06-19 13:23:49 - Scan started. (Full System Scan)

MRU List Object Recognized!

Location: : C:\Documents and Settings\LIFEBOOK\Application Data\microsoft\office\recent

Description : list of recently opened documents using microsoft office

MRU List Object Recognized!

Location: : C:\Documents and Settings\LIFEBOOK\recent

Description : list of recently opened documents

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct3d

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct X

MRU List Object Recognized!

Location: : software\microsoft\directdraw\mostrecentapplication

Description : most recent application to use microsoft directdraw

MRU List Object Recognized!

Location: : S-1-5-21-796845957-854245398-1235568931-1003\software\microsoft\internet explorer\typedurls

Description : list of recently entered addresses in microsoft internet explorer

MRU List Object Recognized!

Location: : S-1-5-21-796845957-854245398-1235568931-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

Description : list of recent programs opened

MRU List Object Recognized!

Location: : S-1-5-21-796845957-854245398-1235568931-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru

Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!

Location: : S-1-5-21-796845957-854245398-1235568931-1003\software\microsoft\windows\currentversion\explorer\recentdocs

Description : list of recent documents opened

Listing running processes

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

FilePath : \SystemRoot\System32 ProcessID : 540

ThreadCreationTime : 2007-06-19 09:56:20

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\WINDOWS\system32 ProcessID : 596

ThreadCreationTime : 2007-06-19 09:56:23

BasePriority : Normal

#:3 [winlogon.exe]

FilePath : \??\C:\WINDOWS\system32 ProcessID : 624

ThreadCreationTime : 2007-06-19 09:56:27

BasePriority : High

#:4 [services.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 668

ThreadCreationTime : 2007-06-19 09:56:30

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Operativsystemet Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Tjänst- och styrenhetsprogram

InternalName : services.exe

LegalCopyright : © Microsoft Corporation. Med ensamrätt.

OriginalFilename : services.exe

#:5 [lsass.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 680

ThreadCreationTime : 2007-06-19 09:56:30

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Shell (Export Version)

InternalName : lsass.exe

OriginalFilename : lsass.exe

#:6 [svchost.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 832

ThreadCreationTime : 2007-06-19 09:56:32

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:7 [svchost.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 892

ThreadCreationTime : 2007-06-19 09:56:33

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:8 [svchost.exe]

FilePath : C:\WINDOWS\System32 ProcessID : 976

ThreadCreationTime : 2007-06-19 09:56:34

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:9 [svchost.exe]

FilePath : C:\WINDOWS\System32 ProcessID : 1024

ThreadCreationTime : 2007-06-19 09:56:34

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:10 [svchost.exe]

FilePath : C:\WINDOWS\System32 ProcessID : 1168

ThreadCreationTime : 2007-06-19 09:56:35

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:11 [spoolsv.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 1384

ThreadCreationTime : 2007-06-19 09:56:38

BasePriority : Normal

FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)

ProductVersion : 5.1.2600.2696

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolsv.exe

OriginalFilename : spoolsv.exe

#:12 [ati2evxx.exe]

FilePath : C:\WINDOWS\System32 ProcessID : 1672

ThreadCreationTime : 2007-06-19 09:56:44

BasePriority : Normal

#:13 [explorer.exe]

FilePath : C:\WINDOWS ProcessID : 1720

ThreadCreationTime : 2007-06-19 09:56:45

BasePriority : Normal

FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 6.00.2900.2180

ProductName : Operativsystemet Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Utforskaren

InternalName : explorer

LegalCopyright : © Microsoft Corporation. Med ensamrätt.

