Små programmer stjæler ram?

Ja, der kan godt være mange, de fleste er systemresoursser, men kan også gemme sig unødvendige ting.

Lav et screenshot, så kan vi se hvad det er for nogle..

Nævn lige nogen af dem;)

Aktiv systemproces, system, smss.exe, csrss.exe, winlogon.exe, services.exe, lsass.exe, svchost.exe,lexbces.exe, spoolsv.exe, LEXPPS.exe, svchost.exe, naviagent.exe, Zanda.exe, ntrtscan.exe, nvsvc32.exe, regsvc.exe, mstask.exe, tmlisten.exe, Nvcoas.exe, Nvcsched.exe, Nipsvc.exe, Njeeves.exe, explorer.exe, Disk_monitor.exe, devldr32.exe, ahqtb.exe, shpc32.exe, PccNTMON.exe, CMEsys.exe, itouch.exe, realsched.exe, qttask.exe, EM_EXEC.EXE, pptd40nt.exe, hpwuSchd.exe, backWeb-8876480, msiexec.exe, Zlh.exe, dmserver.exe, internat.exe, CM_camera.exe, Nymse.exe, CClaw.exe, Nip.exe, Datemanager.exe, ltsstart.exe, remind32.exe, PrecisionTime.e, GMT.exe, Iexplorer.exe, taskmgr.exe

Hent Spybot og Hijackthis her : http://www.arlet.dk/spybothjt.htm

Du har en del snavs på maskinen

tak. Det prøver jeg. læg et svar og få point

Du skal smide den hijackthis log herind, så jeg kan tjekke den for snavs.

Først når de problem er helt løst skal der uddeles point

Logfile of HijackThis v1.97.7
Scan saved at 10:17:22, on 15-03-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\Programmer\VeriSign\NAVI\naviagent.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\OfficeScan\ntrtscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan\tmlisten.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\WINNT\Explorer.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINNT\System32\devldr32.exe
C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\System32\shpc32.exe
C:\OfficeScan\pccntmon.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Norman\Nvc\BIN\ZLH.EXE
C:\WINNT\System32\internat.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINNT\system32\msiexec.exe
C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\lotus\wordpro\ltsstart.exe
C:\lotus\register\remind32.exe
C:\Documents and Settings\Jens Peter Dahlgaard\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: VeriSign Inc. i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan\pccntmon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 ins490cx.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [Disk Monitor] C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
O4 - HKLM\..\Run: [PLoader] c:\program files\umsd\umsd.exe sys_auto_run C:\Program Files\UMSD
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SmartSuite 97 Registration.lnk = C:\lotus\register\remind32.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Statusmonitor.lnk = C:\Program Files\XEROX_XD\ENGSS.EXE
O8 - Extra context menu item: Åbn billede i &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1030\phdintl.dll/phdContext.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Indstillinger (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38032.5567708333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FF2ED99D-13F1-460A-9A8F-C1A876B62D37} - https://www.web-direct.dk/wdx.cab

Tjekker den lige igennem

Gå først i kontrolpanel - tilføj/fjern og slet datemanager og precisionstime

Derefter skal du nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.




R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)

O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab




Find og slet i fejlsikret(f8 ved opstart):



C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe


Gå ind i søg og søg i skjulte filer og mapper og søg på: datemanager / PrecisionTime / gtm  slet alt hvad den finder


Så skal du hente servicepack 4 til dit windows her : http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/


Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.

okay. Det tager nok lige lidt tid...

Ja, men den tid vil du ikke fortryde at du har brugt*S*

Har lidt problemer... Når jeg går ind i Highjackthis og sætter flueben i dem du har sagt og jeg så trykker på "fix checked" er det som om programmet går i stå og programmet ikke svarer. har slettet de nævnte filer i fejlsikret tilstand.

Hvordan søger jeg efter skjulte filer og mapper?

Har du husket at lukke alle andre vinduer fornær hijack vinduet, når du trykker fix?? ellers tag et bpar stykker af gangen.

Inde i søg går du ned i avanceret søg, der kan du marker søg i skjulte filer og mapper

hijackthis bliver ved med at gå i stå selom jeg kun tager en enkelt af gangen. Kan man bruge et andet program

C:\WINNT\Updreg.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

Find og slet disse 3.

