Søg
Avatar billede rickypriv Nybegynder
18. april 2004 - 20:56 Der er 17 kommentarer og
2 løsninger

Links i foretrukne og på skrivebord kan ikke slettes

Hej.

Jeg har fået den svære opgave at skulle rense ud i en computer.
Problemet ligger i at der er en række links i Foretrukne og et par stykker på skrivebordet , som ikke kan slettes - der er her tale om links til Pornografi ol.

Jeg har prøvet alle mulige Spyware - såsom AdAware - fjernere.
Jeg har også scannet den for vira.

Men det ser ikke ud til at jeg kan finde løsningen.
Jeg har også været inde og deaktivere det jeg mener kunne undværes i windows opstart i Programmer -> Tilbehør -> Systemværktøjer -> Systemoplysningner -> Funktioner -> Værktøj til systemkonfiguration

Jeg kan da her skynde mig at tilføje at der er tale om en Windows 98.

Jeg har også villet se på yderligere opsætninger , men har af en eller anden underlig grund ikke rettigheder til at starte de punkter der er i Kontrolpanelet .. !

Jeg håber i kan guide mig lidt her - er ikke glad for at skulle formattere en anden persons computer, da han jo nok ikke kører det samme system med filer (tænker her på backup).
Avatar billede arlet Juniormester
18. april 2004 - 20:57 #1
Hent en hijackthis : http://www.arlet.dk/hjt.htm
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:00 #2
Logfile of HijackThis v1.97.7
Scan saved at 21:17, on 18-04-2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPTBOX.EXE
C:\PROGRAMMER\TDC INTERNET\WINPPPOVERETHERNET.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\APVXDWIN.EXE
C:\WINDOWS\SYSTEM32\WINPROC32.EXE
C:\HPOJTPRO\DTOLE.EXE
C:\HPOJTPRO\PROCDB.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\PAVPROXY.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPDBMGR.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMER\FæLLES FILER\MICROSOFT SHARED\MSINFO\MSINFO32.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HJT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://4-counter.com/?a=2&b=dia
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://4-counter.com/?b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ultralinks.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://teenhqpics.com/r/scr.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=HS01:80;ftp=HS01:80;gopher=HS01:80;https=HS01:80
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://search123.biz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
F1 - win.ini: load=c:\hpojtpro\onlreg\remind.exe
O1 - Hosts: 5377608764 spywareinfo.com
O1 - Hosts: 5377608764 www.spywareinfo.com
O1 - Hosts: 5377608764 lavasoftsupport.com
O1 - Hosts: 5377608764 www.lavasoftsupport.com
O1 - Hosts: 5377608764 searchv.com
O1 - Hosts: 5377608764 www.searchv.com
O1 - Hosts: 5377608764 approvedlinks.com
O1 - Hosts: 5377608764 www.approvedlinks.com
O1 - Hosts: 5377608764 searching-the-net.com
O1 - Hosts: 5377608764 www.searching-the-net.com
O1 - Hosts: 5377608764 ywebsearch.info
O1 - Hosts: 5377608764 www.ywebsearch.info
O1 - Hosts: 5377608764 ok-search.com
O1 - Hosts: 5377608764 www.ok-search.com
O1 - Hosts: 5377608764 ewebsearch.net
O1 - Hosts: 5377608764 www.ewebsearch.net
O1 - Hosts: 5377608764 www.008k.com
O1 - Hosts: 5377608764 autosearcher.com
O1 - Hosts: 5377608764 www.autosearcher.com
O1 - Hosts: 5377608764 www.smutserver.com
O1 - Hosts: 5377608764 www.smuthosts.com
O1 - Hosts: 5377608764 www.kinghost.com
O1 - Hosts: 5377608764 exit.xitcash.com
O1 - Hosts: 5377608764 www.exitforcash.com
O1 - Hosts: 5377608764 exit.sellyourexit.com
O1 - Hosts: 5377608764 sex-explorer.com
O1 - Hosts: 5377608764 www.sex-explorer.com
O1 - Hosts: 5377608764 www.online-dialer.com
O1 - Hosts: 5377608764 network.nocreditcard.com
O1 - Hosts: 5377608764 www.mtreexxx.net
O1 - Hosts: 5377608764 www.0190-dialer.com
O1 - Hosts: 5377608764 install.xxxtoolbar.com
O1 - Hosts: 5377608764 www.xxxtoolbar.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [MPTBox] C:\Programmer\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [WinPoET] C:\Programmer\TDC Internet\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [keymgrldr] rundll32 setupapi,InstallHinfSection Oemkeymgr9x 128 keymgr3.inf
O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Internet Protocol] C:\WINDOWS\SYSTEM32\WINPROC32.EXE
O4 - Startup: HP PictureLink.lnk = C:\HPOJTPRO\DTOle.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O13 - WWW. Prefix: http://
O16 - DPF: {DC840BE3-16D9-11D0-BA39-00C04FDDB4CD} (Conveyer-kontrolenhed) - http://cdm.microsoft.com/update/Jan8/OSB/6/conveyer1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack.cab
O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38092.3136342593
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/dk/games1.cab
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:01 #3
Hmm .. kan tydeligt se her er der ligger meget mere smuds en godt er !!
Avatar billede arlet Juniormester
18. april 2004 - 21:03 #4
Ja, men den skal vi nok få god som ny..