OriginalFilename : EXPLORER.EXE

#:14 [avgamsvr.exe]

FilePath : C:\Program\Grisoft\AVGFRE~1 ProcessID : 1736

ThreadCreationTime : 2007-06-19 09:56:45

BasePriority : Normal

FileVersion : 7.5.0.453

ProductVersion : 7.5.0.453

ProductName : AVG Anti-Virus system

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG Alert Manager

InternalName : avgamsvr

OriginalFilename : avgamsvr.EXE

#:15 [avgupsvc.exe]

FilePath : C:\Program\Grisoft\AVGFRE~1 ProcessID : 1948

ThreadCreationTime : 2007-06-19 09:56:48

BasePriority : Normal

FileVersion : 7.5.0.420

ProductVersion : 7.5.0.420

ProductName : AVG 7.5 Anti-Virus System

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG Update Service

InternalName : avgupsvc

OriginalFilename : avgupdsvc.EXE

#:16 [avgemc.exe]

FilePath : C:\Program\Grisoft\AVGFRE~1 ProcessID : 2000

ThreadCreationTime : 2007-06-19 09:56:49

BasePriority : Normal

FileVersion : 7.5.0.460

ProductVersion : 7.5.0.460

ProductName : AVG Anti-Virus system

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG E-Mail Scanner

InternalName : avgemc

OriginalFilename : avgemc.exe

#:17 [buzzsawservice.exe]

FilePath : C:\Program\MATCO\BuzzsawService ProcessID : 2044

ThreadCreationTime : 2007-06-19 09:56:50

BasePriority : Normal

FileVersion : 1, 0, 0, 2

ProductVersion : 1, 0, 0, 2

ProductName : BuzzSawService

CompanyName : MATCO

FileDescription : BuzzSawService - Watches drives and defragments modified files and directories.

InternalName : BuzzSawSaw

OriginalFilename : BuzzSawSaw.exe

Comments : This service watches all drives unless directed not to by BuzzsawGU.

#:18 [agrsmmsg.exe]

FilePath : C:\WINDOWS ProcessID : 200

ThreadCreationTime : 2007-06-19 09:56:50

BasePriority : Normal

FileVersion : 2.1.21 2.1.21 11/21/2002 14:17:53

ProductVersion : 2.1.21 2.1.21 11/21/2002 14:17:53

ProductName : Agere SoftModem Messaging Applet

CompanyName : Agere Systems

FileDescription : SoftModem Messaging Applet

InternalName : smdmstat.exe

OriginalFilename : smdmstat.exe

#:19 [kpf4ss.exe]

FilePath : C:\Program\Kerio\Personal Firewall 4 ProcessID : 304

ThreadCreationTime : 2007-06-19 09:56:51

BasePriority : Normal

FileVersion : 4.2.2

ProductVersion : 4.2.2

ProductName : Kerio Personal Firewall 4

CompanyName : Kerio Technologies

FileDescription : Kerio Personal Firewall 4 - Service

InternalName : kpf4ss

OriginalFilename : kpf4ss.EXE

Comments : Kerio Personal Firewall 4 - Service

#:20 [avgcc.exe]

FilePath : C:\Program\Grisoft\AVGFRE~1 ProcessID : 528

ThreadCreationTime : 2007-06-19 09:56:54

BasePriority : Normal

FileVersion : 7.5.0.460

ProductVersion : 7.5.0.460

ProductName : AVG Anti-Virus system

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG Control Center

InternalName : AvgCC

OriginalFilename : AvgCC.EXE

#:21 [mwsoemon.exe]

FilePath : C:\Program\MYWEBS~1\bar\1.bin ProcessID : 564

ThreadCreationTime : 2007-06-19 09:56:55

BasePriority : Normal

FileVersion : 1,2,2,2

ProductVersion : 2,0,1,0

ProductName : My Web Search Bar for Internet Explorer, email clients, and messenger clients

CompanyName : MyWebSearch.com

FileDescription : My Web Search Email Plugin

InternalName : mwsoemon

OriginalFilename : mwsoemon.exe

#:22 [lfck.exe]

FilePath : C:\Program\LennartFranzén\LFConnectionKeeper ProcessID : 1508

ThreadCreationTime : 2007-06-19 09:57:05

BasePriority : Normal

FileVersion : 0, 5, 0, 10

ProductVersion : 5.10

ProductName : LF Connection Keeper

CompanyName : Lennart Franzén

FileDescription : LF Connection Keeper

InternalName : LFCK

OriginalFilename : lfck.exe

Comments : For the latest version and information visit our homepages on www.lfdomain.com

#:23 [wdfmgr.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 1248

ThreadCreationTime : 2007-06-19 09:57:08

BasePriority : Normal

FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act)