Derefter genstarter du og smider en ny log herind

Logfile of HijackThis v1.96.0
Scan saved at 11:59:26, on 15-03-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\VeriSign\NAVI\naviagent.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\OfficeScan\ntrtscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan\tmlisten.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\WINNT\Explorer.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINNT\System32\devldr32.exe
C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\System32\shpc32.exe
C:\OfficeScan\pccntmon.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Norman\Nvc\BIN\ZLH.EXE
C:\WINNT\System32\internat.exe
C:\WINNT\system32\msiexec.exe
C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\lotus\wordpro\ltsstart.exe
C:\lotus\register\remind32.exe
C:\Documents and Settings\Jens Peter Dahlgaard\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: VeriSign Inc. i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan\pccntmon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 ins490cx.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [Disk Monitor] C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
O4 - HKLM\..\Run: [PLoader] c:\program files\umsd\umsd.exe sys_auto_run C:\Program Files\UMSD
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SmartSuite 97 Registration.lnk = C:\lotus\register\remind32.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Statusmonitor.lnk = C:\Program Files\XEROX_XD\ENGSS.EXE
O8 - Extra context menu item: Åbn billede i &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1030\phdintl.dll/phdContext.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Indstillinger (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38032.5567708333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FF2ED99D-13F1-460A-9A8F-C1A876B62D37} - https://www.web-direct.dk/wdx.cab

Hvad er det nu for en gammel log version.

hent en nyere 1.97.7 som du kørte før her: http://www.arlet.dk/hjt.exe

Logfile of HijackThis v1.97.7
Scan saved at 12:12:42, on 15-03-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\VeriSign\NAVI\naviagent.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\OfficeScan\ntrtscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan\tmlisten.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\WINNT\Explorer.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINNT\System32\devldr32.exe
C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\System32\shpc32.exe
C:\OfficeScan\pccntmon.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Norman\Nvc\BIN\ZLH.EXE
C:\WINNT\System32\internat.exe
C:\WINNT\system32\msiexec.exe
C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\lotus\wordpro\ltsstart.exe
C:\lotus\register\remind32.exe
C:\Documents and Settings\Jens Peter Dahlgaard\Skrivebord\hijackthis.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINNT\system32\cidaemon.exe
C:\Documents and Settings\Jens Peter Dahlgaard\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: VeriSign Inc. i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan\pccntmon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 ins490cx.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [Disk Monitor] C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
O4 - HKLM\..\Run: [PLoader] c:\program files\umsd\umsd.exe sys_auto_run C:\Program Files\UMSD
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SmartSuite 97 Registration.lnk = C:\lotus\register\remind32.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Statusmonitor.lnk = C:\Program Files\XEROX_XD\ENGSS.EXE
O8 - Extra context menu item: Åbn billede i &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1030\phdintl.dll/phdContext.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Indstillinger (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38032.5567708333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FF2ED99D-13F1-460A-9A8F-C1A876B62D37} - https://www.web-direct.dk/wdx.cab

Start – kør – skriv: msconfig – fanebladet start – fjerne vingen ud for følgende filer:
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot

genstart og så er der kun denne ene der skal fixes i hijackthis:
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)

genstart og ny log

når jeg skriver "msconfig" får jeg en fejlmelding der siger: filen ''msconfig" eller en af de tilhørende komponenter blev ikke fundet. kontroller at stien og filnavnet er korrekt og at alle biblioteker er tilgængelige.

PS: skal nok give nogle flere point

Nej, w2k har ikke msconfig..min fejl.

Hent den her: http://www.svrops.com/svrops/dwnldoth.htm

Logfile of HijackThis v1.97.7
Scan saved at 12:47:05, on 15-03-2004
Platform: Windows 2000  (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\Programmer\VeriSign\NAVI\naviagent.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\OfficeScan\ntrtscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan\tmlisten.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\WINNT\Explorer.exe
C:\WINNT\System32\devldr32.exe
C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\System32\shpc32.exe
C:\OfficeScan\pccntmon.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Norman\Nvc\BIN\ZLH.EXE
C:\WINNT\System32\internat.exe
C:\WINNT\system32\msiexec.exe
C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\lotus\wordpro\ltsstart.exe
C:\lotus\register\remind32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jens Peter Dahlgaard\Skrivebord\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jubii.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: VeriSign Inc. i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programmer\VeriSign\i-Nav\i-nav_4_1_3.dll
O3 - Toolbar: @msdxmLC.dll,-1@1030,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)
O4 - HKLM\..\Run: [AudioHQ] C:\Programmer\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan\pccntmon.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 ins490cx.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [Disk Monitor] C:\Programmer\Generic\6-in-1 USB Card Reader Driver v1.7\Disk_Monitor.exe
O4 - HKLM\..\Run: [PLoader] c:\program files\umsd\umsd.exe sys_auto_run C:\Program Files\UMSD
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SmartSuite 97 Registration.lnk = C:\lotus\register\remind32.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programmer\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Statusmonitor.lnk = C:\Program Files\XEROX_XD\ENGSS.EXE
O8 - Extra context menu item: Åbn billede i &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1030\phdintl.dll/phdContext.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Hjælp (HKLM)
O9 - Extra 'Tools' menuitem: i-Nav Indstillinger (HKLM)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38032.5567708333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FF2ED99D-13F1-460A-9A8F-C1A876B62D37} - https://www.web-direct.dk/wdx.cab

Har du prøvet igen at fixe denne i hijackthis:
O3 - Toolbar: (no name) - {FE6BC4EF-5676-484B-88AE-883323913256} - (no file)

Ellers er den fin.
For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

og se at få hentet den sp4