Hent og kør CWSHredder herfra: http://www.arlet.dk/special.htm
genstart og ny hijackthis log
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:09 #5
Jeg får en besked om at der ikke kan skabes forbindelse til Serveren , når jeg klikker på linket til CWShredder.exe
Avatar billede arlet Juniormester
18. april 2004 - 21:12 #6
hmm. min virker fint..

Så prøv: Master-search, som du finder her:
http://www.arlet.dk/special.htm
Genstart og ny log
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:20 #7
Her er så den nye log efter Master-search er kørt , hvor den sagde at den havde kørt problemfrit:

Logfile of HijackThis v1.97.7
Scan saved at 21:35, on 18-04-2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPTBOX.EXE
C:\PROGRAMMER\TDC INTERNET\WINPPPOVERETHERNET.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\APVXDWIN.EXE
C:\WINDOWS\SYSTEM32\WINPROC32.EXE
C:\HPOJTPRO\DTOLE.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\PAVPROXY.EXE
C:\HPOJTPRO\PROCDB.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPDBMGR.EXE
C:\HJT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://brutal-video.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ultralinks.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://brutal-video.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://teenhqpics.com/r/scr.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=HS01:80;ftp=HS01:80;gopher=HS01:80;https=HS01:80
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://search123.biz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
F1 - win.ini: load=c:\hpojtpro\onlreg\remind.exe
O1 - Hosts: 5377608764 spywareinfo.com
O1 - Hosts: 5377608764 www.spywareinfo.com
O1 - Hosts: 5377608764 lavasoftsupport.com
O1 - Hosts: 5377608764 www.lavasoftsupport.com
O1 - Hosts: 5377608764 searchv.com
O1 - Hosts: 5377608764 www.searchv.com
O1 - Hosts: 5377608764 approvedlinks.com
O1 - Hosts: 5377608764 www.approvedlinks.com
O1 - Hosts: 5377608764 searching-the-net.com
O1 - Hosts: 5377608764 www.searching-the-net.com
O1 - Hosts: 5377608764 ywebsearch.info
O1 - Hosts: 5377608764 www.ywebsearch.info
O1 - Hosts: 5377608764 ok-search.com
O1 - Hosts: 5377608764 www.ok-search.com
O1 - Hosts: 5377608764 ewebsearch.net
O1 - Hosts: 5377608764 www.ewebsearch.net
O1 - Hosts: 5377608764 www.008k.com
O1 - Hosts: 5377608764 autosearcher.com
O1 - Hosts: 5377608764 www.autosearcher.com
O1 - Hosts: 5377608764 www.smutserver.com
O1 - Hosts: 5377608764 www.smuthosts.com
O1 - Hosts: 5377608764 www.kinghost.com
O1 - Hosts: 5377608764 exit.xitcash.com
O1 - Hosts: 5377608764 www.exitforcash.com
O1 - Hosts: 5377608764 exit.sellyourexit.com
O1 - Hosts: 5377608764 sex-explorer.com
O1 - Hosts: 5377608764 www.sex-explorer.com
O1 - Hosts: 5377608764 www.online-dialer.com
O1 - Hosts: 5377608764 network.nocreditcard.com
O1 - Hosts: 5377608764 www.mtreexxx.net
O1 - Hosts: 5377608764 www.0190-dialer.com
O1 - Hosts: 5377608764 install.xxxtoolbar.com
O1 - Hosts: 5377608764 www.xxxtoolbar.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [MPTBox] C:\Programmer\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [WinPoET] C:\Programmer\TDC Internet\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [keymgrldr] rundll32 setupapi,InstallHinfSection Oemkeymgr9x 128 keymgr3.inf
O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Internet Protocol] C:\WINDOWS\SYSTEM32\WINPROC32.EXE
O4 - Startup: HP PictureLink.lnk = C:\HPOJTPRO\DTOle.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O13 - WWW. Prefix: http://
O16 - DPF: {DC840BE3-16D9-11D0-BA39-00C04FDDB4CD} (Conveyer-kontrolenhed) - http://cdm.microsoft.com/update/Jan8/OSB/6/conveyer1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack.cab
O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38092.3136342593
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/dk/games1.cab
Avatar billede arlet Juniormester
18. april 2004 - 21:22 #8
ok, så må jeg i gang med manuelt arbejde.