ProductVersion : 5.2.3790.1230

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows User Mode Driver Manager

InternalName : WdfMgr

OriginalFilename : WdfMgr.exe

#:24 [kpf4gui.exe]

FilePath : C:\Program\Kerio\Personal Firewall 4 ProcessID : 1920

ThreadCreationTime : 2007-06-19 09:57:08

BasePriority : Normal

FileVersion : 4.2.2

ProductVersion : 4.2.2

ProductName : Kerio Personal Firewall 4

CompanyName : Kerio Technologies

FileDescription : Kerio Personal Firewall 4 - GUI

InternalName : kpf4gui

OriginalFilename : kpf4gui.EXE

Comments : Kerio Personal Firewall 4 - GUI

#:25 [kpf4gui.exe]

FilePath : C:\Program\Kerio\Personal Firewall 4 ProcessID : 1480

ThreadCreationTime : 2007-06-19 09:57:14

BasePriority : Normal

FileVersion : 4.2.2

ProductVersion : 4.2.2

ProductName : Kerio Personal Firewall 4

CompanyName : Kerio Technologies

FileDescription : Kerio Personal Firewall 4 - GUI

InternalName : kpf4gui

OriginalFilename : kpf4gui.EXE

Comments : Kerio Personal Firewall 4 - GUI

#:26 [alg.exe]

FilePath : C:\WINDOWS\System32 ProcessID : 2700

ThreadCreationTime : 2007-06-19 09:57:23

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Application Layer Gateway Service

InternalName : ALG.exe

OriginalFilename : ALG.exe

#:27 [iexplore.exe]

FilePath : C:\Program\Internet Explorer ProcessID : 1772

ThreadCreationTime : 2007-06-19 10:27:07

BasePriority : Normal

FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 6.00.2900.2180

ProductName : Operativsystemet Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Internet Explorer

InternalName : iexplore

LegalCopyright : © Microsoft Corporation. Med ensamrätt.

OriginalFilename : IEXPLORE.EXE

#:28 [taskmgr.exe]

FilePath : C:\WINDOWS\system32 ProcessID : 2112

ThreadCreationTime : 2007-06-19 11:11:16

BasePriority : High

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : Operativsystemet Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Aktivitetshanteraren

InternalName : taskmgr

LegalCopyright : © Microsoft Corporation. Med ensamrätt.

OriginalFilename : taskmgr.exe

#:29 [ad-aware.exe]

FilePath : C:\Program\Lavasoft\Ad-Aware SE Personal ProcessID : 2644

ThreadCreationTime : 2007-06-19 11:23:18

BasePriority : Normal

FileVersion : 6.2.0.206

ProductVersion : VI.Second Edition

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

OriginalFilename : Ad-Aware.exe

Memory scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 9

Started registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 9

Started deep registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 9

Started Tracking Cookie scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@advertising[1].txt

Category : Data Miner

Comment : Hits:5

Value : Cookie:lifebook@advertising.com/

Expires : 2012-06-16 23:26:30

LastSync : Hits:5

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@atdmt[1].txt

Category : Data Miner

Comment : Hits:3

Value : Cookie:lifebook@atdmt.com/

Expires : 2012-06-16 02:00:00

LastSync : Hits:3

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@adtech[2].txt

Category : Data Miner

Comment : Hits:3

Value : Cookie:lifebook@adtech.de/

Expires : 2017-06-16 12:03:12

LastSync : Hits:3

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@track.adform[1].txt

Category : Data Miner

Comment : Hits:5

Value : Cookie:lifebook@track.adform.net/

Expires : 2007-08-18

LastSync : Hits:5

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@statse.webtrendslive[1].txt

Category : Data Miner

Comment : Hits:61

Value : Cookie:lifebook@statse.webtrendslive.com/

Expires : 2017-06-16 00:49:10

LastSync : Hits:61

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@research-int[1].txt

Category : Data Miner

Comment : Hits:53

Value : Cookie:lifebook@research-int.se/

Expires : 2008-06-18 13:18:24

LastSync : Hits:53

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@doubleclick[1].txt

Category : Data Miner

Comment : Hits:4

Value : Cookie:lifebook@doubleclick.net/

Expires : 2010-06-18 08:58:20

LastSync : Hits:4

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@ad.adtoma[2].txt

Category : Data Miner

Comment : Hits:30

Value : Cookie:lifebook@ad.adtoma.com/

Expires : 2038-01-19 05:14:08

LastSync : Hits:30

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@as1.falkag[1].txt

Category : Data Miner

Comment : Hits:5

Value : Cookie:lifebook@as1.falkag.de/

Expires : 2007-07-19 12:54:38

LastSync : Hits:5

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : lifebook@tradedoubler[2].txt

Category : Data Miner

Comment : Hits:26

Value : Cookie:lifebook@tradedoubler.com/

Expires : 2027-06-14 12:28:36

LastSync : Hits:26

UseCount : 0

Tracking cookie scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 10

Objects found so far: 19

Deep scanning and examining files (C:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

Scanning Hosts file......

Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

1 entries scanned.

New critical objects:0

Objects found so far: 19

Performing conditional scans...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 19

13:42:37 Scan Complete

Summary Of This Scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Total scanning time:00:18:47.712

Objects scanned:168926

Objects identified:11

Objects ignored:1

New critical objects:10[/log]

men jag inbillar mig att det bara är reklamgrejer. Är inte värdens vassaste på datorer men min brandvägg heter Kerio Personal Firewall (gratisverion) har AVG free edition och kör ofta ad-aware, men det verkar inte hjälpa.

Har läst en del trådar som sagt och märkt att hijack-log är nåt man ska skicka med, men det har jag ingen aning om vad det är . Dessutom verkar Cecilia var en höjdare på vilka problem som helst som dyker upp på skärmen.

Detta blir ett lååångt inlägg...

Jag har nämligen ytterligare lite frågor

c:\windows\system32\lsass.exe

c:\windows\system32\winlogon.exe

c:\windows\system32\userinit.exe

c:\windows\system32\svchost.exe

har jag "deny:at" genom brandväggen bra/dåligt?

Och vad i helafridens namn är det för skillnad på iexplore.exe och explore.exe för jag kan se båda i aktivitetshanteraren??

Hoppas nån orkar läsa mitt inlägg och bena upp alla frågorna för jag börjar bli trött/rädd/ledsen över att saker och ting inte fungerar som det ska. Är man sen ingen Einstein på datorer blir man bara trött när man inte vet vad alla konstiga ord/filnamn betyder.

Har Tight VNC installerat på datorn om nån kan hjälpa mig via detta program?

/Helena_1971

Lagt till LOG-taggar

När du har klistrat in en logg så var vänlig och markera loggen och tryck sedan på LOG-knappen som finns på samma rad som :thumbsdown: :thumbsup: i inläggsfönstret.

Cecilia - Moderator för Spionprogram (Spyware)

[inlägget ändrat 2007-06-19 13:51:39 av Cecilia]

June 19, 2007

Oki, hittade det. Ska tänka på det nästa gång. Är lite nybörjare med att lägga trådar på nätet..

June 19, 2007

MRU List(TAC index:0):9 total references
Tracking Cookie(TAC index:3):10 total references

MRU listor, programmen vet vilka filer som du har öppnat i dem förut, TAC 0 betyder helt ofarligt.

Tracking cookies, cookies som håller reda på t ex vilka annonser du sett och har klickat på och liknande. Helt ofarliga för datorn, men lite obehagliga för den personliga integriteten så därför att det trevligt att rensa bort dem då och då.

har jag "deny:at" genom brandväggen bra/dåligt?

Om du bara har en dator och inget lokalt nätverk så behöver de troligen inte komma igenom brandväggen. Kanske svchost men du märker ju om det är något som inte fungerar. Däremot så är alla filerna standard Windows-filer.

Och vad i helafridens namn är det för skillnad på iexplore.exe och explore.exe för jag kan se båda i aktivitetshanteraren??

iexplore.exe är Internet Explorer.

explorer.exe är Den här datorn, Utforskaren och Skrivbordet. Utforskaren heter Explorer på engelska.

Vi kan ju se om HijackThis visar något till att börja med:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Installera, kör, skanna och spara loggen (inget annat).