Tjekker loggen igennem nu..
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:23 #9
Jeg kan da lige prøve at køre det første program igen , for at se om den ville denne gang. :)
Avatar billede rickypriv Nybegynder
18. april 2004 - 21:24 #10
nix .. stadig ingen reaktion på linket . :(
Avatar billede arlet Juniormester
18. april 2004 - 21:32 #11
Flyt først filen Hijackthis til en mappe oprettet kun til den.

Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://brutal-video.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ultralinks.info/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2&b=dia
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://brutal-video.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://brutal-video.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://drusearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://drusearch.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://drusearch.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://drusearch.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://teenhqpics.com/r/scr.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=HS01:80;ftp=HS01:80;gopher=HS01:80;https=HS01:80
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://search123.biz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm

F1 - win.ini: load=c:\hpojtpro\onlreg\remind.exe

ALLE 01

O4 - HKLM\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKLM\..\RunServices: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Security Assistant] C:\WINDOWS\system32\rundll32.vbe
O4 - HKCU\..\Run: [Windows Internet Protocol] C:\WINDOWS\SYSTEM32\WINPROC32.EXE

O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE

O13 - WWW. Prefix: http://

O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://download4.payoutpal.com/download/dialer/cax.cab



Find og slet i fejlsikret(f8 ved opstart):


C:\WINDOWS\SYSTEM32\WINPROC32.EXE



Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Avatar billede rickypriv Nybegynder
18. april 2004 - 22:02 #12
All done ..

Her er den nye log :

Logfile of HijackThis v1.97.7
Scan saved at 22:16, on 18-04-2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPTBOX.EXE
C:\PROGRAMMER\TDC INTERNET\WINPPPOVERETHERNET.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\APVXDWIN.EXE
C:\HPOJTPRO\DTOLE.EXE
C:\HPOJTPRO\PROCDB.EXE
C:\PROGRAMMER\PANDA SOFTWARE\PANDA ANTIVIRUS TITANIUM\PAVPROXY.EXE
C:\PROGRAMMER\CANON\MULTIPASS4\MPDBMGR.EXE
C:\HJT\HJT.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [MPTBox] C:\Programmer\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [WinPoET] C:\Programmer\TDC Internet\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: HP PictureLink.lnk = C:\HPOJTPRO\DTOle.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {DC840BE3-16D9-11D0-BA39-00C04FDDB4CD} (Conveyer-kontrolenhed) - http://cdm.microsoft.com/update/Jan8/OSB/6/conveyer1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia.cab
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38092.3136342593
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/dk/games1.cab

De triste genveje på skrivebordet er væk , men ikke dem i foretrukne .. dem skal jeg vel ind og slette efterfølgende .. ?
Avatar billede arlet Juniormester
18. april 2004 - 22:19 #13
Bare for sjov, så prøv at gå ind på cwshredder igen og se om du nu kan
Avatar billede rickypriv Nybegynder
18. april 2004 - 22:22 #14
Ja, nu kunne jeg godt hente den .. det lykkedes mig dog tidligere at hente den fra en anden side .. søgte efter programmet på Google.com

Skal jeg køre den  ?
Avatar billede rickypriv Nybegynder
18. april 2004 - 22:23 #15
Der er iøvrigt ikke nogen opdateringer til den .. :D
Avatar billede arlet Juniormester
18. april 2004 - 22:26 #16
ja, kør du den bare.

Du er ren.

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm
Avatar billede rickypriv Nybegynder
18. april 2004 - 22:29 #17
Tusind tak .. det var virkeligt flot arbejde Arlet !!

Point til dig. ;)
Avatar billede arlet Juniormester
18. april 2004 - 22:30 #18
Velbekommen
Avatar billede rickypriv Nybegynder
18. april 2004 - 22:38 #19
Jeg skal nok anbefale dig til ham der til dagligt bruger computeren. Han bliver helt sikkert lige så glad. ;)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Browsere kategorien

Titel Indlæg Oprettet Seneste aktivitet
lukkede cookies i microsoft edge Af ole falsted i Browsere 4 26/10/202517:02 01/11/202514:19
Firefox: Hvordan forhindrer jeg DOOM i altid at loade ved start af firefox? Af KurtG i Browsere 7 13/10/202517:21 14/10/202508:42
Gøre højden af tabelrække mindre Af KurtG i Browsere 1 08/10/202509:39 08/10/202509:41
Kan ikke logge på HBO Max på pc Af Finn-Erik i Browsere 2 06/10/202516:52 14/10/202511:55
Lukket ude Af arnel i Browsere 1 05/10/202512:37 05/10/202514:14
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
58 min siden Fejl Af buls i Windows
I dag 13:44 Adgang til Google konto via Ipad Af cyperbent i E-mail programmer
I går 09:50 Mobilpay svindel Af nu_igen i Andre onlineløsninger
22/0120:51 Knap til ipad Af FinnLauridsen i Excel
21/0113:53 Icloud mail via Outlook Af lbc i E-mail programmer
White papers
Flere white papers »