I ditt svar bifogar du HijackThis-loggen på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

June 19, 2007

[log]Logfile of HijackThis v1.99.1

Scan saved at 14:10:27, on 2007-06-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe

C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe

C:\Program\Grisoft\AVGFRE~1\avgemc.exe

C:\Program\MATCO\BuzzsawService\BuzzSawService.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program\Kerio\Personal Firewall 4\kpf4ss.exe

C:\Program\Grisoft\AVGFRE~1\avgcc.exe

C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

C:\Program\LennartFranzén\LFConnectionKeeper\lfck.exe

C:\Program\Kerio\Personal Firewall 4\kpf4gui.exe

C:\Program\Internet Explorer\IEXPLORE.EXE

C:\Program\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.leta.se/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program\MyWebSearch\bar\1.bin\MWSBAR.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [LtMoh] C:\Program\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [Apoint] C:\Program\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [WinVNC] "C:\Program\TightVNC\WinVNC.exe" -servicehelper

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program\InterVideo\Common\Bin\WinCinemaMgr.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb001YYNO_ZSYYYYYY62SE

O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe (file missing)

O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe (file missing)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Program\ladbrokesMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) - http://games.blip.se/midasa.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab

O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab

O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://games.blip.se/ctl/kingcomie.cab

O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} - http://zone.msn.com/bingame/rock/default/popcaploader1.cab

O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.onskefoto.se/photos/upload/ImageUploader4.cab

O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab

O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab

O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab'>http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab

O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab

O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/instant-play-en/FlashAX.cab

O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Buzzsaw_Defragmentation - MATCO - C:\Program\MATCO\BuzzsawService\BuzzSawService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program\Kerio\Personal Firewall 4\kpf4ss.exe

O23 - Service: LF Connection Keeper Service (LFCK) - Unknown owner - C:\Program\LennartFranzén\LFConnectionKeeper\lfck.exe" --startAsService (file missing)

O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program\TightVNC\WinVNC.exe" -service (file missing)

[/log]

June 19, 2007

Kontrollpanelen - Lägg till eller ta bort program

Ta bort följande om de finns där

MyWebSearch

mwsBar

Det är en gammal Java-version med säkerhetshål i datorn. Avinstallera alla Java/J2SE i Kontrollpanelen - Lägg till eller ta bort program och installera därefter en ny från http://www.java.com/sv/

[log]Skanna med HijackThis och bocka för:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program\MyWebSearch\bar\1.bin\MWSBAR.DLL

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb001YYNO_ZSYYYYY

Y62SE

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCent

ralFWBInitialSetup1.0.0.15.cab

Om MultiPoker och/eller PartyPoker är avinstallerade så kan du även bocka för de rader av följande som motsvarar resp. pokerspel. Det är inga farliga saker utan i så fall bara onödiga rester.

O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe (file missing)

O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe (file missing)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe (file missing)

Avsluta alla andra program.

Tryck Fix checked.

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

Ställ in Utforskaren så att du kan se alla filer:

Verktyg - (Mapp)alternativ eller liknande - Visning

Välj Visa dolda filer och mappar

Avbocka Dölj filnamnstillägg för kända filtyper

Avbocka Dölj skyddade operativsystemfiler

Ta bort mapparna (om de finns kvar):

C:\Program\MyWebSearch

Starta om i normalt läge och så en ny HijackThis-logg.[/log]

June 19, 2007

[log]Logfile of HijackThis v1.99.1

Scan saved at 14:47:39, on 2007-06-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe

C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe

C:\Program\Grisoft\AVGFRE~1\avgemc.exe

C:\Program\MATCO\BuzzsawService\BuzzSawService.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program\Kerio\Personal Firewall 4\kpf4ss.exe

C:\Program\Grisoft\AVGFRE~1\avgcc.exe

C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

C:\Program\LennartFranzén\LFConnectionKeeper\lfck.exe

C:\Program\Kerio\Personal Firewall 4\kpf4gui.exe

C:\Program\Internet Explorer\IEXPLORE.EXE

C:\Program\Hijackthis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\msiexec.exe